05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Analysis

max time kernel
126s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240419-es
resource tags

arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
06/05/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKlauncher-3.2.exe
Size 1.6MB
Sample240506-t7sbxaad41
SHA256 05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
MD5 b63468dd118dfbca5ef7967ba344e0e3
SHA1 2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA512 007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP 49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1504	i4jdel0.exe

Loads dropped DLL 2 IoCs

pid	Process
4008	SKlauncher-3.2.exe
4008	SKlauncher-3.2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1708	icacls.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1340	WINWORD.EXE
1340	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
1708	msedge.exe
1708	msedge.exe
4560	identity_helper.exe
4560	identity_helper.exe
2032	mspaint.exe
2032	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4008	SKlauncher-3.2.exe
4008	SKlauncher-3.2.exe
4008	SKlauncher-3.2.exe
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
1340	WINWORD.EXE
2032	mspaint.exe
1076	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4668	4008	SKlauncher-3.2.exe	83
PID 4008 wrote to memory of 4668	4008	SKlauncher-3.2.exe	83
PID 4668 wrote to memory of 1708	4668	java.exe	85
PID 4668 wrote to memory of 1708	4668	java.exe	85
PID 4008 wrote to memory of 3536	4008	SKlauncher-3.2.exe	87
PID 4008 wrote to memory of 3536	4008	SKlauncher-3.2.exe	87
PID 4008 wrote to memory of 3168	4008	SKlauncher-3.2.exe	102
PID 4008 wrote to memory of 3168	4008	SKlauncher-3.2.exe	102
PID 4008 wrote to memory of 1048	4008	SKlauncher-3.2.exe	108
PID 4008 wrote to memory of 1048	4008	SKlauncher-3.2.exe	108
PID 1048 wrote to memory of 1708	1048	rundll32.exe	109
PID 1048 wrote to memory of 1708	1048	rundll32.exe	109
PID 1708 wrote to memory of 748	1708	msedge.exe	110
PID 1708 wrote to memory of 748	1708	msedge.exe	110
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 1988	1708	msedge.exe	111
PID 1708 wrote to memory of 3464	1708	msedge.exe	112
PID 1708 wrote to memory of 3464	1708	msedge.exe	112
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113
PID 1708 wrote to memory of 556	1708	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008
- \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:1708
- \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
  "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:3168
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff46a046f8,0x7fff46a04708,0x7fff46a04718
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,16798271421621096563,3577354612830788463,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4560
- C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
  C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j1007790867191101790.tmp
  2⤵
  - Executes dropped EXE
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2860

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\JoinDismount.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CompleteReceive.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 3dc3e6031a0a13b2542999032c9a521c09f9a14227b32e83301d9f0e46aa15e6
MD5 930e95069e058dd1a517214cad85201b
SHA1 5c4e12b17a52a055d0ccaeebe993ab2d5294a5b1
SHA512 83afd3b37a74e7605a432766710e8a708f267345074413c9a934544206d8157227fdfc77a85f7ea8ac92ef4cca8f3fc33ef5e41865fcb2bb2e8fde2c76c0d829
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

