valleyrat_s2 | dd22a14eaf32cfa00e18cefb3f45c1cd8c3d33e1fa3b292682422e453d834a7d

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
16/01/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GVD-6.3.p8.exe
Size 11.7MB
Sample260116-cncnnstpfy
SHA256 dd22a14eaf32cfa00e18cefb3f45c1cd8c3d33e1fa3b292682422e453d834a7d
MD5 abee138c69d164c2970dc05b4a6f1f40
SHA1 9cf0494d994a95e627f4569298565f909738c037
SHA512 310057b388b7bd52e305b5a79fd85c033d290fb4484e7d9d6b3a4a44a0f2de2f31d99abd46a2c3704aee62b3934d3dadcd7edd3956f775d440e10104a74f0cc2
SSDEEP 196608:rsa85DbJrtep47y1W903eV4QRztpDjIIAcwDkRP8h2YpWvk9kIi0AiFFh:Z85vzw47IW+eGQRJ9jok29kil
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor discovery execution valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

pdxfacai888.com:443

Attributes

campaign_date
2026. 1.14

Signatures

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
17	2260	rundll32.exe
30	2956	rundll32.exe
64	2260	rundll32.exe
66	2956	rundll32.exe
71	2956	rundll32.exe
72	2260	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5756	powershell.exe
1072	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3012	XLGame.exe
5280	XLGame.exe
5396	XLGame.exe
3876	XLGame.exe

Loads dropped DLL 25 IoCs

pid	Process
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
1232	GVD-6.3.p8.exe
3012	XLGame.exe
5280	XLGame.exe
5396	XLGame.exe
3876	XLGame.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5280 set thread context of 2260	5280	XLGame.exe	88
PID 3876 set thread context of 2956	3876	XLGame.exe	100

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\wallet\wallet-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1927445519\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1845861398\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1927445519\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1927445519\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1845861398\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification-shared\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Wallet-BuyNow\wallet-buynow.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1845861398\edge_confirmation_page_validator.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLGame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLGame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLGame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLGame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5136	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134130031927131601"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481481509-3060867774-1808707516-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-481481509-3060867774-1808707516-1000\{DABF338B-2278-4C77-A061-98B2A18FE36F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-481481509-3060867774-1808707516-1000\{6FC71A1E-25EA-4635-8155-EFD552433060}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5756	powershell.exe
5756	powershell.exe
1072	powershell.exe
1072	powershell.exe
3012	XLGame.exe
3012	XLGame.exe
5280	XLGame.exe
5280	XLGame.exe
5396	XLGame.exe
5396	XLGame.exe
3876	XLGame.exe
3876	XLGame.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4308	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	rundll32.exe
2260	rundll32.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 1232	5496	GVD-6.3.p8.exe	78
PID 1232 wrote to memory of 5500	1232	GVD-6.3.p8.exe	79
PID 5500 wrote to memory of 5756	5500	cmd.exe	81
PID 1232 wrote to memory of 4196	1232	GVD-6.3.p8.exe	82
PID 4196 wrote to memory of 1072	4196	cmd.exe	84
PID 1232 wrote to memory of 3012	1232	GVD-6.3.p8.exe	85
PID 1232 wrote to memory of 4308	1232	GVD-6.3.p8.exe	86
PID 5280 wrote to memory of 2260	5280	XLGame.exe	88
PID 5280 wrote to memory of 2260	5280	XLGame.exe	88
PID 4308 wrote to memory of 4504	4308	msedge.exe	89
PID 4308 wrote to memory of 5136	4308	msedge.exe	90
PID 4308 wrote to memory of 3672	4308	msedge.exe	91
PID 4308 wrote to memory of 5624	4308	msedge.exe	92
PID 4308 wrote to memory of 3672	4308	msedge.exe	91
PID 4308 wrote to memory of 3672	4308	msedge.exe	91
PID 4308 wrote to memory of 5624	4308	msedge.exe	92
PID 4308 wrote to memory of 4256	4308	msedge.exe	93
PID 4308 wrote to memory of 4256	4308	msedge.exe	93
PID 4308 wrote to memory of 2788	4308	msedge.exe	94
PID 4308 wrote to memory of 4256	4308	msedge.exe	93
PID 4308 wrote to memory of 2788	4308	msedge.exe	94
PID 4308 wrote to memory of 2788	4308	msedge.exe	94
PID 3876 wrote to memory of 2956	3876	XLGame.exe	100
PID 3876 wrote to memory of 2956	3876	XLGame.exe	100
PID 4308 wrote to memory of 3804	4308	msedge.exe	101
PID 4308 wrote to memory of 3804	4308	msedge.exe	101
PID 4308 wrote to memory of 3804	4308	msedge.exe	101
PID 4308 wrote to memory of 1396	4308	msedge.exe	102
PID 4308 wrote to memory of 1404	4308	msedge.exe	103
PID 4308 wrote to memory of 1396	4308	msedge.exe	102
PID 4308 wrote to memory of 4772	4308	msedge.exe	104
PID 4308 wrote to memory of 4768	4308	msedge.exe	105
PID 4308 wrote to memory of 4772	4308	msedge.exe	104
PID 4308 wrote to memory of 4768	4308	msedge.exe	105
PID 4308 wrote to memory of 2568	4308	msedge.exe	106
PID 4308 wrote to memory of 5708	4308	msedge.exe	108
PID 2568 wrote to memory of 4412	2568	msedge.exe	109
PID 4308 wrote to memory of 5592	4308	msedge.exe	112
PID 4308 wrote to memory of 3040	4308	msedge.exe	113
PID 4308 wrote to memory of 1400	4308	msedge.exe	114
PID 4308 wrote to memory of 2652	4308	msedge.exe	115
PID 4308 wrote to memory of 2652	4308	msedge.exe	115
PID 4308 wrote to memory of 5652	4308	msedge.exe	117
PID 4308 wrote to memory of 5652	4308	msedge.exe	117
PID 4308 wrote to memory of 1472	4308	msedge.exe	118
PID 4308 wrote to memory of 1472	4308	msedge.exe	118
PID 4308 wrote to memory of 5524	4308	msedge.exe	119
PID 4308 wrote to memory of 5524	4308	msedge.exe	119
PID 4308 wrote to memory of 1768	4308	msedge.exe	120
PID 4308 wrote to memory of 1768	4308	msedge.exe	120
PID 4308 wrote to memory of 4212	4308	msedge.exe	121
PID 4308 wrote to memory of 5592	4308	msedge.exe	122
PID 4308 wrote to memory of 5592	4308	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\GVD-6.3.p8.exe
"C:\Users\Admin\AppData\Local\Temp\GVD-6.3.p8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\GVD-6.3.p8.exe
  "C:\Users\Admin\AppData\Local\Temp\GVD-6.3.p8.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionProcess "WavesSvc64.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionProcess "WavesSvc64.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1072
- - C:\Users\Admin\AppData\Roaming\Adobe\XLGame.exe
    C:\Users\Admin\AppData\Roaming\Adobe\XLGame.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/signin/chrome/sync/finish?est%3DAI3H0-qE0gxKD1qlSurAg_XM_S1gASimGTvDGKHjhsL4aqHmzoBZBERaQKfBSUiPzPs6OjU02sTcqEzj54uMqQ%26continue%3Dhttps://www.google.com/&ssp=1&flowName=GlifDesktopChromeSync&dsh=S-718452782:1755429619398308
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x364,0x7fffff8fc188,0x7fffff8fc194,0x7fffff8fc1a0
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,12937659717161924086,3500128505242881705,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
      4⤵
      System Time Discovery
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4838206279271083045,10482394594849329573,262144 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,13762167980348264394,5863952108076801406,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,15436015316705521093,5927915682912304501,2097152 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14277439614235528548,14703471458534247721,2097152 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4864,i,10344803169870631503,8342703974672645377,2097152 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1376306312593479225,10042106821961017739,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:12
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,126655715514015130,796503747305118706,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      Modifies registry class
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,351918427360719704,14850033964711047035,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10826603402548458440,5862482591812835896,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13258548360031378885,17828696274692453866,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,8719390724060152807,13601233636313235327,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,8719390724060152807,13601233636313235327,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14578226816356892595,17331473140894988674,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2590172427615428789,558268107400966178,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12998293435816961183,2899008073948547623,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,4392447830021595592,15973329214997280952,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,5347888210209643276,2375294721974726390,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17886514332376509407,6831161575419055033,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,2175317139841706836,12538910899254831693,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,8092017457632840162,9665941157066111764,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5692,i,1289209375502738019,2881007296764977940,262144 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,14989918250425603836,2766672307959009890,524288 --field-trial-handle=2600,i,9470921110539177147,7399448461880871403,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:14
      4⤵
      PID:5592

