a1d6e188b398a798a02c2b69fb3e0803bc8f17acfe59208f4c1ca7a02d43efb3

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LauncherBytearmor.exe
Size 2.5MB
Sample260602-beftasbx3r
SHA256 a1d6e188b398a798a02c2b69fb3e0803bc8f17acfe59208f4c1ca7a02d43efb3
MD5 bbf4f7872c5ef807f8992dc676d683bf
SHA1 e5de3d2229a4f83ecb26c0c0aa92309405889114
SHA512 69694c7f3947b3f443cde2fc47cfc84d9c1563811cf21341e86becd078a1b305318b4e4c6daa771c12b86fdf24c0f7513d26b5f7b26244ed65e3e88279c3d492
SSDEEP 49152:kVrfVC5upB+rnlzAQFv5oeohuP9364Jyy8vNgDfJQK1T:yC5uPANv5ohE936438O1
TLSH
T115C548877962F1A1D854B1F7342381713B28BC647B71A3F76ADC11BA1B721C809FAE94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 4216 created 1040	4216	LauncherBytearmor.exe	82
PID 4216 created 2792	4216	LauncherBytearmor.exe	83
PID 4216 created 5928	4216	LauncherBytearmor.exe	84
PID 4216 created 1048	4216	LauncherBytearmor.exe	85
PID 4216 created 3092	4216	LauncherBytearmor.exe	86
PID 4216 created 3768	4216	LauncherBytearmor.exe	87
PID 4216 created 2840	4216	LauncherBytearmor.exe	88
PID 4216 created 572	4216	LauncherBytearmor.exe	89
PID 4216 created 1040	4216	LauncherBytearmor.exe	82
PID 4216 created 1040	4216	LauncherBytearmor.exe	82
PID 4216 created 1048	4216	LauncherBytearmor.exe	85
PID 4216 created 1048	4216	LauncherBytearmor.exe	85
PID 4216 created 4184	4216	LauncherBytearmor.exe	94
PID 4216 created 2384	4216	LauncherBytearmor.exe	95
PID 4216 created 5056	4216	LauncherBytearmor.exe	96
PID 4216 created 5448	4216	LauncherBytearmor.exe	97
PID 4216 created 2960	4216	LauncherBytearmor.exe	98
PID 4216 created 5044	4216	LauncherBytearmor.exe	100
PID 4216 created 3832	4216	LauncherBytearmor.exe	101
PID 4216 created 4184	4216	LauncherBytearmor.exe	94
PID 4216 created 4184	4216	LauncherBytearmor.exe	94
PID 4216 created 5056	4216	LauncherBytearmor.exe	96
PID 4216 created 5056	4216	LauncherBytearmor.exe	96

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4216	LauncherBytearmor.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1048	chrome.exe
5056	msedge.exe
6112	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LauncherBytearmor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LauncherBytearmor.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248358250981489"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe
4216	LauncherBytearmor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	LauncherBytearmor.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe
Token: SeShutdownPrivilege	1040	chrome.exe
Token: SeCreatePagefilePrivilege	1040	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
1040	chrome.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1040	4216	LauncherBytearmor.exe	82
PID 1040 wrote to memory of 2792	1040	chrome.exe	83
PID 1040 wrote to memory of 5928	1040	chrome.exe	84
PID 1040 wrote to memory of 5928	1040	chrome.exe	84
PID 1040 wrote to memory of 1048	1040	chrome.exe	85
PID 1040 wrote to memory of 3092	1040	chrome.exe	86
PID 1040 wrote to memory of 3092	1040	chrome.exe	86
PID 1040 wrote to memory of 3768	1040	chrome.exe	87
PID 1040 wrote to memory of 2840	1040	chrome.exe	88
PID 1040 wrote to memory of 3768	1040	chrome.exe	87
PID 1040 wrote to memory of 2840	1040	chrome.exe	88
PID 1040 wrote to memory of 572	1040	chrome.exe	89
PID 1040 wrote to memory of 572	1040	chrome.exe	89
PID 1040 wrote to memory of 5024	1040	chrome.exe	92
PID 4216 wrote to memory of 4184	4216	LauncherBytearmor.exe	94
PID 4184 wrote to memory of 2384	4184	msedge.exe	95
PID 4184 wrote to memory of 5056	4184	msedge.exe	96
PID 4184 wrote to memory of 5448	4184	msedge.exe	97
PID 4184 wrote to memory of 5448	4184	msedge.exe	97
PID 4184 wrote to memory of 5448	4184	msedge.exe	97
PID 4184 wrote to memory of 2960	4184	msedge.exe	98
PID 4184 wrote to memory of 2960	4184	msedge.exe	98
PID 4184 wrote to memory of 5044	4184	msedge.exe	100
PID 4184 wrote to memory of 5044	4184	msedge.exe	100