755a3a43-f12d-413a-9cbf-24966e2eacc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\755a3a43-f12d-413a-9cbf-24966e2eacc2.tmp
Size 363B
SHA256 67071c62dafe83222a4757032c95b4ecbadf34b870dccda8610bebc2a26319f9
MD5 73025cb0adc7e797436358dfa6bb9425
SHA1 6409567e882bf9d3df734cea9276a6885e0509ba
SHA512 325f12028e9a8aa41d9dcf10747db7e709106ebc46c8dac489d7644c2360a87a327eb0e6276cfa77a3435021f86bfdd4cd58d6ba128ada94128904ea0e81ebd1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 ef6fd3c0351e94b73890294c15e82a66aa1e527aac5b34cf00b5dedc737d4124
MD5 ab9479f052e4d4d927d537db65b4d300
SHA1 c8d084920dbc20ef600ef7ccf64328b848448787
SHA512 a363c82c2739cfe585047bc670414709147f977279b680855196f43aa10a9bb49758f3b74ff4e32a9f53627090a1f82b241a606fa74624f87bde3586dd0405e6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6ca2c2eef4bcfa55047e5c312818d61ced408452be3f466dc49469defa6236c6
MD5 51a876fc45c026047b90afbf8d2812df
SHA1 6325e4fa06812ea0b723c3302a73a231db246b8e
SHA512 797247385b287ea5ac08cf89608743b51a58bca95e3e6932ba1ae804c367e93d62563db0f47082cc67604f56bc1b4c095aa680b33feb7b84031a36146c3ada62
SSDEEP 96:n5jkWJc12PkniK1wpvWMoikHKR5mdeslu1b1jdtkWdpMrHKyIQyV+VD7AgEub:npkp0PzkGWMhMuxhbi29k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2b3d017273fed39cff659645cce848eedebc18013c34ef85ca8ba99d29e19122
MD5 21fa850101843e3f069dad159b0c69ab
SHA1 c8aabcf329eb351a4cbb048c319cae426a96d91e
SHA512 cd62617d416f0f7b5d7ec4be24021b673d9b6640827851eba7d0f9968053684590f75df50b0a40afcdc4b496d09db3959c1d9b489423bd185451d3c4a3edf166
SSDEEP 96:n5jkbJc12PKniK1wpvWMoiVmdeHdt7yMrKUIQyV+VDCzgEub:npku0PlkGWMXblWbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a17924e6db7ebfd8fdb33d2d9a71756091eff7de5cd016ff90a6ee066ac15c9a
MD5 e7083f3260ebf52211af3ee75b9ed772
SHA1 4cc364572cefc9310b62eabc46f2d8f47f8f6365
SHA512 9cd6a721d6049608b6fee0cd289a434853cc7b1cffb5cc90920755d4db8d55de373bacd945d377899790b4877b8b0011203994b7192bf420dc66b15918f3ee5b
SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphBc5e2RU3Oig+OblfBhDaz:c9iIxuERzA83h09RZxYiGg/XDafEBg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 ddc36d4fed552390de86e8457a5513ecf88677a1e107992c64e2940b7514fd05
MD5 c2af3d95f110b00fb36f2f6253ecf1d4
SHA1 38965a17f83d7973be81f98ce1aedd54d1bdc9d3
SHA512 c3e435e9066335162f8a880b047b7a486aef0b264080b15a10ebdb140c1f7393df19e1dda68fa76ee900ef0d55c7830d45b578d1061fd07b5f71690c98a78fbd
SSDEEP 48:uiTrlKxn7RxqxD9Il8u3mFfTc1yllxSDOyfPJjWQAs1GGYqb0ldGStCsctvFVrn6:IEYRaTc6bHAcQxAfFctvFVrtFa9O0Mk
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF1689212120580374212.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF1689212120580374212.tmp
Size 397KB
SHA256 64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
MD5 fdb50e0d48cdcf775fa1ac0dc3c33bd4
SHA1 5c95e5d66572aeca303512ba41a8dde0cea92c80
SHA512 20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53
SSDEEP 6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF1716285016866995924.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF1716285016866995924.tmp
Size 405KB
SHA256 0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
MD5 8f2869a84ad71f156a17bb66611ebe22
SHA1 0325b9b3992fa2fdc9c715730a33135696c68a39
SHA512 3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834
SSDEEP 12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF2983120253000783454.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF2983120253000783454.tmp
Size 412KB
SHA256 d549110689cdde0821ca2c7148f7b47a097166b4169786a4a9ede675f5ce87f3
MD5 c5c41f7587f272a4c43a265d0286f7bb
SHA1 916224c963d04b93ed54ce7c201108f398e7e159
SHA512 d4b4d01088d9f506368dc19d709b4ba6be764929b0dd05775841e14cbbec674f216b81515ae529e95abfd22ed2f3e2d2774363dd4284c8c8b57d203599555f76
SSDEEP 6144:PtBc7UQ0dNXWqSBQVUWrqIWqH70TVMYydoAF4N0ELhwnftLu+hNHzFxo5spvD3+p:Pt2+dRWqgVrwYygLhwnfhjh9fZ78
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF399707320606434644.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF399707320606434644.tmp
Size 398KB
SHA256 1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
MD5 ff5fdc6f42c720a3ebd7b60f6d605888
SHA1 460c18ddf24846e3d8792d440fd9a750503aef1b
SHA512 d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3
SSDEEP 6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF5300075655308881382.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF5300075655308881382.tmp
