hxxps://file-na-atl-2[.]gofile[.]io/download/web/93d4cf30-80c8-4a29-bfa9-131303a63696/Velocity[.]7z

Analysis

user interaction
yes
max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://file-na-atl-2.gofile.io/download/web/93d4cf30-80c8-4a29-bfa9-131303a63696/Velocity.7z
Sample260701-ccptvsd17x

Score

6^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
63	api.gofile.io
64	api.gofile.io
68	api.gofile.io

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	4376	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c920445f55e3dc01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "489635987"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{20BD7EBF-74F0-11F1-9D43-EEE306B5526A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{207DBF0C-AD0D-4B28-9281-EEE5D96F78AC}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273445765489543"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{ED2B6BF6-D077-49DD-B58F-ABBE0C9797C4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5096	OpenWith.exe
4860	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4376	wmplayer.exe
Token: SeCreatePagefilePrivilege	4376	wmplayer.exe
Token: SeShutdownPrivilege	4052	unregmp2.exe
Token: SeCreatePagefilePrivilege	4052	unregmp2.exe
Token: SeShutdownPrivilege	4604	wmplayer.exe
Token: SeCreatePagefilePrivilege	4604	wmplayer.exe
Token: SeShutdownPrivilege	2288	wmplayer.exe
Token: SeCreatePagefilePrivilege	2288	wmplayer.exe
Token: SeShutdownPrivilege	2504	wmplayer.exe
Token: SeCreatePagefilePrivilege	2504	wmplayer.exe
Token: SeShutdownPrivilege	4252	wmplayer.exe
Token: SeCreatePagefilePrivilege	4252	wmplayer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
512	iexplore.exe
512	iexplore.exe
4376	wmplayer.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
4604	wmplayer.exe
2288	wmplayer.exe
2504	wmplayer.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
5096	OpenWith.exe
512	iexplore.exe
512	iexplore.exe
600	IEXPLORE.EXE
600	IEXPLORE.EXE
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3344	3184	msedge.exe	87
PID 3184 wrote to memory of 3064	3184	msedge.exe	88
PID 3184 wrote to memory of 1392	3184	msedge.exe	89
PID 3184 wrote to memory of 1392	3184	msedge.exe	89
PID 3184 wrote to memory of 1392	3184	msedge.exe	89
PID 3184 wrote to memory of 4732	3184	msedge.exe	90
PID 3184 wrote to memory of 4732	3184	msedge.exe	90
PID 3184 wrote to memory of 3296	3184	msedge.exe	92
PID 3184 wrote to memory of 3296	3184	msedge.exe	92
PID 3184 wrote to memory of 3296	3184	msedge.exe	92
PID 3184 wrote to memory of 4648	3184	msedge.exe	93
PID 3184 wrote to memory of 4648	3184	msedge.exe	93
PID 3184 wrote to memory of 4648	3184	msedge.exe	93
PID 3184 wrote to memory of 2916	3184	msedge.exe	94
PID 3184 wrote to memory of 5112	3184	msedge.exe	95
PID 3184 wrote to memory of 2916	3184	msedge.exe	94
PID 3184 wrote to memory of 2916	3184	msedge.exe	94
PID 3184 wrote to memory of 5112	3184	msedge.exe	95
PID 3184 wrote to memory of 5112	3184	msedge.exe	95
PID 3184 wrote to memory of 2140	3184	msedge.exe	98
PID 3184 wrote to memory of 1876	3184	msedge.exe	99
PID 3184 wrote to memory of 2140	3184	msedge.exe	98
PID 3184 wrote to memory of 1876	3184	msedge.exe	99
PID 3184 wrote to memory of 4728	3184	msedge.exe	101
PID 3184 wrote to memory of 1400	3184	msedge.exe	113
PID 3184 wrote to memory of 1400	3184	msedge.exe	113
PID 3184 wrote to memory of 1400	3184	msedge.exe	113
PID 3184 wrote to memory of 1740	3184	msedge.exe	114
PID 3184 wrote to memory of 1740	3184	msedge.exe	114
PID 3184 wrote to memory of 1740	3184	msedge.exe	114
PID 3184 wrote to memory of 3100	3184	msedge.exe	115
PID 3184 wrote to memory of 3100	3184	msedge.exe	115
PID 3184 wrote to memory of 3100	3184	msedge.exe	115
PID 3184 wrote to memory of 2208	3184	msedge.exe	116
PID 3184 wrote to memory of 2208	3184	msedge.exe	116
PID 3184 wrote to memory of 2208	3184	msedge.exe	116
PID 3184 wrote to memory of 1076	3184	msedge.exe	117
PID 3184 wrote to memory of 1076	3184	msedge.exe	117
PID 3184 wrote to memory of 1076	3184	msedge.exe	117
PID 3184 wrote to memory of 1384	3184	msedge.exe	119
PID 3184 wrote to memory of 4748	3184	msedge.exe	118
PID 3184 wrote to memory of 4748	3184	msedge.exe	118
PID 3184 wrote to memory of 1384	3184	msedge.exe	119
PID 3184 wrote to memory of 1384	3184	msedge.exe	119
PID 3184 wrote to memory of 2292	3184	msedge.exe	121
PID 3184 wrote to memory of 3080	3184	msedge.exe	122
PID 3184 wrote to memory of 1332	3184	msedge.exe	123
PID 3184 wrote to memory of 1216	3184	msedge.exe	125
PID 5096 wrote to memory of 512	5096	OpenWith.exe	127
PID 512 wrote to memory of 600	512	iexplore.exe	130
