c951b65882a1902ca45f74147c5a5633ac33950a68041d3d084c35e828681434

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 337KB
Sample260627-aecafags4l
SHA256 c951b65882a1902ca45f74147c5a5633ac33950a68041d3d084c35e828681434
MD5 6ff008198f52d935cc3aa43b93d4a079
SHA1 3347b2c0aa779a9b49d8e13d2aa75f2e35f2a041
SHA512 0c421ee1b7a777f4b1e5ec46a45575d7219071187eaf9682b1ff11ad6a5ece9dec638dde38dd2c04c4c8af1efe67bccd0f5ed4f23a45a720334d670cf559ca55
SSDEEP 6144:EihDN2PrZh9TS89Tm1g9leMNjVRFVPZR2l1JNsN91FHDm3UUSGOdjTs:tDqjrleMN3FVPZRjN9fjmJ
TLSH
T1BB744B2FE7A348FCC15BD0358AE6D7B2B031BC4803247D5E1A95C7763E24E544FA9A68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HelperAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Agent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Helper64HostProc-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Helper64HostProc-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WinTask	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WinTask\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2440	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HelperHost\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Executes dropped EXE 1 IoCs

pid	Process
4268	HostSvc.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CoreProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\NetHost.exe	x_plfg.exe
File created	C:\Windows\SysWOW64\SvcHost.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\MsHost.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\UpdateCore.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Runtime32.exe	x_plfg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinHelper.exe	x_plfg.exe
File created	C:\Program Files (x86)\NetAgent.exe	x_plfg.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\SvcCore.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\SysAgent.exe	x_plfg.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\LoaderAgent.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\CoreProc.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Win64.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\HelperTask.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\Sys32.exe	x_plfg.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6440	sc.exe
6192	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	x_plfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	x_plfg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4992	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269924446536216"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{48316403-EF9E-4477-9D6F-12D42E0B7F86}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{2C57833B-0AF7-400D-B799-3E1B4B51F3BF}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	powershell.exe
2440	powershell.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe
3888	x_plfg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
7028	msedge.exe
7028	msedge.exe
7028	msedge.exe
7028	msedge.exe
7028	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeIncreaseQuotaPrivilege	2440	powershell.exe
Token: SeSecurityPrivilege	2440	powershell.exe
Token: SeTakeOwnershipPrivilege	2440	powershell.exe
Token: SeLoadDriverPrivilege	2440	powershell.exe
Token: SeSystemProfilePrivilege	2440	powershell.exe
Token: SeSystemtimePrivilege	2440	powershell.exe
Token: SeProfSingleProcessPrivilege	2440	powershell.exe
Token: SeIncBasePriorityPrivilege	2440	powershell.exe
Token: SeCreatePagefilePrivilege	2440	powershell.exe
Token: SeBackupPrivilege	2440	powershell.exe
Token: SeRestorePrivilege	2440	powershell.exe
Token: SeShutdownPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeSystemEnvironmentPrivilege	2440	powershell.exe
Token: SeRemoteShutdownPrivilege	2440	powershell.exe
Token: SeUndockPrivilege	2440	powershell.exe
Token: SeManageVolumePrivilege	2440	powershell.exe
Token: 33	2440	powershell.exe
Token: 34	2440	powershell.exe
Token: 35	2440	powershell.exe
Token: 36	2440	powershell.exe
Token: SeBackupPrivilege	4776	vssvc.exe
Token: SeRestorePrivilege	4776	vssvc.exe
Token: SeAuditPrivilege	4776	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
7028	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3888	x_plfg.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 6624	3888	x_plfg.exe	91
PID 6624 wrote to memory of 2440	6624	cmd.exe	93
PID 3888 wrote to memory of 2276	3888	x_plfg.exe	95
PID 2276 wrote to memory of 6192	2276	cmd.exe	97
PID 3888 wrote to memory of 7148	3888	x_plfg.exe	98
PID 7148 wrote to memory of 6440	7148	cmd.exe	100
PID 3888 wrote to memory of 6456	3888	x_plfg.exe	101
PID 6456 wrote to memory of 4992	6456	cmd.exe	103
PID 3888 wrote to memory of 5028	3888	x_plfg.exe	106
PID 5028 wrote to memory of 6036	5028	cmd.exe	108
PID 5028 wrote to memory of 5100	5028	cmd.exe	109