C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe
C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe /run
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2332

C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe
C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5396

C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe
C:\Users\Admin\AppData\Roaming\trvePath\XLGame.exe /run
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 14496b82cfb6cedcf89048425260470cb6143acd6fce0cbdcc9b9a9b9775aec2
MD5 6d44565065c0f2d2791c577debd98a49
SHA1 4a238420d7c9b37942fbc9ac21afb1735f3120cf
SHA512 e151ba3f741edfe2bd2d79b6c9fabb19dbd62707b398049c993f5d4681ed0062dd56307f3bf5b56d70fdc564c76f058975253116f010cec89062ced0e454440f
TLSH
T158D0C0E903824C37C5D501B100830F1831DCC2384083C600BCBB493C48C37C4628F0D0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1e645ce3de5f727860c7d8e5010210344953c8a3020456d5bb164657a61c0df1
MD5 c88b7932e6baa2fb945169cca6d38ebe
SHA1 11b9c1382d70b41b36150fc04084a777d571ac46
SHA512 375f8171e45568265366a83920da71b692b19bf04b6690c03cd223f00f189a59cf28f3b0e1aeb2f3e6cdbcff16517d8abdbbf9470613e5ad2f42dab0c7c8f5d3
TLSH
T158D0C0ED03864C37C5E901B100430F1830CCC6384083C600BC7B492C48C37C4628F0D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6084fbaf51b8b1b3af988c83a235a8ba86e51f252430ecd7d3df43ee42cc79d2
MD5 d94b36a7f47e4b1f7c19d4e043771762
SHA1 d32c085866b6a43247819421b51d44dc921efc0c
SHA512 e75cfdffbc3b2765819e34ba67263e9a5ae3c6278d323f82979486d31b91f922d3169829a26d1545b1383bd2b29076de5004e8fc2f421e9586f50ec3598d7498
TLSH
T138F028B9C921BC3718FE4B2D60655A47FB5513672B80894F3A3D810C4FB1A3B859992C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 02cdc915320350253d8d10d32dbd63584fb62c1828479876284cf55bd02465ff
MD5 68e091fa5a03d84acb2d042ca76de2dc
SHA1 cdb5fb2639f2e2979ce46c9bd56a9b99df966c05
SHA512 2cf91f97daab2f099bfa6fbf54c7a507a67373cf49574cfe8bf0653e3eb5ff872d51d359ada0eafe3ecbb20449466137771b9ef9868302b6b28c3952ba5f0da5
TLSH
T17D714D5F804D8530E74C3E7251E76334B6B4F913E64BFA8A31D163F489C6F1A180C294
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58075e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58075e.TMP
Size 3KB
SHA256 cbc02b287e7ae9f5786c3eca9e627ec99ba83c5a7c3525229ad43600a93ba3ac
MD5 53a3888b5f9dfd181cdc1ccd97b10bdd
SHA1 a22b6d64281224cdab8b429d22274fd2a8a22d3b
SHA512 475c06f9b35acac841c670470cb755e58282d1ebcb9f96faa4beca3de54c95e8afe14e616cad2109bfd90c415643e40804ba232dceea947fa604cf569821b867
TLSH
T124613B6F808D4530E71D3EB251E72330B6B0F952E64BFE8A32D593F48AC6F18180C654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
TLSH
T196B35227D6A54C6B01F16264EC794382F325436F9282A82F3A7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c524f012efa58a54d3e622780315ac0e241f7576285c22dc7764232cad643a03
MD5 08778ad6c3df1fe2bb3fc6c66f082131
SHA1 fc6cad5e688d38a7c10102e80e724e44cf3e11b7
SHA512 be38d0e4f649a6bd56fe0427b8a0c38a036f0c2899dfec13cd2af2eba9b95123f5aabe1f2a39b8ef2f120fe61298073a34905c0e6a9d078c75a2e8f2233ec6e0
SSDEEP 96:D1gH/zaxzBwf2O0nNj6jQXEIwPcEoEPp0GEUd:D10rax1wfrKNj6jE9ycbC3X
TLSH
T11281BCF7C3E8892D890095F4AB187F2FCE690914432C3D5E84E8AE0B97E2871D20595F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c26da4ad4ce2f411b841c220ecc5368b499f6844e64a6b6dd976aacff3bc858a
MD5 f0f6469ffd70079e8cada728e4ce0e73
SHA1 de3a094bdfefbc5aed6532990dc649d76419cecb
SHA512 8a49da99b01c2fd42c68d5607614ac629344f7b63d5657e44893698350685833ecab26a0b36aa0b953159d43c5e5e1aafd1f771f520a0f00cf0b9d977d205fe3
TLSH
T1DA81BBF7C3E8852D890155F4AB187F1FCE690914432C3D5F84E8AE1B97E2871D20595F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e1c2f7e223474d59ed586e7d05e3c827c6bd5ea01a537ae52a109dbfc0206815
MD5 d50e4464a90ca3648dcddbe72a47852f
SHA1 eef5532b9f47b7277bf9ab9bc9380eb8cb8c8882
SHA512 10b16214030fdd93e2c05b78200c335d52758ea2b926b3eefc81696ae6aa6c559a9aa1bb8c14ff308acdb2384607aa1a84a54ff9288a98eb02aa788a82655be3
SSDEEP 192:sxZyRnyM//K1Ml8M3pB/f5s9f0wZLDM5grfzodpaz1/W6+WNu77/Y01RFaDlIgjF:sxZy1PpB/f5s90uXGgr0O/bu/5Na9jF
TLSH