Size 400KB
SHA256 5fc09af94a447fae6f82c00f15dfaef9eae7c560e6cbe46d3e84524019a574aa
MD5 12ec66b825b504d752e8c333bf81dacf
SHA1 56896d3e6011466b7e6631c714c57e20ee8366d9
SHA512 8cb838589ac4f9819b7e2204517445df94663d3217297212973e8b2d9fece162155130ddc783e7e89ef2832d38bace731b2ae3b73aff36ad782c707813bc52b4
SSDEEP 6144:nm0XOI8wiWXWqSBNVUWI9Wd4EZDSwKBUMimozkhBiv98svLAYP0wJShe3+4yCL18:nm1GiqWqgwbMd4EZDDpmokGllkYMdQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF6464235629903608965.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF6464235629903608965.tmp
Size 393KB
SHA256 4c392dcc8ad916f0f9df7559ab5563b01dd94f9f3b2db34617fe392e00060339
MD5 b97f16379b4c106616f60f702733f5c6
SHA1 85c472fb9a7f256643bc4bba10f158dfaa1d1e8b
SHA512 d124af2c705b97cbb307497f88c47a5f7d320174d48626ea14ac27d42bcf8016f32810cf7ecb6af1261297b8c331a6ea89e2e35c3e2536390d8d6e500ed8d61e
SSDEEP 6144:FZbewyXwv22mZ8JWPziKSQQQbdiJNnL1qIPQyC4JRPeQQFgppInr/qwAWJBIF072:FZCU22mZzPziKPd6PQgcgpa/nMF07J8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF6601861685123735814.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF6601861685123735814.tmp
Size 405KB
SHA256 fe3714926082ac5764327e3b67ae52cb6f0cf6b8c4221c064a6cacf821079414
MD5 4b1ffad3c0075af22674765ff1ee2f56
SHA1 1f7b05d0ed1c6c15736115a59ad844adea5f1f66
SHA512 427db3fe5860676fab65a9b895d205620a1ec0aa172f45aa9ecef261820e25b84f3413bc5d0a9d0c1311422a8da1f5706ac4f6211a60aacc82974cf00ff036a4
SSDEEP 6144:BgWQyjI8Ai+XWqSBxVUW+EuzZKKH+XgoniJ2D5L2kZSVbnN90oGPP3+4yCT18:BgWQtiiWqgsR3n+XgZJ2xqu58
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF6687856542498847321.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF6687856542498847321.tmp
Size 403KB
SHA256 d054d998ae12be33820b100e0ed3923d513fa5c79c6d4e7ca1953afeb262ea9b
MD5 118abbe34a2979b66d6838805c56b7cd
SHA1 7f320cb81660fc6dff9cc5751f8fcc0134847c77
SHA512 5bcad4a03ced2ce76c5ebf78cd2c1328a4ee27019807f56a48bf8a0f936c57f351f10726c176952f0cf08776a5ce53d34c14d6a848925be2789408a61678f381
SSDEEP 12288:C2vSKsOi+1iqWqgfYs0S2S7vWAlcBJPH8:1PqIS2S7v3lcB98
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF6715639106916640547.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF6715639106916640547.tmp
Size 410KB
SHA256 5e606f805a71432d4875de7dab737bf9dea1187090f0a5190da9b1bbab09f57c
MD5 c4c47e3d7ed51a6bb67b7b8088a4b0e3
SHA1 b190f4e4e8f838c46ffe9507d966ea4d8b37d8ce
SHA512 b4251618479c52398ca71cfc61ad88230a14145771ef1085ab9288486d7bfc841f0ea222909f8ba6882db6076df26bfe37e1c23917569270c86d6e7adee7cf13
SSDEEP 12288:xg28OmWqgaGeWLF7k/oONd1P+yyZQl/xFiwRi98:SZG17k/oOX1PXyqCwRi98
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF7302946346213397734.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF7302946346213397734.tmp
Size 401KB
SHA256 1bda81124d6ae26ed16a7201e2bd93766af5a3b14faf79eea14d191ebbd41146
MD5 a473e623af12065b4b9cb8db4068fb9c
SHA1 126d31d9fbb0d742763c266a1c2ace71b106e34a
SHA512 1fbc2841783140fe54f3ab1fa84e1ded2534bcec3549ade2f513491b32178df515bd63a0a4a2c35017a6850ff9c3a24f8602357d912acf8ca92b8d68ba846d3a
SSDEEP 6144:D0RV3jlWkDOh9oC2wuhsJWPziKSQlRiFy34YmkCD9oI0+msvMlwt5BO2x28YzWDQ:D9SxC2wuhDPziK2yIYmkCCIPmsHI8F8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF8281777644235373465.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF8281777644235373465.tmp
Size 407KB
SHA256 0d34f9588400a586b774be97e66ae8c076a8807b8455df0587b39d2a4a1a3b42
MD5 9a21378c7e8b26bc0c894402bfd5108c
SHA1 72bd9f3ca75ca691ce86fe1ebbdb269f5f737bae
SHA512 4a9d23a01f1a7474e0339d4d8b151d0269bfaf7d9e13ff6aa34d7f929002e8ff185f273e6f7afd2d40df3e0630a962dc7767d870dcf1766f3e04b8029a7b452e
SSDEEP 6144:/DRFemw/pjVeXWqSBpVUW8KOA8HiQ109P0GJrMfsVwGSkSdnMgVIwZp3+4yCr18:/DKmChCWqgkJKy6zMfsdUDv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF8664309200582740819.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF8664309200582740819.tmp
Size 404KB
SHA256 6bdebeb76083e187c7ae59420bfc24e851edb572e1a8d97c1c37b7b2dc26148c
MD5 4154321279162ceac54088eca13d3e59
SHA1 5e5d8c866c2a7abfd14a12df505c4c419a2a56f7
SHA512 04ca175774cbe3f2d83543c01cc388e2715ab7b1378143db41bacdc7e7eddf05d3beef476f6acbe7ddeb34861984efb5fd7f299ec1820697c440b372d258aee7
SSDEEP 6144:s3unFMi82w/+qnJWPziKSQSzzY6XqYQ0rBfmPbPGxGl36DNoAmFFhGj3k4yhP18:s3uV82wWqsPziK4zbBOPb96DNAV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKlauncher-3.2.jar