PID 5028 wrote to memory of 7016	5028	cmd.exe	110
PID 3888 wrote to memory of 7028	3888	x_plfg.exe	118
PID 7028 wrote to memory of 6944	7028	msedge.exe	119
PID 7028 wrote to memory of 4428	7028	msedge.exe	122
PID 7028 wrote to memory of 6356	7028	msedge.exe	121
PID 7028 wrote to memory of 4428	7028	msedge.exe	122
PID 7028 wrote to memory of 4428	7028	msedge.exe	122
PID 7028 wrote to memory of 6728	7028	msedge.exe	123
PID 7028 wrote to memory of 6728	7028	msedge.exe	123
PID 7028 wrote to memory of 3012	7028	msedge.exe	125
PID 7028 wrote to memory of 3012	7028	msedge.exe	125
PID 7028 wrote to memory of 3012	7028	msedge.exe	125
PID 7028 wrote to memory of 1808	7028	msedge.exe	126
PID 7028 wrote to memory of 1808	7028	msedge.exe	126
PID 7028 wrote to memory of 1808	7028	msedge.exe	126
PID 7028 wrote to memory of 6940	7028	msedge.exe	127
PID 7028 wrote to memory of 6940	7028	msedge.exe	127
PID 7028 wrote to memory of 6940	7028	msedge.exe	127
PID 7028 wrote to memory of 4980	7028	msedge.exe	128
PID 7028 wrote to memory of 4980	7028	msedge.exe	128
PID 7028 wrote to memory of 4980	7028	msedge.exe	128
PID 7028 wrote to memory of 6216	7028	msedge.exe	129
PID 7028 wrote to memory of 6216	7028	msedge.exe	129
PID 7028 wrote to memory of 5340	7028	msedge.exe	130
PID 7028 wrote to memory of 6496	7028	msedge.exe	131
PID 7028 wrote to memory of 6496	7028	msedge.exe	131
PID 7028 wrote to memory of 5232	7028	msedge.exe	132
PID 7028 wrote to memory of 5232	7028	msedge.exe	132
PID 7028 wrote to memory of 5980	7028	msedge.exe	134
PID 7028 wrote to memory of 3776	7028	msedge.exe	140
PID 7028 wrote to memory of 2100	7028	msedge.exe	141
PID 7028 wrote to memory of 1196	7028	msedge.exe	142
PID 7028 wrote to memory of 6520	7028	msedge.exe	143
PID 7028 wrote to memory of 6520	7028	msedge.exe	143
PID 7028 wrote to memory of 1072	7028	msedge.exe	144
PID 7028 wrote to memory of 1072	7028	msedge.exe	144
PID 7028 wrote to memory of 6176	7028	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6192
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7148
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:6440
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6456
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "RuntimeTask" /TR "\"C:\Users\Admin\AppData\Roaming\HostSvc.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:5100
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "RuntimeTask" /TR "\"C:\Users\Admin\AppData\Roaming\HostSvc.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd0885c188,0x7ffd0885c194,0x7ffd0885c1a0
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10060354256281552754,11815713644517373537,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,11599243934238369707,16310324131997424017,262144 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,17760617588571631971,7497603100016122996,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,5290233798834442662,17923569864558909009,2097152 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,12232009261759028884,2455648188726014949,2097152 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5128,i,2338638694046985336,10071753797798060099,2097152 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3860,i,7003919293560779127,8398908344077473980,2097152 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13030573824892791272,6467675456016161966,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:12
    3⤵
    PID:6216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10611168539608791955,7206043384830468827,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8573319726818780150,16399928527825833324,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
    3⤵
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12747400407571112920,1141668407674635191,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17475277735168038511,14053261246642223766,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17475277735168038511,14053261246642223766,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,10134051381342201219,17597457066559220235,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6179447606750979938,2411449751760394124,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16567422350587436768,8678264544939199848,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,8474465499810671844,11600988250765210128,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,2184610795328502150,13706324361460819024,524288 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6684,i,17369302697947637574,11259047206379996492,262144 --field-trial-handle=2696,i,18329353591918970559,14871266150667395585,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:10
    3⤵
    PID:6176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:4808