T17D72D7066938593B8CD7D309FA45BF63E6F95573D5404E489AFC8E0C04E6AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cc8997262b55d5c25c11366e18fb362e336bccd2f07a4af7d73dd864445dfcc7
MD5 365e3d33ed4b4b9abad128e479159a37
SHA1 e689df8b146fc793034fc75712d79bd53d028aa1
SHA512 d358631b66374fc0f29575f0e1705bb5f6c1ca0ab1d618f9aa2bd616b72d601e3726e187d5354d58b6fb5e7ea634128da3a5b17f03de0270d7db55f22bf2ffcc
SSDEEP 192:sxZyRnyM//K1Ml8UQ/3pB/f5slf7wZLDM5grfzodpaz1/W6+WNu77/Y01I5FaDlX:sxZy1qvpB/f5sV7uXGgr0O/bu/5Aa9Yg
TLSH
T1F572E806AA38593B8CD7D319FA45BF63E6F9557395400E489AFC8E0C04E7AED611382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 1cf9bbe184981d3b3f5a9a9f4fca835e5809e66cc8b889d232a6e630835e4d47
MD5 e050d5664adde09a63dcb3ca0a34049f
SHA1 a219816783d1f4c534b271db29e97988f2c177be
SHA512 1a0b3b8429492a9c4cc13904fabd6409b9e6caa5cd787a9f1b1c6b94c49112ecfc2a79586b883ac81d5d6af797abb9836a648bc11450c81963b07edb450eb484
SSDEEP 768:fI2+S8kK2YF7pLuLU99WRm9LQqb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34QYwLlm:fI2+S8kK2YTEU99WRm9LQqbu1jaK4QYt
TLSH
T149031B3B280CCB7A4F844F9CDD267E8A6DE8018FA698C95447EA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 e3d5fc970603f3e536b7d55e56b036c266e9eb3614175f5f553663f69f462dce
MD5 c3973e16b0797163b1799f98bd7e9880
SHA1 bb608d72ba8065cbaf038f4240facd9b17ba63c8
SHA512 4938d70a17018be1df28519aba18683ce914e21e45ef6bd162aebd2fab7cfe933a3d7a9d9c9ff66b35970f7130e297d6cd85b1bb1c4a8831ded88737c7dc5254
SSDEEP 192:R0pimk2Ktifm+8+XorM0HyakWYt+Kg6O5+zqiIiXEvYQ7WuEZSW0Ga9Sv2uMOXYl:on/lS5CBQwsvoZxXphnpA
TLSH
T1D2C25711317B12413A3F29CCD9A5F827524270A3B058E87B3FE90CA64E67E285DFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5c51df016c4b646e3c4547a70bb6d3cc7c3f48adde4890ee5d9e58248f59978d
MD5 adcffb49e8556ddae3002cb0cb2336cd
SHA1 4bb004a8d8b3b342452de7d95631469d5e11bb59
SHA512 193b4fb1f0c56bee2e2d76491e88cb76f3a571e82389d3575dd76a0650422a90311f73bf13c460f539ff6f70db43b7890922844288a466bd09a596ac1c5b45c5
SSDEEP 768:VF3yG3UwgNe6pY56BOK2TK1832JiBzBu5CDnj2J3:byG33Z6BOKon32JadwCW3
TLSH
T163F2C6F598E78976D99E4B97A73D6E52ADBCC153B4880688B7C40D0DCC461BFD30B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4ed28a3e4c9a5cb504bc8d1484eadf9f1ecdd6dab54d1eb54f255f1ddc30119b
MD5 e3706295a39fd067cbcef3246587602a
SHA1 9923ed4613cb5700b2451655806122bd67715d95
SHA512 3ea776fdbe8581c4d15224da08bdaa96e79b5758f094b47669f46991103e2e3534f580ae661550eef1bc779991870eb5dac2132374750ca4507920a1ef030d84
SSDEEP 384:nYiFavqMg38N68TUNTUlIxB11dANVcFN4flYEG6BEXK2zXVi5vrh3A1wPCvwcxa9:jFayv3RwgPOc8Y56BOK2zXVamcCj21t
TLSH
T126C25B35A868CDABDDE78FD6E70A7613EEE012A395CC5AD8CAC91D0D009709D630BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 887d881f3e8fbdc387580c30c4e337ff318f079d1d961a4000ee608baafaf0d1
MD5 9c9ed3e664914ba7f8ad9ab4a0ddaf99
SHA1 94caf43d200c58312749fff5fbf7d321e6c1ccef
SHA512 ca160bad5baf94f465227e40ae7a7eb0c0245710e23ff130c99328741f707a053fd541730f5496682a839deecfe6b8c707a863a22d97abb2b3a37926a4c08a83
SSDEEP 768:JF3yG3UwgNeYDY56BOK2TKH832JiBzBu5CDnj2J3:vyG33R6BOKoT32JadwCW3
TLSH
T195D25B76AC69CDA7EDE79BD9E75A7A53EDF002A389CC0AD8D5C80D0D009718D270BD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d107622aa5d052328d74451be78505aa6ab60b6191767fefce5b66b09bf40ce1
MD5 98a6c16b5dbd523243aeb0fe06390ca1
SHA1 3242bc581efa32f9bfc8289852e9dc50740ce815
SHA512 b33574a3d7e146a168f67a482600a6e5caa44da3d5c6f285214a207208d817da965d92c3dbc6c018264a561f9e7d07399c41a6ae08f36c6a0690384bb0faf757
SSDEEP 768:7F3yG3UwgNeYDY56BOK2TKH832JiBzBu5CDnj2J3:RyG33R6BOKoT32JadwCW3
TLSH
T1D3D25B76AC69CDA7EDE79BD9E75A7A53EDF002A389CC0AD8D5C80D0D009718D270BD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.1.15.1\typosquatting_list.pb
Size 1.5MB
SHA256 9e3a34ff2b9c55dcd5d6a33e0ded005d575f7fa989c9c45ed1555d2058f24b2f
MD5 bb29b490dc6dbc9ebb40c499cd6b1fa5
SHA1 e59ac909737d855d809256be703a65368d536be0
SHA512 a65478e49b4ef0ac38c1a779bf698d39dbb8f248443edaf33a842b62d256048c93c92943b803634c12bb2ad14e5100610680b7456c8387049e747fc0500a8a58
SSDEEP 12288:y+PxxpPFDQo3F8qIOGoThqjyp7d+Pm4NowEESo0+3JcG:fPtViqIOGTjyp0u+EEJ
TLSH
T15865B4B9DFC00185DBB8112D20BF71D8181412A180E9DFEAFE7C85DF2B8598977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1713fbd219501745a5aff8176494d7b1467c054961a0d8f8b1101bdb7e7ae5fb
