Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://drive.google...

windows11-21h2-x64

8

Analysis

  • max time kernel
    1775s
  • max time network
    1162s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-01-2025 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://drive.google.com/file/d/1mMTLW_V64uJHI3DwhFAMbBw7qOQOIUs2/view?usp=sharing

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1mMTLW_V64uJHI3DwhFAMbBw7qOQOIUs2/view?usp=sharing
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda8f13cb8,0x7ffda8f13cc8,0x7ffda8f13cd8
      2⤵
        PID:4064
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:4216
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3456
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
          2⤵
            PID:2908
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:4896
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:1780
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
                2⤵
                  PID:4696
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                  2⤵
                    PID:3448
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3064
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
                    2⤵
                      PID:1228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
                      2⤵
                        PID:3140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
                        2⤵
                          PID:2160
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2780
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
                          2⤵
                            PID:2312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
                            2⤵
                              PID:2344
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                              2⤵
                                PID:4056
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1784,7063265254271230313,8345707867802410014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:8
                                2⤵
                                • NTFS ADS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4980
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2444
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3624
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:4840
                                  • C:\Windows\regedit.exe
                                    "regedit.exe" "C:\Users\Admin\Downloads\Windows 11 to Windows 7\Windows 11 to Windows 7\! Take Ownership\Add_Take_Ownership_with_Pause_to_context_menu.reg"
                                    1⤵
                                    • Modifies registry class
                                    • Runs .reg file with regedit
                                    PID:5068
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3644
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of SetWindowsHookEx
                                    PID:464
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2748
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:432
                                  • C:\Users\Admin\Downloads\Windows 11 to Windows 7\Windows 11 to Windows 7\Explorer Patcher\ep_setup.exe
                                    "C:\Users\Admin\Downloads\Windows 11 to Windows 7\Windows 11 to Windows 7\Explorer Patcher\ep_setup.exe"
                                    1⤵
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • NTFS ADS
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SendNotifyMessage
                                    PID:3264
                                    • C:\Windows\system32\taskkill.exe
                                      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                                      2⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4896
                                    • C:\Windows\system32\sc.exe
                                      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                      2⤵
                                      • Launches sc.exe
                                      PID:4892
                                    • C:\Windows\system32\sc.exe
                                      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                      2⤵
                                      • Launches sc.exe
                                      PID:1520
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
                                      2⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      PID:1768
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
                                      2⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      PID:4292
                                    • C:\Windows\explorer.exe
                                      "C:\Windows\explorer.exe"
                                      2⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      • Checks SCSI registry key(s)
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2120
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                    • Loads dropped DLL
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3036
                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                    1⤵
                                    • Enumerates system info in registry
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2820

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  System Services

                                  1
                                  T1569

                                  Service Execution

                                  1
                                  T1569.002

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Defense Evasion

                                  Impair Defenses

                                  1
                                  T1562

                                  Modify Registry

                                  2
                                  T1112

                                  Credential Access

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Exfiltration

                                  Impact

                                  Service Stop

                                  1
                                  T1489

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll
                                    Filesize

                                    628KB

                                    MD5

                                    f8433b9d1f5e09e653233378a6940ded

                                    SHA1

                                    e97c2a3868490d4a677c8459c9e2abfe0b22faa7

                                    SHA256

                                    4ad20004353419a88ea50f0b44162e30b12076721a091a793056ad35e4177a2e

                                    SHA512

                                    d77a9b7814e1b901e02ca53c6fb1c46eb558b277ba3d094bedc400ef339f8b4566fa543659720e03493bd082b7610bab43123cd90a3a6f3aac5d0cbaf55e22e8

                                    Download Submit

                                  • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
                                    Filesize

                                    136KB

                                    MD5

                                    c44baed957b05b9327bd371dbf0dbe99

                                    SHA1

                                    80b48c656b8555ebc588de3de0ec6c7e75ae4bf1

                                    SHA256

                                    ad8bb426a8e438493db4d703242f373d9cb36d8c13e88b6647cd083716e09bef

                                    SHA512

                                    ad1b76594dca7cde6bbcde55bc3abe811f9e903e2cf6613d49201e14e789cfc763cb528d499dd2db84db097a210d63c7d88cc909ca1c836d831e3519c2ce7b35

