Analysis
- user interaction
yes - max time kernel
1800s - max time network
1801s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-fr - resource tags
- submitted
12/07/2026, 15:06
General
- Target wireshark-portable.html
- Size 13KB
- Sample260712-sg4ftacs2j
- SHA256 192751f4803c049b2a7c1246f0d9009fada56d13634bf14ee2f100aebce6e5ce
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 20 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 27 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 25 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wireshark-portable.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc7eb2c188,0x7ffc7eb2c194,0x7ffc7eb2c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,18072672525046048058,13981374220876144977,262144 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,5225641349178328027,18418307704235021697,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17126677640907061897,553933443685546060,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3732046040660089037,12826131326323614545,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,2758947518358733994,2321881117710884334,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14029614460929426656,4124560249592243328,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,4958704772018602221,15489583939570762549,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,11035975465779185141,15523446700552672805,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13984730115477961251,2119093330735911072,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6360822852172401385,10171898660948037832,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6360822852172401385,10171898660948037832,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15741979713534038334,4266909294283590996,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,10096859246673502212,2101976216780683326,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,14949264503394042305,5005587005987907516,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,9874374189702547337,101436494440614290,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,14255751535853168062,725551336377493453,262144 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7505837516453852551,535160589388106033,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,12974748025009951614,1651888761369194182,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,5022759894910426817,11985007854340813627,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1939450483310242759,1889432358872800192,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7408097731796198602,17938370212364160075,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,3052429055985200988,7112296934377123799,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6308,i,3846865291740415181,16651319574254777641,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3616,i,11140229001295429313,671932827152101102,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3744,i,9682638540064862655,8940876070735226298,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6180,i,15147917452787116890,17265765678418619241,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8936577290247340633,1314828149757224905,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,5069203243234997971,5427057513373378500,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,7312415411439170866,17088227356957197248,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3684,i,7836003646126607524,9870589570608339210,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\discord-portable-win64-1.0.9232-25-setup.exe"C:\Users\Admin\Downloads\discord-portable-win64-1.0.9232-25-setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ANQ2Q.tmp\discord-portable-win64-1.0.9232-25-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ANQ2Q.tmp\discord-portable-win64-1.0.9232-25-setup.tmp" /SL5="$10010A,92221316,1187328,C:\Users\Admin\Downloads\discord-portable-win64-1.0.9232-25-setup.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\portapps\discord-portable\discord-portable.exe"C:\portapps\discord-portable\discord-portable.exe"4⤵
- Executes dropped EXE
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exeC:\portapps\discord-portable\app\app-1.0.9232\Discord.exe --user-data-dir=C:\portapps\discord-portable\data5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exeC:\portapps\discord-portable\app\app-1.0.9232\Discord.exe --type=crashpad-handler --user-data-dir=C:\portapps\discord-portable\data /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\portapps\discord-portable\data\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9232 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4bc,0x4d0,0x7ff66a64b074,0x7ff66a64b080,0x7ff66a64b0906⤵
- Executes dropped EXE
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=gpu-process --user-data-dir="C:\portapps\discord-portable\data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:116⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f6⤵
- Modifies registry class
- Modifies registry key
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=renderer --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\portapps\discord-portable\app\app-1.0.9232\resources\app" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783868256023307 --launch-time-ticks=1624863430 --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:16⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f6⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe\",-1" /f6⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe\" --url -- \"%1\"" /f6⤵
- Modifies registry class
- Modifies registry key
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=renderer --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\portapps\discord-portable\app\app-1.0.9232\resources\app" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1783868256023307 --launch-time-ticks=1630694499 --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3792 --enable-node-leakage-in-renderers /prefetch:16⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=renderer --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\portapps\discord-portable\app\app-1.0.9232\resources\app" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1783868256023307 --launch-time-ticks=1630969482 --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3996 --enable-node-leakage-in-renderers /prefetch:16⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia7⤵
- Executes dropped EXE
-
-
C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd7⤵
- Executes dropped EXE
-
-
C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel7⤵
- Executes dropped EXE
-
-
C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\portapps\discord-portable\app\app-1.0.9232\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation7⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:146⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --user-data-dir="C:\portapps\discord-portable\data" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:126⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=af681f21-1510-48c8-9f7d-3151b8cec7c06⤵
-
-