Path C:\Users\Admin\AppData\Local\Temp\e4j3A2A.tmp_dir1715013768\SKlauncher-3.2.jar
Size 1.1MB
SHA256 f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350
MD5 4d653e61ba01a521c56b9a70a9c9814e
SHA1 de855dc3dbc914b497b58da92e0c21fff660796d
SHA512 e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def
SSDEEP 24576:cABupJWa7eXYJ4FCDzQvrmqBqAXxKhd1ODQZ3z0IH8obxOaHmez6Im:JgxzIvrWphdcDQZ3jH8olVGezFm
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe4jlib.jar

Path C:\Users\Admin\AppData\Local\Temp\e4j3A2A.tmp_dir1715013768\exe4jlib.jar
Size 62KB
SHA256 8a416dab7b3028f3e79b41521b65432ab2d25dec9f85e220ade0157badc0dd41
MD5 bd8451491a92b1aa5fe6d44bc9f3e1c6
SHA1 fe210263b4bdaa3719b00994e665839c8987094e
SHA512 3c1892e9f8812ed6e895936ad16f3f457f50283d88d37b45d780a1d5f0bb2751bb74585b03227d10367b9367c7c2eef68d88d914b8e3cbcca0b2dfca05ad0ebf
SSDEEP 1536:ZUAJ/9dFD/QlniESY3nUJHaSJPqGjndVNWV+:ZqP3ULYG7drWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