PID 4860 wrote to memory of 4376	4860	OpenWith.exe	133
PID 4376 wrote to memory of 4560	4376	wmplayer.exe	135
PID 4560 wrote to memory of 4052	4560	unregmp2.exe	136
PID 3184 wrote to memory of 2636	3184	msedge.exe	139
PID 3184 wrote to memory of 2636	3184	msedge.exe	139
PID 3184 wrote to memory of 3028	3184	msedge.exe	144
PID 3184 wrote to memory of 3028	3184	msedge.exe	144
PID 3184 wrote to memory of 3028	3184	msedge.exe	144
PID 3184 wrote to memory of 3500	3184	msedge.exe	145
PID 3184 wrote to memory of 3500	3184	msedge.exe	145
PID 3184 wrote to memory of 3500	3184	msedge.exe	145
PID 3184 wrote to memory of 3636	3184	msedge.exe	146
PID 3184 wrote to memory of 4604	3184	msedge.exe	147
PID 3184 wrote to memory of 4772	3184	msedge.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://file-na-atl-2.gofile.io/download/web/93d4cf30-80c8-4a29-bfa9-131303a63696/Velocity.7z
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa98b6c188,0x7ffa98b6c194,0x7ffa98b6c1a0
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,11290398844656829254,5176157673380171678,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,3399240968417307371,14476340017224412024,262144 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,9084607351554410055,8624431854598200285,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17664348404024296430,3734242061597101210,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,4824264842331147670,16845986532326836736,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,7394875180140172740,8666871267188687810,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,9079328404897555340,11543989417326753192,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10235586528676659321,10397274528586038814,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17880595519763250585,17131595127278263395,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,12224106098688655165,2032078189130281572,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,12224106098688655165,2032078189130281572,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4324,i,11562599620688278537,6571070924242851493,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6252,i,12549978782447239508,15387006030930376616,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3600,i,13057845656538915621,11963141192052388115,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4396,i,4116742756126916345,967722694279400110,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4384,i,11560413185011260892,16585500931062983899,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,17083979792000841536,17775788301239249774,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4392,i,12281247269333371722,3564358039884966939,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9125933377824679243,14520590086866879317,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,412193896727999071,9357455966882265237,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,103942280610505813,2312920731102495225,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,14781016550880340191,11842097023023950079,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,17832278698586007846,5692193156635590576,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4360,i,10489384797456100043,17949202162564660861,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5772,i,7562365017728955157,16816134316555664418,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,8674737155362739320,13989645968908999098,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity (1).7z"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4604
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity (1).7z"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4772
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4400,i,13703507832561942996,14576793984393313849,262144 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=1236,i,4579634378946579953,2031234877357593300,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6864,i,12508759296540454640,17569431492937361551,2097152 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,18008715990418368612,3570346211714750777,524288 --field-trial-handle=2304,i,8748066834187199767,16347086581223916797,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Velocity.7z
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:512 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:4052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2256
    3⤵
    - Program crash
    PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4376 -ip 4376
1⤵
PID:4808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:868