C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe"C:\portapps\discord-portable\app\app-1.0.9232\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\portapps\discord-portable\data" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,2238758030668695445,5211704578703493313,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:106⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3588,i,3521134044998266119,3356840161695319860,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6920,i,1238258990782274097,5754609537110098192,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,17786105972730953406,12536227465628483186,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,15731766919854490318,4867696250040007018,524288 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6900,i,16801316805478459020,14729304927756202443,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7840,i,3157012738437076029,9878838384579823173,2097152 --field-trial-handle=2628,i,12070018824224030978,5514301159057573189,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffc7eb2c188,0x7ffc7eb2c194,0x7ffc7eb2c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,3145503286346390116,16893308202247535069,262144 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,2736123785786104124,16818253825887557489,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,4027869875456901792,17582660836001164189,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,5532685290195984163,7800498152315895443,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,5532685290195984163,7800498152315895443,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10459460204557069637,14721864057882969659,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,12243733376800940997,4599878119132094054,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,2183426571818680394,13572590068446811054,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,10814158536176464473,1624803270959331248,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,1576038469233669441,1960658762652380403,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3172286177301721892,3135042919657514946,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,6432786742471900755,5312673356865609934,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,3900826576373878939,4845055163435444550,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17854173169786910007,10557585032915883558,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6809047696155728074,2305615005335147984,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,836786800701117368,12802619926406198036,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,5418698287225472032,11513020753643847697,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5028,i,15619901741424973666,5219765290830520788,262144 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3953498550680971241,8385657671886711663,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,11049313134456974965,17523043796350474494,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,15008890951912505757,10751046265939402978,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,11291830006754659147,486706916966617414,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,17897989918317594865,11217052714035067387,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,18155451424954989457,1577147800331278024,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,1646110571381417188,7152714064078041991,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14268212457246223794,3960120200251996705,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,8569258165484011983,8765016025295008571,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,16775749581886274251,8754161756281808198,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,16076956955941490597,2253906535745511948,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3056,i,16786715948911523519,14830161289177500133,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,18421619969825836596,4031105997378231665,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1504,i,10228405320816701103,5977853036119383466,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,1320535636154340220,4793716484961184658,524288 --field-trial-handle=2576,i,15360257820285661536,1890550466221870725,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D01⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
settings.dat
1135036b-d25f-4f5f-9b4c-b60a5ec40fa6.tmp
15f4b144-01e3-4d0e-9c5f-349aefc3c0ab.tmp
LOG.old
LOG.old
LOG.old
LOG.old
MANIFEST-000001
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity~RFe699ef8.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt
index.txt~RFe697cba.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
f37e9826-e77b-489b-8723-d6e44603b7a4.tmp
OperationConfig
OperationConfig~RFe5a47c8.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe67d3fc.TMP
cca03f2b-97a7-402d-83d7-e6e09c56e5dc.tmp
e99fce03-ab77-4609-aa0b-7fa1a0cc14c1.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
f7a19671-0622-463b-8516-c0b28e7e6a8e.tmp
discord-portable-win64-1.0.9232-25-setup.tmp
content_new.js
LICENSE
Staging
icudtl.dat
LICENSE
package.json
gpu_encoder_helper.exe
bootstrap.js
buildInfo.js
index.js
analytics.js
paths.js
processUtils.js
index.js
hubextensions.js
package.json
index.js
package.json
is-INSLF.tmp
is-82PSM.tmp
is-F2CSL.tmp
index.js
package.json
aggregate-errors.js
browser.js
dsn.js
error.js
index.js
index.js
is.js
logger.js
string.js
worldwide.js
package.json
is-OUT5R.tmp
is-OPO6M.tmp
package.json
build_info.json
v8_context_snapshot.bin
09e734cfa2a129b7a4aa37cea30e39854a673c2ad8a042de434d6561dc6d73a2
0b92bde4418affaa34374f1f2e997b54720560be970f6633416408ae2b52816f
25ded70cf056a51c73d37e649ad68d63c1488a9d42e025b050e88bdcf12cf474
26bab11e8e68e746eda1394f5fd6c0349f9146dc4456012ae3f21e2b1535ddb0
3e67e47e18d5f18ae852a9ed82dc996c683983caaef941b45e8822a4286f3b4e
4fc4aec2aa44c6859cb020015ce1225f468554fb844b1b8f6391df364126e7fd
56f43f88a8193f3f9f994a0368b469381fdfd4d6a69646a598c1305abaa1d94b
8896c4e461e144e01d71f79df6bce469c834771b5bf39a54fbf3c07f1197d7fc
bb01990fd8222643d9346c70da0562938c96ca91d49e474e6c5f78fc9ca44173
d347543bd5a839c6a12d2c3344b3ac9b052e1b68b13e8ccd984bbcaf4da36dc5
d4eba36cbc57c4129823282292ce308da98f462390f64ea98e63162769aa2204
f6f5d30f5f03d66b15ccac521e7a4647f5be2bdf5f7f97c4cefbe21fb7a781ed
installer.db
installer.db
RELEASES
the-real-index
the-real-index~RFe69e69f.TMP
data_1
fr-FR-3-0.bdic
data_0
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State~RFe698bed.TMP
Preferences
Preferences~RFe6973c1.TMP
index
index.txt
index.txt
index.txt~RFe6949e2.TMP
renderer_js.log
discord-portable.exe
portapp.json
memory/1116-3076-0x0000000000400000-0x000000000052F000-memory.dmp
memory/1116-542-0x0000000000400000-0x000000000052F000-memory.dmp
memory/1116-574-0x0000000000400000-0x000000000052F000-memory.dmp
memory/3200-6775-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6784-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6785-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6783-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6781-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6777-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6782-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/3200-6786-0x000001BED28C0000-0x000001BED28C1000-memory.dmp
memory/4676-1001-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-587-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-585-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-575-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-589-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-3064-0x0000000000400000-0x000000000076B000-memory.dmp
memory/4676-3075-0x0000000000400000-0x000000000076B000-memory.dmp