                                    Download Submit

                                  • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
                                    Filesize

                                    236KB

                                    MD5

                                    0dbcff769e30ad47cad9fbb42a0576ca

                                    SHA1

                                    32a4ff988fa185c8b04b86f1b4b45b21e2960bd9

                                    SHA256

                                    fcf61101867cfd6ca03909235933045dd36a1cb863ca84de1c1a17ba812430fe

                                    SHA512

                                    3b5e8e3ddcd26cbbbe3144acdd6a979339c01ffd3123eeaa0aae6c95544fa0c262c545eace24f5362caf6463a8b7092eee146f80a9982ac9128e8ad137649551

                                    Download Submit

                                  • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
                                    Filesize

                                    109KB

                                    MD5

                                    f6bed42a0193a6039d51b650fa06f8a3

                                    SHA1

                                    a6c92d4f2b095c5709f7a9c4f0119d501e9b9edb

                                    SHA256

                                    1904434f9da55d3e9473e8c8173edfae43cd9e0524d08934075f0a8c6178a40b

                                    SHA512

                                    2d40697671aa72ad6ef917565829a2012ba0dd1558849229eab980ee6ecafad453fb6faf46a7a46b756df66168e743e3c83fa65d657eed3a5fe1a8ca7e48b3b4

                                    Download Submit

                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
                                    Filesize

                                    1KB

                                    MD5

                                    8d8672428ef420f0d9a96ef6fabae91f

                                    SHA1

                                    a6b9b385e86b10b46e0dd340b246390a4b1908b6

                                    SHA256

                                    be5c7879a0655ed54ad2c206ff897e586c02013e07cfc6ee36e7fd40e1469a27

                                    SHA512

                                    d9cc054464fd84f3f70dff63dc5956f8c0d1a5f6586f161ae63b4153ea403440c167ee84a0c158c80e89bf8999cff7de7504550ca726d0ff7d0f6e772c45dee3

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
                                    Filesize

                                    280B

                                    MD5

                                    2e3b1d2b0da7494926e7067a7991e358

                                    SHA1

                                    914240c551385528af738c7d2bed9815e052a2cc

                                    SHA256

                                    d7b0c95af78d110120730326382c5a515649524d0f13de07225dc8cacc9b62aa

                                    SHA512

                                    aa51a6802aecc21f8baa2488005c087db5ce727042439519433962e9eaaff566fed56b10183d7e3391ae3263c851a4299a3b72b46abdaee413110a59f59c9acb

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
                                    Filesize

                                    1KB

                                    MD5

                                    4f9ce3cdd4f1cf5ea276c9b64aeea4d7

                                    SHA1

                                    f1f7bdbb44d781ebc7014285a6d6a07f3a245c5e

                                    SHA256

                                    053a444faf5e86919de4ccfbc6266ee7f30a0cd51639b1ee1d73335093d7f0bd

                                    SHA512

                                    8a649b3fb7e1cb26bc12b8d113f9da910a36a08939521b305f6ff9ecd78907ee958ed34125165f96a3235e3a6764ab223671768bd2e28d8d2e46f02ef9fb272b

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
                                    Filesize

                                    979B

                                    MD5

                                    d34ddf7764dfe4c53ad02658afa56d95

                                    SHA1

                                    82277ea579922dbd30b043753a531abb6dd65d9b

                                    SHA256

                                    1276ff418c0be079f2b88cc1230b9b49c2a7c47d4b703c5ef588f9e2d0aa2e1a

                                    SHA512

                                    cedfb5954bf40bbddb344677a5cf75f9af67c7d92c088c06ed82067436e9d7a49937398a10bac7611a77b90c02701a66319f83c504362e86d219d0bc4aba6c6b

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                    Filesize

                                    471B

                                    MD5

                                    12656b93231f30cf35d082d198b1d422

                                    SHA1

                                    25a24ede9caf7e30e42c3bbed42ecdd3d0e2189e

                                    SHA256

                                    3b5ec14eb35e6c6829b9a3858c069e7a6fee9f142b21d04002ea81ed9116d277

                                    SHA512

                                    f137afbbb5fed4e995082a3e3d58b6f9a13f85472849e086ec8543ed3a6cfaa4b7c6f0452ac9a68d68effedc59616bcfff1ce983e9a011df2d85eea218fe980b