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity.7z"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2288

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\Velocity (1).7z"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4664bca59d7a8fbb7d24ae4762c6416f14313acaee1641e7d6c9c0fdc441a28b
MD5 f8325141fe65edd862f0cb8bfae9324f
SHA1 d17a33835f308862269e1ed353f0e3310f45d4d3
SHA512 2e61c38e82b5308d78418e578e760f88214fa70893e5fd958b91b4b33e13d056ed6f13c810935afa3fb5dff340a9f24c1d2352ce100cf4658dae102e7d038868
TLSH
T156713C35E202D4A9D3B013317081236DF071A9C8FA6BDECD3E7358B79500F29721D926
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9cd6d41ecf540e279456172231b157ce8f999d33eb8cda9df622f0744b98c59f
MD5 24b7b6273d56300369f58d5f209342ae
SHA1 a2f07d1fc145f1b26d277c4327e82dc5d6aa62d0
SHA512 dcb0ff68c8c969957409e9c351342e11d299ec3c8c7f72f61f77efe8678b7bb9da5eb6b599aed56a0b864c45228254017eb37b19158bbcaca35d8c0e7f66bfe6
SSDEEP 48:M+94It0C4x7wFlCuXd/iKPjZyK5FfSTWUQvkdWZTWHzy:Mk43CqwFQuQKfSFaTF
TLSH
T1A7913E35F602D4A8D3B21330B2C26B6CF079A5DAF927CE9D3E7348B79504F16610EA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a284.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a284.TMP
Size 3KB
SHA256 f88db553303d551fccce85519eb66b740fc5aec5021e8052528eea7b1c4fe945
MD5 684027c8d248ca8a070d074f18a0d52d
SHA1 07c5f2914f5d58636cb9baa2bf30857a6af6777c
SHA512 d80e0c6a118b2d5b1e696efd593880c1384f26e330690b6b00ed2c26f7a8893a690f7350cb8d9aade7b6cb55341567e1ef2d40fba6767c9e94941e357253a64d
TLSH
T186713C35E602D4A9D3B013317081236DF071A9C9FA6BDECD3E7358B78504F29721D916
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 17716368b5326fc269db41c6f221872c224193056e88eb61df192db35fa94291
MD5 8fe31151c3325f9f1660d2cde16eed2c
SHA1 46cff5c53ad069d861e9cd877d1881462fd37772
SHA512 a2321090bd36387b3e4b1542f18e13ea23dab9b8042577b7012a8e1e91f829f854037b9be21775dad9dfe16f665f4226062c6226fb424ad35b006ca4b4f2fbe0
TLSH
T14551ADF3C3E8856D8D2256F4AE14AE1BCD5C1426832C79398AD49E07A3E3971D10574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 398549c28d0a837eeeb3639a9c9c723d8045554cc250b0a120d2244d8c70763c
MD5 b400eb87027718276f7718cfac706e1a
SHA1 74c679e566c2323e4e43cfecb09edef73baea058
SHA512 5b46f9e8696e7293a4e5355cff11a8ca12066d1a76e59de4df858dc3aee142e993411fd8e75f2010cebe90e41404e1e1c15a4bfc95dd3eb990534ce4d40ab1bc
SSDEEP 192:sxZVInRI6yM/jK1Ml8MkYq/f4Ssq673XqwVIwIdpJHW6+WNGYvxV3EolILDFSaIa:sxZ4bMR/fzsqUHWJHbGq89
TLSH
T1AD42E7526A345977CCCBD209FA51BF53D6F91563A2900E48AAFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 af78d5914ed4dab91b684e09d80bd5e146fbd51a996e5f6edeab289706abd3cd
MD5 34213dbe9da3911068ac12697ac78b7c
SHA1 9b06dea4f01f5c97911f68773dcc50ef32ecff78
SHA512 17b86343bc164cd42208b5338b2fb85efbeccfba8007a07768c43534665b43b39833bb5a028efa59c0453ef3bc2a9c000378f53e9e0b3d6bb6013f92dda7ce01
SSDEEP 192:sxZVInRI6yM/jK1Ml8UQYI9Yq/f4SsYw6cb3XVmVIwIdpRlVcHW6+WNeVJnXYv2W:sxZ41qrR/fzs33HXuHbmX+8m
TLSH
T1D052C752AA345977CCDBD20DFA51BB53D6F51463A3900E48AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3bc718be8c7b2e51e07982d3c66ceeb86cfdb0057f28421b4e38410410cdd332
MD5 31be8c5aa15065bd3f2fa18e686fd8bb
SHA1 feea8c7a49b84c8e95f5b078baeb6655de3bace4
SHA512 d95932a76646855adbe8d02216eae0a4a79a58862d2ec4de83432f69f6e30fb1e72f96fc035947eb3fb2598d0ad86edc1526191c61a9c7e8df49998ad84629e2
SSDEEP 192:sxZVInRI6yM/jK1Ml8M9Yq/f4SsYw6cb3XVmVIwIdpjlVcHW6+WNeVqU/Yv2TVlt:sxZ411R/fzs33HXMHb2/n8m
TLSH
T17052F8526A345977CCDBD209FA51BF53D6F51563A2900E48AAFCCA0C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a2b2bb46f8a232e250138453c9c5cae622c09e61d5bea2ca707fceedd2c4e470
MD5 51d1322764530e14d4de73858be0b1f1
SHA1 7137adc5534a2611c7a5c10bcb254d5b93c8bd2a
SHA512 74635b3aa88fda9389051eac2c071532b0322f67550509764487520eea2a36c6e7f2b569a9cda4c4888c969b7e93b753250b91102d7b31706d22632b0482ab98
SSDEEP 768:OwseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp9roCN:OwseJ3xWvhfynu1jaVcL88p2A
TLSH
T1C1D2FB2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5d0df9cbedc87614c54fb7fe1798c3c0f3d33266dc237fc2e8d8b35c3c5d18c5
MD5 b6c839dd1f7c2d8882046595ccfb4ac0
SHA1 247e0449dcda5af24a14618860f442b1e8909f38
SHA512 e1bc6b235608689ccdfe9ced6311030ee611615528bd7ed6a9cea6327085f6a1e36fa5a0158745436ee2e27082e32709ca9649eaecfe87a4c38b4dbb2a7a3f6b
SSDEEP 48:KYHIhKggkXyZqIvK7i4Pyd9I5Kec0/fItpfdK:KYH+Kggm6qUK7iqW9yKecSfItpfdK
TLSH
T1FA917C16363F020238BD2558B2A995778F4135A37458A86FBFF800754E6BE112EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