MD5 a595b7d7bc20439715454ff002b4885c
SHA1 78c1b48c98c48f41ef936d104cf41c3608dfc0e9
SHA512 6a2eff50e1211a6a7a3353b664e0204c9e5717631606c155b27d1f253c64892ab12524a5a2330950f5069df83f2dfdccbeb500c44617c87da329d9b9051e95c5
TLSH
T1D65120E04D3D16D1D9FC1A3EA45B38FD95ECC725F4A4353D6824EA88063AA1D608143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8dc26a127b44a72d590d02b1469ecc0577c7862cc1c5facde4fd43412f4db15c
MD5 4c71427224c22ef647995f20ab3c215a
SHA1 d600b348d847fca7db9708b846fa2e75e5e40bf9
SHA512 87ade7450b6e1a9726601094c7b7a5fdeed1eaef955a0c172f8491817266df19130a599172a4b337a25b0bfc1fbe1c0606f88bbbf1a4e4f8af7a65ea9d8e5553
TLSH
T1EA5144E04D3D16D1D5FD1A3EA45B38FC85ECC725F4A4347D6828EA880A7E61D608143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 86f6ff9c247f5cb9c6efe6b0a7051c3d1d03e773133bdd7d8a37eb759952d8d1
MD5 e4dca9d474965bcfa1bb4a930e6e6fb6
SHA1 363802433a4b5af6d58285114eed13388607be8a
SHA512 b11d0ace457e6e62fb20207401dcc70989ddfc4c41b8e2d8c306026ce4a4257f641fecd53782b94e2c1b4674229b0db8c0a946e2928d72d141488d62be2a767b
TLSH
T122412FE04D3D26D1D4FD0E2EA49B7CFC81DCD725F8A4357D6828EA88463AA1E648043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 39dfde5e4cc0d05cb18a62caa6f6cee176f28a58d03b013b69fa0f50cb509964
MD5 b5311553e8326dce5eab6278ddf40e22
SHA1 5cd18d9c03708a555589bda17803ac4a53d87954
SHA512 2e77b61a820965d39248f8ada39fe234af90e984f133a1a6ef54b2dea3cc559d929f4f4d1bd07238aeef79af33cbfcbbb05d85042df109af8cff497cfba661f4
TLSH
T1564131E04D3D16D1D5FC1E3EA49B78FC81DCD725F4A4353D6824EA88463AA1E608143F
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
MD5 088a5fda312ec2e1957e83d530f9bb8f
SHA1 29629e5dc8ade5f79eaa20017dbe01589d160508
SHA512 146c224d680bdd60dc680a744bd7ae08a867cf28d0e6e251e108fd19ec77e13e2e0f50558032391e6effd62644460ff06831e2da46291bd046144ca232e0a5d6
SSDEEP 96:I4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdTqke:IJB3jD2hoeeqLO9I1oC07xlYmBtcqg9
TLSH
T10932184BEA158AF9D1134336C0770649AAB6BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_asyncio.pyd
Size 69KB
SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
MD5 2cd68ff636394d3019411611e27d0a3b
SHA1 da369c5d1a32f68639170d8a265a9ea49c2c8ebd
SHA512 37388d137454f52057b2376d95abcc955fa1edc3e20b96445fa45d1860544e811df0c547f221c8671dc1a4d90262bb20f3b9f114252f3c47a8c3829951a2ce51
SSDEEP 1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
TLSH
T115637D83A290459ACD97A2B4D5632F57DBB1F5430A01479F62A8C18F2F6379242FF722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_ctypes.pyd
Size 121KB
SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
MD5 10fdcf63d1c3c3b7e5861fbb04d64557
SHA1 1aa153efec4f583643046618b60e495b6e03b3d7
SHA512 dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f
SSDEEP 3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
TLSH
T13CC36B0B339410AAEBA34179C5B36E07D7B1B45A175087CF12A4C69A2F637936D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_decimal.pyd
Size 247KB
SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
MD5 21c73e7e0d7dad7a1fe728e3b80ce073
SHA1 7b363af01e83c05d0ea75299b39c31d948bbfe01
SHA512 0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
SSDEEP 6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
TLSH
T19B346B57A2490CA4DE73807499979B57FBB278850320D2CF43A48AA73F577A327BD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_multiprocessing.pyd
Size 34KB
SHA256 fb69005b972dc3703f9ef42e8e0fddf8c835cb91f57ef9b6c66bbdf978c00a8c
MD5 811bcee2f4246265898167b103fc699b
SHA1 ae3de8acba56cde71001d3796a48730e1b9c7cce
SHA512 1f71e23ce4b6bc35fe772542d7845dcbea2a34522ba0468b61cb05f9abab7732cbf524bcff498d1bd0b13b5e8a45c373cca19ad20e5370f17259e281edf344be
SSDEEP 768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
TLSH
T168F28E53EA941856D837897694D39E2AE671F7470B10C3DF2355C24D0F723823BEA39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_overlapped.pyd
Size 54KB
SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
MD5 f9c67280538408411be9a7341b93b5b0
SHA1 ccf776cd2483bc83b48b1db322d7b6fcab48356e