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:1332

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:4292

C:\Users\Admin\AppData\Roaming\HostSvc.exe
"C:\Users\Admin\AppData\Roaming\HostSvc.exe"
1⤵
- Executes dropped EXE
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 afab44831d15737b93a51b5da32d6f7ffdeb215ed2ae065fce98d07ea4026ae9
MD5 577602fc13804460f1a4c682a14371fa
SHA1 75c72bc7e167208774b7c3c199ee72158d472d5b
SHA512 cf269890ba0a2bcf1c40983f5ab82ca0bed90f59b35f5275ced490c8da7884427c1e64cec45fcf6fb345409604822a89ee8e179211bc96abdb7d379a2baa2ee4
TLSH
T112D08021350EB882D11B10FACD62C316711985636263D10E7991D02DCC974D0B3C5597
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1fa5793fe6845769417d245f773360bdac44222bef2ab416aa3d6fa563dc9ab2
MD5 9587aafc640a78a75a13183a93e029f2
SHA1 8ee625628522c4f0750654eb38c5a437c0109585
SHA512 baf4442c9b7e634d8beae8c6fbc32e3e7fe9757f0b4a059020e802ddc7ac4fa192ac37e4a0cba2192a6498faa40042a60e3d26a99c49b15fe10280b9017d59a2
TLSH
T1BAF086AAC921AC3708FD0B1961A54A4AE75113672741999F3B3C830D4FB157B4686D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9bd3bd3ebcd14e008aa10caa227013b19e8e04237f79eccada331bc77327580b
MD5 fc5dc1de09a33ac770de0372e8dd9eb9
SHA1 8a243135e996078f627b7961d25fa40c7b7c519c
SHA512 2d65b545cf74a99ff3921f41bc90e044e13f1a76d2107c6783a822d7141c5eee989349ca81f2325fa9533539945fe6ce5b455c8b762770313f2b3db3ec5a1fbe
TLSH
T19C812AB2C4A55AD5EF1719FB24AEF48537BCDABF73036E0640566037B9426834C87C81
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ea5467229fe8d0d052864b5da7197c14511058cafe3e2582afe6cc508643450e
MD5 66445d7546117bddd16364c8e3d1e9ba
SHA1 9a888bc260cc0704ba05cf8b1ad9a5b37d2a1cd6
SHA512 1c679d5a74bcd32274a8106ea054968bf54df73512a65f59f2ff1a343e2c07edbcaf5304a3f2ad5da30fd8a254dd7f8e0ab18e1fb089af094e682b8aa064ad8f
SSDEEP 192:D+1rLb2OoheSchWGjhnij6LQv1Bqw3SvnNwx:D+1rLb2OoheSchWG5iGLQv1Bqw3SvnN0
TLSH
T15CD19FF7C7D8822DD81116F4A7147D1ADE2E0D6483283C6AD9E5BF4BA3E6431D244A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1049142ae7f32e14cded1f3f02c0df59d426fd39d56f9b27e7d58d7338f80657
MD5 c8c60b35bef5c5086d2c5f6137b3d1db
SHA1 deb3585caeb0b913efa9a1d64095720b5ed8f561
SHA512 961b34e3854641b4d8c9b078073b739865d9f1bb5917073269079233422224608abfe60f285ebe40102dacc5818adfbf13df70c8fe205e157dc01015156d3075
SSDEEP 192:sxRoJRtyMqZjK1Ml8wcN/fns7BVaWsZuApqmMzoA8p/VVzkwy/g6+WNlbIU/B14x:sxR2iCN/fnsFlSPq8NVFy/5db/25vPj7
TLSH
T1EF72E8166934497B8DDBD619F695BB57D2F81163E1805E44AAFC8B1C00EBEED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a8243e49dcf3884b9828eb36f4e02082bc1861824e213f528faed00f7608b8d0
MD5 6a5caedbfdbce9d6a0a7e4b7fc432cbc
SHA1 fe81073db6922fc2c6162a6fec0e939058fc60af
SHA512 22063650c84eddd2f1e7786b15536f7054a78c45c9626672d8bc7f619a611669fb86b41999e43dad3a6afd64e61843e56153596e5e168f243699c32cd4c0f171
SSDEEP 384:sxR2iq5N/fnsIqSPq8NVFy/5db/2wvPUX:sit5N/fVqT/5l2aq
TLSH
T11C82D7166934497B8DDBD619F6927B57E2F81163E1805E44AAFCCB1C00EBAED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3d6c3f9ac069aaac3deb251eef3f69fd6abadd9f50a45f18183d9c93eda12579
MD5 cac3e72544d1151256fc399d9267967d
SHA1 7d216ee9b45428b80bc082c973bf5bffe4904a17
SHA512 29bd133ab6dd07ea1eb780bb7bc909f79857f575d2cbe68ac91e1ebbd7e9cc95069562ea214b3b2e8802128e339fe2a6d8865bf392b7b783a47173023315e467
SSDEEP 768:AeaxFJ7pLuL7n6WgGMffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjrxu8CcrofF3Q/:AeaxFfE7n6WgGMffAu1jaYrxBCHd3Q/
TLSH