PID 4184 wrote to memory of 5044	4184	msedge.exe	100
PID 4184 wrote to memory of 3832	4184	msedge.exe	101
PID 4184 wrote to memory of 3832	4184	msedge.exe	101
PID 4184 wrote to memory of 3832	4184	msedge.exe	101
PID 4184 wrote to memory of 2316	4184	msedge.exe	102
PID 4184 wrote to memory of 248	4184	msedge.exe	103
PID 4184 wrote to memory of 2316	4184	msedge.exe	102
PID 4184 wrote to memory of 248	4184	msedge.exe	103
PID 4184 wrote to memory of 4248	4184	msedge.exe	105
PID 4184 wrote to memory of 2716	4184	msedge.exe	106
PID 2716 wrote to memory of 1276	2716	msedge.exe	107
PID 4184 wrote to memory of 5556	4184	msedge.exe	108
PID 5556 wrote to memory of 3468	5556	msedge.exe	109
PID 3440 wrote to memory of 5956	3440	msedge.exe	112
PID 3440 wrote to memory of 6112	3440	msedge.exe	113
PID 3440 wrote to memory of 6012	3440	msedge.exe	114
PID 3440 wrote to memory of 6012	3440	msedge.exe	114
PID 3440 wrote to memory of 6012	3440	msedge.exe	114
PID 3440 wrote to memory of 1788	3440	msedge.exe	115
PID 3440 wrote to memory of 1788	3440	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\LauncherBytearmor.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherBytearmor.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffccef2c728,0x7ffccef2c734,0x7ffccef2c740
    3⤵
    PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,668948967980291424,10517830855218290460,262144 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,3468648311855945394,3186169310257508637,524288 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,14057797138767587208,4375370856196659629,524288 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,1470414183624395406,5967458145034230754,2097152 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,1166310019350009023,1381974708011901330,2097152 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4140,i,1538769507348751357,7792755384590689106,2097152 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4184 /prefetch:9
    3⤵
    PID:572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,11823628289545428556,14902271279907971327,524288 --field-trial-handle=1892,i,3641754329051333370,9272509511561043025,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcab19c188,0x7ffcab19c194,0x7ffcab19c1a0
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,6172230937382995899,14147777623263430193,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1660,i,9077397569349327032,14694552752680575523,262144 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,13716655605932311599,11267598533960664216,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,7865328024352687804,10081358194663951783,2097152 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,10017552034248939775,16451776421041411579,2097152 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,16513511288841214982,3219644607374836606,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,11529981236748889625,7140154071193928978,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2779884231261836789,1264050580199269250,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2779884231261836789,1264050580199269250,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,10214051118906777549,10772529496976441275,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4018051828553498418,17330520877659740743,524288 --field-trial-handle=2220,i,9233331662869377125,3357046492635502185,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:3468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffccef0c188,0x7ffccef0c194,0x7ffccef0c1a0
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,12690573160886159879,2191844706711296844,524288 --field-trial-handle=1968,i,1526510575934992638,18031437212069414798,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,12334160767796881871,2094503834550954008,262144 --field-trial-handle=1968,i,1526510575934992638,18031437212069414798,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,10228313787219607663,201404668088507859,524288 --field-trial-handle=1968,i,1526510575934992638,18031437212069414798,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7099b0478a1dc647a7e247d39a1187e85f9a1d17d5fa34000525a1775bc60381