SHA512 af2156738893ef504d582ace6750b25bc42ad1ec8a92e0550ce54810706d854f37a82f38eb965a537cad5d35c0178c5eb7b4d20db2a95bebfecf9a13c0592646
SSDEEP 1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
TLSH
T1C1436B4AA79004E9DD27C57EE4A30E17EBB471825611935FA2ACC24E1F73B4337AE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_queue.pyd
Size 31KB
SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
MD5 6e00e0821bb519333ccfd4e61a83cb38
SHA1 3550a41bb2ea54f456940c4d1940acab36815949
SHA512 c3f8332c10b58f30e292676b48ecf1860c5ef9546367b87e90789f960c91eae4d462dd3ee9cb14f603b9086e81b6701aab56da5b635b22db1e758ed0a983e562
SSDEEP 768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
TLSH
T103E28E93AA546C9AC833C57194D35E35F970BA53470087EF2318C29D1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_ssl.pyd
Size 173KB
SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
MD5 9b4e74fd1de0f8a197e4aa1e16749186
SHA1 833179b49eb27c9474b5189f59ed7ecf0e6dc9ea
SHA512 ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4
SSDEEP 3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
TLSH
T1F4046C47B6942DB7D813E4BAC1230913DBF1F015331247DE49D6D6490F17B0AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\_wmi.pyd
Size 35KB
SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
MD5 ee33f4c8d17d17ad62925e85097b0109
SHA1 8c4a03531cf3dbfe6f378fdab9699d51e7888796
SHA512 60b0705a371ad2985db54a91f0e904eea502108663ea3c3fb18ed54671be1932f4f03e8e3fd687a857a5e3500545377b036276c69e821a7d6116b327f5b3d5c1
SSDEEP 768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
TLSH
T1F5F26D66E3641845DD27C67998E64E2BF971B6569B10C3CF3314825E0F323C1B9BA3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\base_library.zip
Size 1.3MB
SHA256 44ddbfa7ce8c4ddb0a8370bb4c44aedf2c423db01e6077113290d63d3e84ac4b
MD5 5f85adce01d7646ebed35bf47d44f9aa
SHA1 f788ece8b11f94615665810aefdbc8cd5fde5411
SHA512 fabd0d3fae5f756c5690e18125ae9aa9488ca8a73ced3a4d40853492262519e4076563cdb4f8ac8943babc5144d1232cfb4c5825e30ab1a74765283a7494313a
SSDEEP 12288:DD9QHtzJYTq+zYgEkA1qJuAwMawPU9OmgRiVGttcY+bkgCyw0P6dY4aYcSglU9:DitJPtHCYGttcY+wB0P6dY4aYc7lU9
TLSH
T1AF55D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 465eea55e33d0d18fc859bb2a324236912ac67ace4a688dbecdc759cd4db8ebf
MD5 8504e694a282eb609080b37cf3259a15
SHA1 666d33d33187c596acc88213e35d275e5e45f83e
SHA512 ef211634b4d3fde76901859780db33472d5ebd1e192d0404f619313741b0e016a52eef6a7f52256fb0040c511eb6234f76ba42f87e52b7b0d4dbea871a6f72d1
SSDEEP 192:Dxl1qJ2Y1L9K2l/ijGaJXIpcToccgta96:DxPqJ22KMKAcncgoc
TLSH
T1A222171CFA6598E6E9064134C6374E4BB075BB110702B7CF83B0D5692FA23E7BA38746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 123KB
SHA256 5972250796d99115d8da4e2bef43e6c9fede2d1c3accb89bf9d5d791122b3990
MD5 f5583343f2ed88566800186f3d825d5f
SHA1 4e15f996bd612b99b10847b525610e6b2cf714e6
SHA512 73b92d8ce8db47e52a2d2a6084ef5c411ac5d1e5a26fb3e69a57f5342989ae24f70a8d1cb2f1a3225a5c3cab88a5853f43b49f5b13f8e63915b8646915947c94
SSDEEP 3072:/SNagEAr+mY5Shef25KFQ2QW0eXXLuob8F:xgEAc0KlBLuog
TLSH
T187C31A1622A50077CA6352B9CCB77517DBE1F561073253CF04A4C65A6F03BEABEBE602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\pyexpat.pyd
Size 195KB
SHA256 e1d56ffbf5e5fab481d7a14691481b8ff5d2f4c6bf5d1a4664c832756c5942fe
MD5 f554064233c082f98ef01195693d967d
SHA1 f191d42807867e0174ddc66d04c45250d9f6561e
SHA512 3573a226305cec45333fc4d0e6fc0c3357421ad77cd8a1899c90515994351292ee5d1c445412b5563aa02520736e870a9ee879909cd992f5be32e877792bdb88
SSDEEP 3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
TLSH
T100145A57B1A6C0EADC83803896D74E07CBB2B865038197CF12D4E77D9F277923A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54962\unicodedata.pyd
Size 1.1MB
SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
MD5 a1388676824ce6347d31d6c6a7a1d1b5
SHA1 27dd45a5c9b7e61bb894f13193212c6d5668085b
SHA512 26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89
SSDEEP 12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
TLSH
T1BF354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0su2pa5p.acv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0su2pa5p.acv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DuiLib_u.dll