T119E2DB3B680CCB7F4F844A9CEC29BD9E6DE801CF9698CD5447EA840C03C66EB55165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7fde9c82-77ec-41d9-92c7-2b762a914693\index-dir\the-real-index
Size 2KB
SHA256 48eb4bc2077a3d077cef6c4c233d9517ed58b4e2c77ff109dbfcb7973ac4af42
MD5 acd401167369a75ce017e4224df152de
SHA1 b3ca7b753cc91c8b80b90134c152ad8a3cc23883
SHA512 22ae681daee984da691b5962ddbe5adfc50d740397bc1245bef5f5c7aa3b8cf7a67196771cf13824fc153e1989e390324086082094e356991d8cad9bf84b156a
TLSH
T14951628CC980A79DE87161BD19A415F293B52C28FC58C3A281A4F1B57453A681B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c5bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7fde9c82-77ec-41d9-92c7-2b762a914693\index-dir\the-real-index~RFe58c5bc.TMP
Size 48B
SHA256 56857168b0645723f221693ca11a835180f68dc5829298cacea5bf5d0b8bbfcf
MD5 a71e9d57048ea59332f693a951c15c46
SHA1 fb7a34fbad4aa3935cae2efe4c591073a624445f
SHA512 26bcfc56f94096efbfaabd3627e37a8e8dc7d140a74c80cbd7b8794549a04db96e85bc2e4290c4a84cd4e7840bcc1be63113c333dc375a405420dba78a4ba634
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 06ca8bbbf48f3e8f4af567258237df19cf580c0f2af5434b4cd140d6e16ed82f
MD5 df17796de25742069f2ff6ece495faf4
SHA1 0d58a56f505192852968c265f224eaff98b1444a
SHA512 2fe601bdded579011fe90dc9d3b630096c781b28223740658e15b83cc59731c208b14e4cef3d86476df4e808eab9b50d0ca1563964181a4f76ebb626d6722d4d
TLSH
T184D0A9A38532A82E1B34BE80903C624D841E8E98DCD29EB88A09B2866478A13C04252A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 9065e6e7fc32c8e4e1398f2c86edae14c6650ad09d3268bea4fc39a6e3dc45a1
MD5 37602a89ec5c01f7d2990e0ecf807abb
SHA1 a67d08b47158da6a356dcf03caf1b1bec419e267
SHA512 2e1d312974bba5d825603c3219de59f62d6d6d24473722139dbe1279d9656aef3995938ac4dc0222c4b8f51e92946ae5d162d7851309159d79ed290bc55660f0
TLSH
T100C09BE38522956F0E78BED45039725D954F43DCDCD1CEF851195145B4349138441529
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 028a02c14992c3b63c4625150bec4f428d8489254a6002c753061f33094436fc
MD5 dc049800a70474c96a63ff26ce10db5d
SHA1 c019eddbe3b03412b42c55c37fba3bbf62a09e0a
SHA512 24af49efbe4a1a6a99195744f0ff48bd1e53afc769c7cca4f860049ca5c7110eed5130ad124b8b093297a6b58da4d1b87ef8a6ebf646e04f59ae11c9a571a63f
TLSH
T107C02BE3842241AF0E70BED46038721C840F43ECCCC0CEF855086142F1389138400429
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586e74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe586e74.TMP
Size 137B
SHA256 15257793ba93184d6cca23f258656c845e7d5cf27c9688e17198918cc2f42d0c
MD5 c43667a3ec8b40d96fba26dbd43742c3
SHA1 b573d7efa0a0314470b5c2094c00dae84f5d2969
SHA512 a5fdc1698fd1c776c9e690fe0f7e42c14c9a2e52ecbe84f46fa058da31d6eb0f730611ca348e72adb1818972bc48ba65e75b3a7512908b07a29cdd675403bfac
TLSH
T178C09BE38532456F0F7479D4B038725D955F4FEDCCC1CDF8911A7145B034A13C501529
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5d179cfc9933eccaa1e0a8d8c65917cf7f6bbee570a146703d27c27188567b10
MD5 89f13439bc9fad2975a3f4a69dc8dd93
SHA1 2052e41b61937ac58b80cc3b5cc196f13fd7a757
SHA512 10e0f95c998eb7a72b192d4c4d99dcaa4a6bd9a856d7d1d5cc44c84e002a3efd483e96215cb38eaf59225f234599489737cec2b7b22fb7a775ee9c099bb9a916
TLSH
T184A002340349A101D81406F02D55155973A18DD6012512024598D5D8ADE5A5072CD301
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd21.TMP
Size 48B
SHA256 fb1d9a552f1bedb34b5c23f141934be272355a6f03bb51879eacc77bec5f5506
MD5 53fe155bc94da909cfe1738535da4bd9
SHA1 98969c873a7fbd50d347a5336a83d6f0eec2d1b7