MD5 fcc547488ed53c5509902828f111ff0f
SHA1 b6f533df29e33de932cb2c2acb08424a3d5044f7
SHA512 96766cdd417aeacace1db7d1b201298d6760ec76a741593c89a9987bc1a5807d20859b2afd4b20366fa39057d7c209b9e65a0aff55805e33613092a733390920
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OyvezSVumdnr:1nbZeMrv/hGty+cnr
TLSH
T1FAD3864B3A747102EDE5DA721CE050BB5E3CB16D8F55A5D428B620588EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 881a2757ed2b400435f41439d4f3dfd8ec0716a4f220ac48fb2ce2e12ce71135
MD5 a0d5436b5d753c06e6bd3b5d76f77456
SHA1 e3754f9191889b022ffd2050e738a0357d01b4ed
SHA512 184f33a0df68c913229089704b67073bdbf874c263e6ec09b98988ced5e9a4b9d2dfd1d59c26c15418857d298c05d04d5e0dfa0e08416f344b6a2d3da154a32f
SSDEEP 3072:tzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:ZWDfxA3OnjrYQ9EU0/hEg
TLSH
T138C302A15D35BC660CB8EE99744C3F60BFF4AD9A91879DC362ED1B0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 82d12d77fd8f81c611499d63464bf6f0f984da4aa13ed54dd99d0f60082816b2
MD5 fc848f59d316db621a5c54c0b7a741e4
SHA1 662ffeef776fc53ccbd7bb0c01770eb937e82be9
SHA512 cea0c8b840276dc397c5555637fe9cd2ee866ecf69242065a8e33e157025afb1a92bb0ba9453c3bff24d441b9d112877b365e55f68c965cfa57e2b7c498d6239
TLSH
T169D080EA5B567411DB3DD135B4D3C311177994F018411F04765DF51C59E02DC55930C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1e47f9a86e26eede097546c847e4ba0c592c9ea627126f053f21190e0e5a2616
MD5 9933d11eac8adf7d1a3f9e1f8571dc46
SHA1 b4058a8facb1880bef8ac47912652e6ac0a2c0dc
SHA512 485a7ef692150600eb1f7dcbf121ebc9d5cddb214aafe717a85235ade85b66f588c93cac04fa4c9478c69573651c51091a705883c3397fc0b030166128b9c8da
SSDEEP 384:GCRUXso3bWXIF3vpwDoX1fK8WwL9VG1YiR0rLUSY1ejViV:zRyskbzFiDoXNomVG30HUSYwc
TLSH
T13C13C43DF2155C56FAD2043E090B1B786B7DDA25E1C4070B73F9B4A4439AB2A0A8FD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d4036dbe236908f9dd932ad2357c7703c8e8b327d0031f0030aee06cbc8a653d
MD5 bb102f55257f7094697be54e702aa821
SHA1 8898fd95fab7796a5309c06490e7cc3cdcaf89b7
SHA512 af0a8f775f58a86b347e314794cd6a8ddad77c7ecccd2a78c3a3e708f0ecfdcb49a96d0e00491e7fff3d1d8d84469b0cf24f8e83d3a06c3adf19a865684dba67
SSDEEP 1536:fSkMXz2L/GML/LqFtOe0lRd+dfUmpCL/SL/JA77ItEcf7e+74gqvmIa0LC0ghI:fNL/9L/OYSBUmQL/SL/afPxgqv95CZ
TLSH
T1B7446FFB5951A01BDBA802F5D2033E3DD177055D2CE1E9E9E6BC0C852825F22B6BEE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 0e560e4c6a9d106d3815b51b6a04aff39b7c1ac90aa8246bb457e28ca4cca43d
MD5 08806867abef18797dde32ea9e6d31d0
SHA1 958692271c600a2d7b2344612ff3a241c161fc9f
SHA512 422208792581c3207d01af2f6f06187c19c77756a5d94da66dfe85d43ce2863d95a06a3a8655b82819fa78fff336f28ae38c8adc98ae589fa6dd2eaf2af3685c
SSDEEP 24576:Ewb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1i+3Z7AkeOFSDsmifXV6:Ewe8YHLZTpEsW2GS9oOZe1bJ7A7zviw
TLSH
T1E9867DEDCA6898C3CD639930B1F0ED877C7413C3F595C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e56a315ce210e3702a02130cb52df62c0274a57ffbc152b3a3f70f856ef215b
MD5 dd256f19c609328c291f099da772a299
SHA1 61825bff8cd27583e367d075b199ea8a9822a22d
SHA512 743fda9c2897a99f3a45a6dea371b6c28b877e689cff76c828fb998ca83df999010d3b37609cd19133f91a071aa9f52e36bf942d5e375b29714d354c61b272a9
TLSH
T1136191D6F2227844F3203071B0C29E5A397251454AC79ED6D4F04B76EE2AB2D875FC0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 e2295167988f7d2b98ea0ca6c6ab4454376a9e671d8e71e7a1d206fd7afef7c4
MD5 c50f6ef2c4589b5cd82c47d9c55ea391
SHA1 3236b0dbb312c18fd033b7ff363879e63d2edab5
SHA512 bc203e9dba9b56845f666f100c04d0c871008147417c7e73bb283f364e9929f83429b61de845d8f7092d498b2768aa36328e795e7e5d0ff81bd2a296d72c0a00
TLSH
T149E020B459CBD15D761534CB51FC7B0881C0345BD7C66D4B1744CCDC7616105F2457D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 19a77e9cf1b93ed252bc2a59911f921abb2b7303508defd4f6e04a10e33e3fe1