Path C:\Users\Admin\AppData\Roaming\Adobe\DuiLib_u.dll
Size 489KB
SHA256 d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2
MD5 0b98bd6bf1956a04d626bf45c8a8f24f
SHA1 4d33a107a39071d5f3dfb0d5e6665920eea1ecf0
SHA512 6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed
SSDEEP 6144:OoFzDmi3RUAaMhq6hWvuK05XptWEWb3KMYqdQoE40:xpcshqjvuKcXWQqOj
TLSH
T1B3B49F2236E181B9C993D3379B2C9F38ED7A74404675864B73DD0E667A27A90CA113F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLGame.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\XLGame.exe
Size 571KB
SHA256 db8cbf938da72be4d1a774836b2b5eb107c6b54defe0ae631ddc43de0bda8a7e
MD5 faab2a5ab3bf288543a8369bed59e138
SHA1 af1b3d44d97e6005e1708700e4d78f6c807a9815
SHA512 2af25013079046cf5006de6acb8978a65c282a1331f722aef62deece32a335456e9be931eceb8372caf17dcaf0c735d84ec1e53325d5832923f7c242a2b69b3a
SSDEEP 12288:XtJEzuujzvFri7Zn0itxHdkbEoNzAu/GQAeT3zI5Od1DbyseEs73:XtJEzRHvlcf9kb7jZfIybv7s73
TLSH
T1E3C49D21F582D032D56100305F74EBB1097EFE305B6189EBA7D47E7E9E356C26A31B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