SHA512 214ec7908eaa6a736ddbfe4a74612eb317c96c477adacebb7fee98f79286f0b83ef7b3dce98e7bafb4ae2375857fbe9c39ef6ec91ce30d58644a31761eabd4c0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5a0a805b8261daf39046ebeb97ab50b047270193cffb5abc28040b11c74d590f
MD5 3a26bdb90702c20a04b6a340426ce569
SHA1 3ab73de6a89832b31a382d4865bd7e1981456208
SHA512 d080227629aecb26376f4f4f11c66c249a5ff66bcc0999df5d83e5cf22362fb8da489f0d9818d13e580d4088c452606154e6e51de28d23528de7a35af016af9e
SSDEEP 384:CEsqH8wSgMr85QoaiVuNqCBUsDJO9ZfLHob0Vx1pVnopZUP2PHbAzvHvR0HLzT:CE9RKPHbAzvHvR0HLzT
TLSH
T1EBB23D51797E220139BD2919D194966F675230B3301EBA3B3BBD20E24EA7E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d9baeaf25ef995e6510d6ac175a47e69ea1d3e7c69f65bfd0b31166693e30b60
MD5 77da038c64f135a38d27b88f9dfda94b
SHA1 248e4a57aae6fddb496b9d4cbcc7a0be62110c1e
SHA512 90ee7f9bffe4305d71298558b5ef872c82f3add33fc4ecc378b1e3404761f9f608a7f349cb71f1966b9ca927880882c6021059f66fb6384fdfa6084fdb01a2e3
SSDEEP 384:nU5iF1tNn/s3n9SW8Ny8TUNTUlIRU/F3XHzBc2HfoBVgGq2fpmHTmn15wbAjE26B:UQF1j+9zvwgAtT36VHZfETmn12bf5
TLSH
T1DFC25B32E868CA77ADE78BC9B34A764BEEE041B395C859C8D5D84E4C00D72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 653417f13a2184c6fe82236b95099797073cb0e0e8a9edf9ee93b782071639f4
MD5 05d874f22217589aad2239ac5639db65
SHA1 d493fb06699c8a8cd6a4e312859d4e9a2d44129a
SHA512 52927be3c7138035fefd01c9d82c84dc4b4f4ff5147a950078503ca8269b28cbf5bcdc742a93bd73f2417b4480283e0572981baa6ac63ae14494fab27ccf9877
SSDEEP 384:nR5iF1tNn/s3n9SW8Ny8TUNTUlIRU/F3XdzBc2HfoBVgGq2fpmHTmn15wbAjE26B:RQF1j+9zvwgAtJ36VHZfETmn12bf5
TLSH
T140C25A32E868CA77ADE78BCAB349764AEEE041B395C859C8D5D84E4C00D72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ed9aa41a4dc1df4f8f1348edb2fdac385e132adc06e97c09b51108bce7d944a9
MD5 97faf292980a97ed20ea4e95b809d382
SHA1 45ae6638d17cad2e2bdea3846f099267918fb59b
SHA512 850a5949ace4ef27ccd97074aa9d9870d2e42e7d6037122b09b81f1a9adf14d705cff9e1b6a9155fb0e254d319e7d62aa454b73e8a6d92fa5b4ebf45767c7fad
SSDEEP 384:noiF1tNn/s3n9SN8NC8TUNTUlIRG/F3fGkAc2HfoBVgGqgzWITGT0Ii8Lk1Iz4xz:zF1j+9AXwgKZD06VHNzWi+0hvR
TLSH
T1DAC23A36D858DAB7DDF65F9AB709764BAEF001A390C86DC4CAD85D4C00872DD0347D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6ba608b02edf6bd242fffdb96c6511ae85e4de20211be47f8822a461852d141d
MD5 61276acb67c84bcb558329670a8394c7
SHA1 8c87c67eac29c812a6b74f2adc39b14ab4c857c5
SHA512 62af062eab4b6c4fb344c8ffb30e7793615349f055b3226ec6b0d4dac3ba7d7a2d8b1e6beaf4b91f1b92f54b41cfa01a6cd8f454f910fe7e68b71694cbc4280b
SSDEEP 384:nRpiF1tNn/s3n9SY8Ny8TUNTUlIRU/F3XdrSBc2HfoBVgGq2fpmETmn15wbAjE24:RAF1j+9dvwgAt9S36VHZfNTmn12bf5
TLSH
T1D3E2C3F198D78973D9AE4B8B637D2E4699FCC163B4880984B7D84D4CCC862BFC306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ec7b2bc14be0e136425d4dbd66c48d4ced79e9df4c9f496727c452d5aea04176
MD5 7ba455ba93bfbc15c3ef6846a5fdfe13
SHA1 82f61c96fc3a9f3d1c768b21906916f76ad30d03
SHA512 c3d8df34e28f62dacc6aa7f2edf4c9e018269ad143b24c6521e3e4a64b0d789038bb082be9a88e033c7f80467e0641102f84a636b1d5f848e8d71425d19e539e
TLSH
T1092112E15C391EC1C8BE0DEFB49B39FC94E8D326F6A034782894ED54162D61E264047F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_evucso34.bi0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evucso34.bi0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\31
Size 2B
SHA256 e5a08ffd3d7509c66e79642edbdcd8ed889269a7164c718afca541304188423d
MD5 946490ad0fdc17b3b899760a445128f0
SHA1 2934526b788a419c15c351c8462a7a7eef4633fb
SHA512 0f3cb2ce12431693621c47573b3d81a5113be7388db3dea9f4d457439ef04c987f5c01f49f5f067ad4cbf0e451b402f70313c9908a47291a80b947a78d4b37f2
MD5 SHA1 SHA512