flatlaf-windows-x86_64-4541281346400.dll

Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4541281346400.dll
Size 22KB
SHA256 ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c
MD5 dcd68a87b7e6edbcfde48150403b22eb
SHA1 28e4839a29725075772fccc39b44e194eb91e477
SHA512 ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71
SSDEEP 384:6pPX3l1FuqkXq3NhzDuWik7DPObNpwKNsOfJ8APxh8E9VF0NyXKss:Ydiq4UzQkG2eJ/PxWERc
MD5 SHA1 SHA512 SSDEEP

Submit Download

i4j1007790867191101790.tmp

Path C:\Users\Admin\AppData\Local\Temp\i4j1007790867191101790.tmp
Size 880B
SHA256 1f280eade9d1ae3af946df6cb272aab0d1a7d914ca0433e004cdbd2692865d27
MD5 ee084e4c99b7fd9be7208814aa71b42e
SHA1 0565d047b05ee79422536f3e3d80cb0e16e06c73
SHA512 33deb5ba2510bef79ed1d792aa2d673d81583183edef0affc8c6b0f1b391c26cadc7ea597a9e9602be5f23dab3ffce9e0f9a48ed5c7933e36fd5e2e8630695ce
MD5 SHA1 SHA512

Submit Download

i4jdel0.exe

Path C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
Size 93KB
SHA256 e48ef14933f4eb6071497a5311ca0ac6e115f7a0d57a60e519296f8fd42ad4fe
MD5 802d1182a4685e1b86c0a9dcb3f2be36
SHA1 3aea1c3d1925ec0e6c4e534adcccb1271c6a5f04
SHA512 ebde9d7c89fed73ea1766fdbaf716e5ba69068b5b0c913490c9ad8703540945e2cda248b0365d6a49acecae960a8fa846da53cfbf8e19b98a6da382267dc562c
SSDEEP 1536:pTjiguRSshbhH7JG9cGJOkUPwoavqnzZnBBw3QMZblzmPxJ5:TTqrG9b45nzZBK3QMZblzSxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna2530952690492754259.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2530952690492754259.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

sklauncher-fx.jar

Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
Size 17.2MB
SHA256 0e79303169cd0305c364885824b1ee91b15e6ede8b7eae02e808ad4c4c35a36f
MD5 5b0bfa78154b1c57ab68574af285fc6f
SHA1 bf9f6b357352f81a2e4427c4e5d839b89b32d3b7
SHA512 95dc94b13f82d61e5a168251665412c04710069a1b1679e9674d4a4dd2f824eff994e9ecd92f257a8abe1144239a8a4a6aa492c6b2e71d6faeb4d1e4a3c76d26
SSDEEP 393216:ifffPon+2G9lsE9bZITdFBchEHUGXP7svSg2xsTcG2:IfPu+ZR9b+BaE0j6g8Vv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3536-31-0x000001CC31280000-0x000001CC314F0000-memory.dmp

Download

memory/3536-30-0x000001CC2FA70000-0x000001CC2FA71000-memory.dmp

Download

memory/3536-20-0x000001CC31280000-0x000001CC314F0000-memory.dmp

Download

memory/4008-251-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-864-0x0000000002700000-0x0000000002970000-memory.dmp

Download

memory/4008-45-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-34-0x0000000002700000-0x0000000002970000-memory.dmp

Download

memory/4008-178-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-176-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-201-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-134-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-110-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-49-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-142-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-210-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-84-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-1130-0x0000000002700000-0x0000000002970000-memory.dmp

Download

memory/4008-202-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4008-204-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4668-16-0x0000015D44EC0000-0x0000015D45130000-memory.dmp

Download

memory/4668-5-0x0000015D44EC0000-0x0000015D45130000-memory.dmp

Download

memory/4668-15-0x0000015D44EA0000-0x0000015D44EA1000-memory.dmp

Download