box.ini

Path C:\Users\Admin\AppData\Roaming\Adobe\box.ini
Size 2KB
SHA256 0473063ddeca9476d340f4ba533c3b46da6134cbcfdfe1c903dd025466b433e7
MD5 4256e19347c0ab993eae922809f23591
SHA1 9d0284dd7abe975ed565ca80a53dec78ded3b625
SHA512 1d0c8b7b1db5331b1a328a312e4ba133167c9c5b0f45a97efececa6819484544e895a5da4d940d8c75cde395a1b94940d4b6fef2fdfc77ab5cc9806aa53116b0
TLSH
T153415FD5521F831A8727084F181CE3D17D64A7158D9144DD5905CD4D87E38D771E2F96
MD5 SHA1 SHA512 TLSH

Submit Download

libexpat.dll

Path C:\Users\Admin\AppData\Roaming\Adobe\libexpat.dll
Size 212KB
SHA256 a69554223a3ba192fa287e8c696b3905602cd2de3a0ce2cc2b8f77a47d8d8e8d
MD5 d17df4b1e1dbcb8de51a3164b0be6e10
SHA1 21042c7759db05d77033099a84698feaa59e867d
SHA512 b76f78f0380fd3353a70d8b6ffb8051280551da25c2a25eeae10c2d5e1d9ba39564ee0d0d1080101465dabae5421f9b343ccf3435d41a69af6d8518ddfbcd1ea
SSDEEP 3072:FGRdzCF5vdjkKeJ74yqzU7yTxVJYFwN4BuIgE4TH8dOAg0FujDIgqGS:2d+VQKCqzU7qx3Gy42VAOsGS
TLSH
T1EB247B4174D2C432D9BF163104399BB65A7DB9204BA5DDEFABD40E7E4F302C1A630A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Adobe\vcruntime140.dll
Size 84KB
SHA256 1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
MD5 ae96651cfbd18991d186a029cbecb30c
SHA1 18df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA512 42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
SSDEEP 1536:RPwKQRaeU5QsPWFP/wPENm2eK7oJnoUSgpAY8ODcDcm7cIs+4ecbV6iVBoA2r:RwKQRbU5P4XwPENm2eK7mnoUSgpAY8Oa
TLSH
T17A837D11B1C040B1E15608B612E99B23FA7DA3734FD94DCF5FAA5C8C1AB93D2A73425B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1400776577\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1659581574\manifest.json
Size 118B
SHA256 aa18119d2abf94b8e226676aff0d3b734134acf1a87904e12e50b7ab933e05e6
MD5 d2e98f261bef5db537028be86364f325
SHA1 dfdf09cb77e51b48fce370239411904a142bb325
SHA512 1e0d5a469c2ced6e9e8b678c8d0092afe898fa09973dbc1394e2fe92e5104e0010c2f70699e07a87a96ce25552e18cd95ac789e4283e433df82c1ac4f6f69423
TLSH
T161B092B00D0AA03B22C59360ECA0AA8283F80228E80A1B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1845861398\edge_checkout_page_validator.js
Size 983KB
SHA256 4f163677b3aa447563730c2d69fc989ffa4d3bb74906a4ae0a10e7b069e63cb9
MD5 a310c508c9eb3db1c72e5a1638b318d3
SHA1 ea78003c96b5da9652579426eaa97076c6c14dae
SHA512 6d07d42618d4fdc8f4e0c241bce0922ead3ff1d1f7c769759800eeab95ccddd203d25105af7ed7ad154227fecb23ab6441c612ce4a9d1605e7354dabdee9332c
SSDEEP 24576:cs4KmRApsfvGNkrQAQHAQUwzEByhWQtDBLIfIeBCs6oam5dXKLRzMEiJsfasHPZ1:cs4KmRAqfvGNkrQAQHAQUwzEByhrtDBt
TLSH
T13F253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E8FA6C588ADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1845861398\manifest.json
Size 145B
SHA256 3506cadbd800b77398a5f1ed8d8a346fad226fc94a56478196e96e486c1240f7
MD5 18f0374a3cdc7017639462ed8e30d3cd
SHA1 5e5f69f9b6b5911aa9f8ab454c25e08fdb82a0f3
SHA512 c077cca134e0be44ce918cdc604d35bddce8123feccc066c6dc4980276875af444208d59f7f76b0807c3a45e8e4dd1a8ecb39ce5b299fd8f07d379df324dee38
TLSH
T1D1C09B73CC31AC71157447D40DF59645EB74574BF511B0563B34018E0F3D5755060BE1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_1927445519\manifest.json
Size 116B
SHA256 a1774d7a0ac3f90fe6fbed83045377b838af48811380d5ad88809222168c22eb
MD5 6658e8d6901ebdb2b695444e181b6348
SHA1 34c4bce8c106ad7c8ba03d56f702b868a9ae67ed
SHA512 615aa2777141a88f0d0904e7c73de3affadab0e7bff76fd11b98c8970f9b44fff5186bd4ca721c8960f1b57b4e35323826d52d5fc09d10a25b21b4ab46167d70
TLSH
T14FB09262A8084633689523F4A22383A3CBA86D4A91306606051B548165AA73B22E5219
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_508338219\data.txt
Size 143KB
SHA256 4edfdb9cade0be665696dea609332ae299080986e7adee23432a7012f107851f
MD5 695d1e0603e2d8d001b7b604580bba26
SHA1 796e01101b9596a88c2e12ed2b7406d874df7c43
SHA512 91865dc3f65a7c722207fa8e1e442fb637c49b9d0160e885b58fd4afb2cdcddf0f8ca516c6a1d9aafa00ff8ce5b5a91f122f46dcba264e35753b8daf39d3749e
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEnGA3iqS5Wt8y:YX1aI5aZoKzMJ07NnGk1
TLSH
T1E5E3F150CA841F9CDFAC261C50FE0F1DB3D0C79D852B658AEB63BE4A6F4AA0457274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4308_508338219\manifest.json
Size 52B
SHA256 dcedd46fab398b40ecea0160d44a5140286672ecd6e70b7d63a675de3e0030e6
MD5 4100dc4a7cbcbfb95078f35006d88b85
SHA1 5ade230ac8f36d89b8ff3db7d7ed94175313b460
SHA512 ed02ff06ab9d94e287da52d034ff547094f073cb7e969f532840e0e8b91896f80e826264fd33b3a4bbe9c73fd085d4541265eebd11d56c83e21e8cdeea911708
TLSH
T11D900260042495571AC10E906574F8959391661A55850D1E0445154802D546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-166-0x0000022B17610000-0x0000022B176CD000-memory.dmp