Submit Download

HostSvc.exe

Path C:\Users\Admin\AppData\Roaming\HostSvc.exe
Size 337KB
SHA256 c951b65882a1902ca45f74147c5a5633ac33950a68041d3d084c35e828681434
MD5 6ff008198f52d935cc3aa43b93d4a079
SHA1 3347b2c0aa779a9b49d8e13d2aa75f2e35f2a041
SHA512 0c421ee1b7a777f4b1e5ec46a45575d7219071187eaf9682b1ff11ad6a5ece9dec638dde38dd2c04c4c8af1efe67bccd0f5ed4f23a45a720334d670cf559ca55
SSDEEP 6144:EihDN2PrZh9TS89Tm1g9leMNjVRFVPZR2l1JNsN91FHDm3UUSGOdjTs:tDqjrleMN3FVPZRjN9fjmJ
TLSH
T1BB744B2FE7A348FCC15BD0358AE6D7B2B031BC4803247D5E1A95C7763E24E544FA9A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-41-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/1412-40-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/2440-22-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-24-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-30-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-29-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-28-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-4-0x0000028CF6AA0000-0x0000028CF6AC2000-memory.dmp

Download

memory/2440-27-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-32-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-26-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-34-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-25-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-12-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-23-0x0000028CF70A0000-0x0000028CF70AA000-memory.dmp

Download

memory/2440-36-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-11-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-8-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-33-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-21-0x0000028CF6FE0000-0x0000028CF7092000-memory.dmp

Download

memory/2440-20-0x0000028CF6FC0000-0x0000028CF6FDE000-memory.dmp

Download

memory/2440-13-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-10-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-31-0x00007FFD07670000-0x00007FFD08014000-memory.dmp

Download

memory/2440-1-0x00007FFD077FF000-0x00007FFD07800000-memory.dmp

Download

memory/2856-375-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-457-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-596-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-430-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-648-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-499-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-637-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-534-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-545-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-556-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-667-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-627-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-580-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-608-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/3888-169-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/4268-44-0x00007FF688E60000-0x00007FF688EBC000-memory.dmp

Download

memory/4292-42-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/4472-374-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/4808-39-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/5100-38-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download

memory/6036-37-0x00007FF6B3260000-0x00007FF6B32BC000-memory.dmp

Download