MD5 5c0ae3667ba57c4613dc9c6fd515cf44
SHA1 7dfd6fbf4ce4cd26e301062e47f20fd3c9772a6e
SHA512 ee415830b2f4d29ec246a7bc71083ba3140563618e127ac2e9ed5b3cea505c562df50f32070021a77e9daae30b3a589eec41960a44383d1490c2337a710b75c8
TLSH
T1D8E0263405CAC179A1186CABC2EC770986D0B59BA2CB3E0A178C88846142241F3A76D0
MD5 SHA1 SHA512 TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 44KB
SHA256 c280a38d977a757a92dcfee565ed17789fe036eaae711986d6f93e30aa276394
MD5 53dd80c05377a5d5125946502d2fe470
SHA1 a69a5cb633d4ec8bb46d4c177fa311558d89b156
SHA512 99fe88997fc8f214471e62530a2299ca7f95f640789c789db637de6ec84dd5a6fef99549472488aeaa993eb2598aa45fdb559c04691e83550c4a7a686983f69b
SSDEEP 6:yDWlFPD+lqDg4EDAWvXoDgDEvXoD4DU4Di4lgDUoulAK:kih+l8gVDAFiEvXqaROk
TLSH
T1672348865D200130CD8F72B98D278183F83012CC9CE6880A5048D135111312EE9F4C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9a2a27eb98990c11231555a89dff6f8c7a29f84c5d6db1f8f88674c384f38ef6
MD5 7bb9a945b6297cc1fb84259ddc920603
SHA1 cf756ddc0a7cf4b17098398b7d8a602635422cf2
SHA512 d64c69a07602d995d09172decf26a811b6baf27bae95ff209a1594f96ed5c7dc25a83a5910d2b40c765d0df9bed4b2f145c1570cde4bc6ae5596829f7cfe5fe5
TLSH
T1F8E0D8B046CED1596604604BC6EC7B48CBE0341BD7CA2B091B4CA885B002004B395AD1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6b09d03de3d4a2997086e1c7019b51e9884125bfe121de9c7dfef9329aedf483
MD5 05fbcfdadb6b3807dad23e5503b714e8
SHA1 0343c445e35f0e06a314578682cd4a80e0906f6f
SHA512 bf980242c93c2729e7bc3a83bfe351283bbeac5d497d379d2fcea5c45ba9280cdc0c55c13d0488bfa35cf8eb5f6e016ae3cad9b4e0260d5a4b7625bb4d11da5e
SSDEEP 192:sxZWRAQ7sfBKQ7PgYsY0lIrpW/W6+WNGY0ZtphgiJnWJ:sxZWF7sfBV7orY0mW/bG5wiJni
TLSH
T1A732E91A6E2898375CCBE259FB597A53D3F9112360C05E08AAFC8B1C05DB6CD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 87f8f067c2b9273ce05bfefa1c09420a6343d022bcb9ab208f72f0010da44bfa
MD5 7f57e8e1ae1b9a047163ae712e8afd1c
SHA1 a39ac3900501d64840f29af7d6c7f385c81040c5
SHA512 694f25c3d04e9d63ef88ae1740746ad3d6de27aad51f5d69121b3bb064c9ca774c4a61eceb00b00c8f497f7f83ee3e4da07394b951cc3695c538a1688f448af1
SSDEEP 768:XpZH38yv2H47pLuLn1FWRm6GQom8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3IGC9Lly:XpZH38yv2HkEn1FWRm6GQomu1jaKIGCS
TLSH
T180F20B7B280CCB7E4FC04ADDED167F8A6EA802CB9698CD4047FA855C02C67EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 77524cde5cd28def266c726248d29690214098ff383a2e8bdbb4f12408617933
MD5 57ae812fe5b8be626fc89742b0ae5d01
SHA1 975e67a8d87f066378919eadf2a9d0afc8faeb1d
SHA512 84e593a52c167a73fe66191113c50735bc6b417cbb7ccd393a7201369ecc1591004a00d1b205ce34be2d94fc6adf4fa2ba2468afa282d48f56495bef97395560
TLSH
T166E086700AC9D2BD7115258742FCB30D96E4B42BD7C93D0A2FC9C948B153544F3A2DA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 66c70cc5a18978810ef0c6a9a6bc5c9367c4592b3daf35d65a97c3ffcb89460e
MD5 06d63bfb058e6b4d2277d377f8129228
SHA1 0b10946b4e6eee38ed22ca9d7d29ae12977bb7b2
SHA512 f083b799697a212f04214dbc6dab67f2640b64c64bd4e3783437514005a514399cfee640182fad84a957677f806b2d6f876de755b50341ae789afbc17bdff9d5
TLSH
T15DE0D8712AC9E26A7246208F82DCF70981E3F437D7C929192B4C9D44A20B140F353560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 427e44b2b3de8157fac89a372fe8442aac8f24a2ab3a59612a65cef2a8274ebf
MD5 812db3a6d38120f8f93ddaedb269ab30
SHA1 31eac83d35d7b5ab46cf9a6134b0655b09c485a9
SHA512 17ce0014d45c7a4fcabf34e920a97c6b2b3ea54cf25911231b3887b7f7675a0f48642a6da07d91ff4ee46535353185dcc76ecd2b9256f411a8ef6ed0e2564257
TLSH
T137E086748AD9D2B9A314628782ECF71D86F0F81B97C97A4E974C584CA602145B3BA990
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 13888d4c7538f11fe2c88822d08dd1e1fc56fe9f90c0a659c62bea66c6f3f20e
MD5 fa930482ddc6192241cb768b37d689cb
SHA1 eac6647dd2819f75005acfbe92f2c16cbe2d0e25
SHA512 718afab945da78d476a108ce942ee3704eda419ae63f1a4efef0bb83a5e0f17c8b0894eabb7ee85bd3e0ddf1f475c93598cf66cd9904af9408be5c5e6d485612