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
                                    Filesize

                                    480B

                                    MD5

                                    749d8b4fcfbee460f0a63c28c58b00c8

                                    SHA1

                                    04bda43189b3cdbf8c914740745e81ae630a8b0c

                                    SHA256

                                    54982ee24f10e8c7c3eb0a27b8d7695e42218dba6280894f6010690bcf17f2b7

                                    SHA512

                                    e6afc49c691a7dc17c29e66420fb0e47e93965a4539d41ac6267292fb30ae5607026d27d46118dc6ca6b75b39bf84130e9dbde3b76e4c8109ff35881962d3399

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
                                    Filesize

                                    482B

                                    MD5

                                    22118fd5f66371dbaf4a9ac8c31b9bb1

                                    SHA1

                                    0e2aec70a79c91190b76fc60acdbe5cac89da9ed

                                    SHA256

                                    c8c5ccb75c16cf1976e1e21dde9a60e95597bf32c17e16f56383cfe739feaaf1

                                    SHA512

                                    988643e91fe9916cd396f7a2cf80fd666055f766674d919483880dc5b54a85e656e0e9bea514bc7886764d00f0f5b9436c5420d8016856c5e4b3b9d5f58e0d11

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
                                    Filesize

                                    480B

                                    MD5

                                    0f759520b5681b4fc7b76ebe4ac21597

                                    SHA1

                                    48c4e94411d9122bc1569351d97d49aa054ae204

                                    SHA256

                                    252910c209bc083061b431273f359662ae261b32f4fd11dcb5f62a6945cc589a

                                    SHA512

                                    29666c7a985d4b00ef141851809c21e4cdd304ff57c061a790d5ab2f4fa8ce6cd97c35928a5fd7cbcd342069920e5ae7680c8ea43ed2ef4d7478ac23146979bd

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                    Filesize

                                    412B

                                    MD5

                                    b0cd1dbd66407e973a9c0635fc28f0ac

                                    SHA1

                                    2ede339cccaf17b5c86048abcc131cb9741a74bc

                                    SHA256

                                    8c724d8a61333eaacbd0366e64dd9d135145c1514d40709c09e6ae18b31adad9

                                    SHA512

                                    b70c384b3fcb2aaf05a904a1340f7c73d781062e196666aa864105fde9222ed9548ae124e5e36c6a7ff2ff30c9fee257b3b119074a75c770536d5e51f5a9f8b9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    e9a2c784e6d797d91d4b8612e14d51bd

                                    SHA1

                                    25e2b07c396ee82e4404af09424f747fc05f04c2

                                    SHA256

                                    18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

                                    SHA512

                                    fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    1fc959921446fa3ab5813f75ca4d0235

                                    SHA1

                                    0aeef3ba7ba2aa1f725fca09432d384b06995e2a

                                    SHA256

                                    1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

                                    SHA512

                                    899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                    Filesize

                                    480B

                                    MD5

                                    6e807f0e918c1f301d056e5fd0b1b72f

                                    SHA1

                                    e3d0234dfcf9291ec5948d0111cf1ee305cc8408

                                    SHA256

                                    7d6deef31c0f4fcd8d96c2fe2eadac9863e92985cc0fe0471968613b5e081092

                                    SHA512

                                    168950c956543ed5908e7e25dc1b5e1d10f97e0afdfdd1a3a1371b4a83474464765376d0a7c3595f4b9ef290009863d7576a11a39c96f561e4c64c3c66c21b42

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                    Filesize

                                    3KB

                                    MD5

                                    9438924e9360e0955cc9acd7a70c9c0e

                                    SHA1

                                    61a138fb5979c08fb6a2522773ac68aca4a8d506

                                    SHA256

                                    8869f712729f6d55d08cde9d635f22c01519ba6f64d0d1f7b5918a7c1c13a750

                                    SHA512

                                    dddfad6775cf75a0071411dfebf8e4c30cbc628cfacc5215d05c966b009b245b0b7b0913a00209b53085d971bd3828d8398a83a3bb8de3aca58bc2746be6594d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    5KB