Download

memory/2260-347-0x0000000000C20000-0x0000000000C47000-memory.dmp

Download

memory/2260-378-0x00000000028A0000-0x00000000028F1000-memory.dmp

Download

memory/2260-258-0x0000000000C20000-0x0000000000C47000-memory.dmp

Download

memory/2260-381-0x00000000028A0000-0x00000000028F1000-memory.dmp

Download

memory/2260-386-0x0000000000C20000-0x0000000000C47000-memory.dmp

Download

memory/2260-362-0x00000000028A0000-0x00000000028F1000-memory.dmp

Download

memory/2260-361-0x0000000000C20000-0x0000000000C47000-memory.dmp

Download

memory/2956-360-0x0000000002EA0000-0x0000000002EF1000-memory.dmp

Download

memory/2956-359-0x00000000027F0000-0x0000000002817000-memory.dmp

Download

memory/2956-379-0x0000000002EA0000-0x0000000002EF1000-memory.dmp

Download

memory/2956-385-0x00000000027F0000-0x0000000002817000-memory.dmp

Download

memory/2956-349-0x00000000027F0000-0x0000000002817000-memory.dmp

Download

memory/2956-259-0x00000000027F0000-0x0000000002817000-memory.dmp

Download

memory/2956-380-0x0000000002EA0000-0x0000000002EF1000-memory.dmp

Download

memory/3012-388-0x00000000009C0000-0x0000000000A52000-memory.dmp

Download

memory/3012-389-0x0000000075130000-0x0000000075169000-memory.dmp

Download

memory/3012-183-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/5756-147-0x00000277FA0A0000-0x00000277FA0B0000-memory.dmp

Download

memory/5756-139-0x00000277FAA00000-0x00000277FAAB3000-memory.dmp

Download

memory/5756-140-0x00000277FA9B0000-0x00000277FA9BA000-memory.dmp

Download

memory/5756-123-0x00000277FA730000-0x00000277FA752000-memory.dmp

Download

memory/5756-141-0x00000277FAD30000-0x00000277FAD4C000-memory.dmp

Download

memory/5756-150-0x00000277F8640000-0x00000277F86FD000-memory.dmp

Download

memory/5756-138-0x00000277FA9E0000-0x00000277FA9FC000-memory.dmp

Download

memory/5756-130-0x00000277FA0A0000-0x00000277FA0B0000-memory.dmp

Download

memory/5756-142-0x00000277FA9C0000-0x00000277FA9CA000-memory.dmp

Download

memory/5756-122-0x00000277FA0A0000-0x00000277FA0B0000-memory.dmp

Download

memory/5756-143-0x00000277FAD50000-0x00000277FAD6A000-memory.dmp

Download

memory/5756-144-0x00000277FAD10000-0x00000277FAD18000-memory.dmp

Download

memory/5756-145-0x00000277FAD20000-0x00000277FAD26000-memory.dmp

Download

memory/5756-146-0x00000277FAD70000-0x00000277FAD7A000-memory.dmp

Download

memory/5756-131-0x00007FF4C41F0000-0x00007FF4C4200000-memory.dmp

Download