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlp5tQG5UA2:ctGj+BCNC5qFVpKxpPQG5UA2
TLSH
T1FAB2461632BA02023C3E791D87A597371A42B2733418E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d02c68142e281d35d7af9a4b9d99d5663e96290cdb47a9fa6720c1e18c121e38
MD5 47f454d4e1ae745f3d445785f3ff95c1
SHA1 19669eafc944cf76c55dbe9584b450e34df3a584
SHA512 7e65e5ee9f59a0e4e536949a8bc4df5dff23a3b12ec1bef8917c9cb83890d89dd370ad9b035d064affeb3e6db26beb0bcf7da312f0dc8621371ed89383d566f6
SSDEEP 192:FvoWcq4KMJcyfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:am4bJcyfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10824740A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 2b58171a3fe7fee8ac366cc8a6561ff8e654b1f7ef5b77d87b64204b116a9653
MD5 4bc6e19818bebf87c6a9e4776911cb71
SHA1 1773b3a75345e55fa87cd2f51e4fd0685cb0782c
SHA512 3928cf1603db88e64fbdd02ab905f612c5e67b3ec271f24c92d1b4504c00f3c742bc0cadbc5a63247fe4cc5bcbfde4ff83f3ad566ff9a80e093f99beea6aa1c8
SSDEEP 96:N89+fvgxZS1QQgOXeZeDWXWY1lDhseCWAWVvlrqxsWWVqxdm5sdmvM8cdmvMbx6V:HeOQjAsvlrqxrsj5RLhFCA1B
TLSH
T165221D646A021B3BE00D9EF712FD8B6017C2C5C3427676EE756108DD1DD662787C82FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 fa0105b50cadaaaf7fdfbffd6616a07d2107ee7c771215b5d509c0a6cc375cef
MD5 601315a1d6b49740ae13b2eee11c42b9
SHA1 aba54687c9f1584c10a803f47c182b917ea13a8a
SHA512 79ea4a57dcbc518602527af697d4a10ca7dc19b2963cef2181ed90349519049e3e9ca71600b34a20597e4c0d3b17aa8b2dea66be544f01535cb428e395441d13
TLSH
T12AE0207075C4D1BE7515609F41FC670982C0745FEAC52A0D1F4CC8486502900F3576D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6256f8959afa1806d6c67074de9d6fbd9fbbce9ee9cbe6bd0608ae20586dfa0e
MD5 c140f4fe7306ec373f424e4d05223628
SHA1 66ffbca64652c65c75f391724e73d2c4a0001c8a
SHA512 b91c8d273bac8d0b3b98be7a3d82bb57d945261578a04fbe7fd162799746df1ac86f4ae93a3b4b0a83db97c76de32a43cca5e02518cefcf68a6fe067b208466d
TLSH
T1C3215E55F321C108E18E867EA12BEB351328E8029FFCED1F847920252D76F010E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 85d6cee14e75736c70cd89732e5cc985b50bfa7601dc8c540bed96b55c02f674
MD5 38a138cf750b4695a65945bb24fab683
SHA1 7bec782292f87b8a3ccc79b871be32cdb8ab229b
SHA512 d84a163371cc7d2d77839d39d1b2b466268fdd1004d3b91d12e668454703477201cda3743fd916efeb0589edd407f7f3361ec4dc84426a1104ea960e3df1137a
TLSH
T1DBE0203075C4D2FF621520AB41FCB74982D57857EAD52E0D1F4CCC489902541F3575D2
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 048855ae3f7dedb4822059991305763162a0e7cab0fd3596fc6eff7bf1b7f1e7
MD5 7ee8227740f4613edb147c1321db80b0
SHA1 5b5dcd2d75132d33e44d87b3d8fecdaa93309957
SHA512 3d3e760f5bee960e1803d0102d5e4e6a35d6043c5d03459924154409cf2a3e4297ac0b14f69ad42d1f7c804e7426c5dc322d475a66c362a5be9ef912b89ecf27
SSDEEP 384:npiF9CcmyWCs38Nf8TUNTUlIxBrk6olGVF1zCfbHoMacjXSMe4KV8p0WMty/7Ig5:AFccps34wg4BGVzqoMbjXSMI8p0S
TLSH
T116C25C36EC98CABBECDB0F99E74A6603DDE05263869C9ED4DAD85D0C008718D174B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 689e15dc17a257846ee9ff3394ed3fd843853dd12ecdcb466f614ee5122473e5
MD5 7e49b25cf62d9f547022107f2bd704ef
SHA1 1e264fea210875140e5292b6a97ba553fe2a4817
SHA512 876ea464b8126417723a1b11408d96f6a7140cb3c6f148859505841308cbe72e212eeec0eb3bbaad9954334e59ea3bcf1a395fb897e39dd1428ab4fa1134a40c
SSDEEP 384:npiF9CcmyWCs38Nu8TUNTUlIxBrk68/0VM1zCfbHoMacjHX3R6e4KV8p0WMty/7n:AFccps3dwg4v0VGqoMbj33R6I8p0S
TLSH
T1DDC25B36E8A8C9ABEDDB4F99E74E7603CDE05263868C9AD4D9D81D1D008718E174BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 b20ca4589c8f379b43c13ae0409461361bb90cecb1dee885333c0ee1d066e862
MD5 a34ec9c59051b8fbf03b12c026f7100d
SHA1 2a5424f849994f5d1035666e8773c60ceeeb2e66
SHA512 cb1fbbd5dc88f914a199591b71613a1df81b9150b5fa6933dc3e23b2adefec833b904a986e03508c567bb9781fbd054f68777cda3aaa893802755cd55a8d4521
TLSH
T11BB02447C473C00FF45540D1C45C034114F4C047011DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

7b154f4f

Path C:\Users\Admin\AppData\Local\Temp\683fde6d\7b154f4f
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4216-144-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-102-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-139-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-118-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-116-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-115-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-113-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-111-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-110-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-107-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-105-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-104-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-103-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-101-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-100-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-99-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-98-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-114-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-112-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-109-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-106-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-76-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-75-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-74-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-73-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-71-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-68-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-67-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-66-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-65-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-64-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-63-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-145-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-142-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-108-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-134-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-135-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-136-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-137-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-138-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-140-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-141-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-143-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-0-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-146-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-147-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-117-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-70-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-69-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-48-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-17-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-16-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-15-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-14-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-12-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-11-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-9-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-10-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-8-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-7-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-6-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-5-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-4-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-3-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-2-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-1-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4216-2280-0x0000000410000000-0x00000004101E9000-memory.dmp

Download