                                    MD5

                                    971f91ab26e094a24ce96cf3f72b5203

                                    SHA1

                                    00a312a267061447d9cf77db3872aae0e4108ff0

                                    SHA256

                                    c4dc8dd460fc052201602c692911ab9d7a376c4cf63b80c06b9991e58aabc3ae

                                    SHA512

                                    1df2fa36b7c5bedeca1f92fa8ede718b6ca8b21d19b8e1cb360e72d5e2cbe17e65d417f63927da014a3a457ae37749c7baf6e7accc2b05698cd54dfdc1588322

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    2691de2e40f69c4781df64e8947bc708

                                    SHA1

                                    3f565c5d86a7e9fa64fe2318b66691811bd19a0f

                                    SHA256

                                    f707325a61d4a81584af177e45397ddda33df0728313b6b0a72c41fdb539dc54

                                    SHA512

                                    e0d52c5da58276d51fa18e62d801fee224eb85476930bc3f579ed242c7309ad1da4c327a9ff1cbf4d1f4e37fd7e1bb8290be4e4f7016f6e7f907e6d20208fb25

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    80c77cbaa15ef43fe01ea24fdef15df0

                                    SHA1

                                    75e362f2b7843feace5654673c2b25f3cf173f0e

                                    SHA256

                                    03613606667f14b43832c6db2a9f79e67c7af3cdd331ca65cb2d6fd4ba515bf6

                                    SHA512

                                    4fdae1b949fdc62117a15b3e711d2ce8344ab1280fba2fb2acca1995ebd1fe438b8f33b53433689392e23473d338ebdd8f976b131f1e6ff36d05decb03386b82

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    9631b1be905ee4c0514856192947cab0

                                    SHA1

                                    39a28cfc52bc80c203db2d04e2fbf0dcd0ece577

                                    SHA256

                                    d182734323d53e9752de234e1484f122e5fdf339221a8c722b308a1fa2aed618

                                    SHA512

                                    11ecb7725e7b4221b40bfae4ddf33557911363fcbad35d90a7e20c938e0235d6ed055009c4559bf0d8fef9baa5cafad876a3fdbb6509ff63adca5cd91112c294

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    10KB

                                    MD5

                                    a1879e07e5987a30c53295771a30601f

                                    SHA1

                                    1bb7e18969757ab54e36dd96190d0d3bb87083f8

                                    SHA256

                                    ce2a2ae6c80a96c4002b14908e7d359722dff3597befb8e6f0c0bc53de0e6cbd

                                    SHA512

                                    32bf8c4cd6999d38fe58ce35c689a2813a5b2d5bd50712db7a9d3eecb190ef711bee2cfc9d27137e56beac82fc61a07a5bae61dd7602d51c9ab600f446597ce9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    10KB

                                    MD5

                                    3a97a18a39c2c10a3df70d0bb8ed302a

                                    SHA1

                                    4c6c89ccda8f8a9ad65efc9e697b8882d61d2a29

                                    SHA256

                                    9e47e66370cead10d06d98fa44f04ec2e5e3f96cc2bc2fef4527839845575d13

                                    SHA512

                                    6d9f9d8e66ed856d308a8b10852fc3945df8b3d7b57c8e9545a3332e3771fa07a513277ab068467740b0be67ea7b68b38d5e9dd1894251ee6b0eae023650594e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    10KB

                                    MD5

                                    f355713f54ea669127c45d89fbf5422e

                                    SHA1

                                    1cc5d0d1016e2e00780c1241ac93f7519a344f3c

                                    SHA256

                                    9271864347e62db44c1b53d39a7783e75ef2ab30e9bf20e5060e22c0604c099c

                                    SHA512

                                    34958400fee9c394479780d80ed337759303636077e010f269aea72fc2a38a523c810a056fb5fcdb1ae7c14b14ef22b0b56d23f429fec11ab65f88e64c6d71d1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
                                    Filesize

                                    328B

                                    MD5

                                    261c2e4cc6c843f78bfcf1f16df08e3c

                                    SHA1

                                    b5aca25bdc083c059dce8526979b2d606ae5d926

                                    SHA256

                                    b827be149aed816fbf0ea82d827e805c0f8a05eec166042b78ff568d6b3cd7a2

                                    SHA512

                                    1e024b4772a4bfbde8ff30841c879dcfce7e7bb844ab67d861fbc9e856fa3f2cfc62b6f41e550be457c3df9bb44857316d14e075da09d71ca6e05e5305b24ec7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
                                    Filesize

                                    15KB

                                    MD5

                                    f0ea51897ff1ddb7adefb3c14c7d20f7

                                    SHA1

                                    62c73c4ad7b8dce2a00839753546360ddadf70c6

                                    SHA256

                                    792879cb63411317a570d772605a35396c534f4a0889e8430d4dcd2a6727d253

                                    SHA512

                                    26c2c7001004d1b9813a179bf449752e51caefda0b5e560d6db638b9453fa0b208d64c713af4289f183b78f3523f6d506869dc5979c17efd0f28ba0ede4e9d4f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133807462774625313.txt
                                    Filesize

                                    68KB

                                    MD5

                                    7377a47c9926da9d1a461854d8f416fa

                                    SHA1

                                    7b670586038f4288fea647a388b40f1bb005bd29

                                    SHA256

                                    01bd1e10dc7a7fe815eb944488f34c9c3dee05178bd025e511e171f2236b4fa7

                                    SHA512

                                    02edeb1f691ea057a8091c8a2317b0c2183330334ed8b217590f40cfffe6e28d200fa672be9f65b5088646021ea455eb6536ec456a6e5fc8e73422d33cb6fa27

                                    Download Submit

                                  • C:\Users\Admin\Downloads\Windows 11 to Windows 7.zip:Zone.Identifier
                                    Filesize

                                    26B

                                    MD5

                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                    SHA1

                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                    SHA256

                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                    SHA512

                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                    Download Submit

                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll
                                    Filesize

                                    194KB

                                    MD5

                                    478bcbcc2e0f7d6faf4f9a1a171d6b93

                                    SHA1

                                    db77058adae62839c47bfd6decd0028e488a789a

                                    SHA256

                                    86f30e106697a9f3ac201c3430f4a21ce9420cb3eb6a261fc234539e108266f2

                                    SHA512

                                    f4e668319529affea8fc83f956d3799f8f0651007f3bd338039273a1cf135156d55b516f49806e267fd67e9320a251bfdb5840d6eb1b789e078456fee95e52bd

                                    Download Submit

                                  • memory/2120-362-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-338-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-364-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-363-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-367-0x00007FFDA9850000-0x00007FFDA98A9000-memory.dmp

                                    Filesize

                                    356KB

                                    Download

                                  • memory/2120-360-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-359-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-355-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-358-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-354-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-353-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-352-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-351-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-350-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-349-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-348-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-346-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-345-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-344-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-342-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-336-0x00007FFDB7170000-0x00007FFDB791E000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2120-366-0x00007FFDA22C0000-0x00007FFDA2AF3000-memory.dmp

                                    Filesize

                                    8.2MB

                                    Download

                                  • memory/2120-337-0x00007FFDB7170000-0x00007FFDB791E000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2120-368-0x00007FFDA9850000-0x00007FFDA98A9000-memory.dmp

                                    Filesize

                                    356KB

                                    Download

                                  • memory/2120-387-0x00000000045A0000-0x00000000045A1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2120-341-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-369-0x00007FFDB7170000-0x00007FFDB791E000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2120-372-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-370-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-365-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-361-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-356-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-357-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-347-0x00007FF734220000-0x00007FF7346E4000-memory.dmp

                                    Filesize

                                    4.8MB

                                    Download

                                  • memory/2120-339-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-340-0x00007FFDA0E30000-0x00007FFDA10A1000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/2120-343-0x00007FFDB6FB0000-0x00007FFDB715C000-memory.dmp

                                    Filesize

                                    1.7MB

                                    Download

                                  • memory/2820-526-0x000001D75C340000-0x000001D75C360000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/2820-615-0x000001D760880000-0x000001D760980000-memory.dmp

                                    Filesize

                                    1024KB

                                    Download

                                  • memory/2820-525-0x000001D75CD70000-0x000001D75CE70000-memory.dmp

                                    Filesize

                                    1024KB

                                    Download

                                  • memory/2820-524-0x000001D75B630000-0x000001D75B650000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/2820-391-0x000001D728BD0000-0x000001D728CD0000-memory.dmp

                                    Filesize

                                    1024KB

                                    Download