689feac9-37eb-45ed-bf1d-85d46bb5fc4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\689feac9-37eb-45ed-bf1d-85d46bb5fc4a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 40b36edb2db8ce0dcc3739958e5bde87dacaa7d95ee0ee601382a697fbf80b3b
MD5 3b80757a6df23eca8f802d1e06f02e69
SHA1 8c1d3d7cfe8b746e95cd12bd297485eebb6d1d3e
SHA512 78a20b0788e7014f3fcb6c8b1b8ba5006d0612fab2dadd11299083285047f912b796cef9c5bff61b631d473b3e492c675fb405d0cd80f3033e9107ea56bcde75
SSDEEP 192:uO5LsNPuacQiEZM7Lr6VYQmiU1VyV+Ife4MTRV+FdLJ65rSfy/8z1iB2qEOb6FD:9sNmvvEy704+Jxd9tqEqV+h
TLSH
T11A421A32AC749C3BADA7F285F14A36035EB0916B97C42F55E6ED6F0C01CB298130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 80dfbaf7976429f2629e57116500f02cc0ad306191636cd1be554eb5c89ebea7
MD5 a00abc99580f918a1dd057394ca6527a
SHA1 9e4a5ed6407be0046a64f9e44914fbff81dfc2f1
SHA512 1af8a6884691a4f9ae735ae47867c673e77f8639d1fe97ae6779d6b978ea82a93da49ae376153c396aa8a45023cb2e4bee9af0bc995f5bc3945ec72efa2d8d8c
SSDEEP 384:ziF5tNn/s3n9SQ5sNJ8TUNTUlIlCvEy70H+Jxd9tqLqVaN:eF5j+9ZewgDy5L/tGqVaN
TLSH
T11DB2E8F248D7883BE99E9787B37D2E034DBCD167B5806A55B3985A0CCC861BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d8f95909e90d6dfb4d6a4f8ed9c362cb0e259a2a5dde5630c61054ed2bc2b772
MD5 05b8be1d0f1b75a8b502084057525fdb
SHA1 2dc841eb14714111706c029894162e3228b4b190
SHA512 06b9d364311c43ace30b7aec5e866381bfc457f84c189ab8b585bdd67463a0e4e10ca27507530dc760fce88b1109a04b7658267dffe7886ef8d8fd38ee3efa75
SSDEEP 384:ziFHtNn/s3n9SQCsNJ8TUNTUlIlCvEy70t+Jxd9tqcqVaN:eFHj+9iewgDy/L/t1qVaN
TLSH
T191B2E7F258D7883BE99E9787B33D2E034DBCD157B5806A55B3985A0CCC861BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a773890313e9d40ea77c61e98503f9c1c0adefe64554c65aaa71438788fb25d2
MD5 56e8160959b44f747872a449af0549c1
SHA1 619ed08fc4885c0e2ed1d6d39c796fa417aaa93c
SHA512 fd02f4ba9cd605dc7bd089c34f30f544099219837ead511e7fc456c4653aa212493f96543689fb1c18543bc108464f5cb3b2c8fa42ce6d1be0756769558c4ade
SSDEEP 384:7tNn/s3n9S2sNmGvEy70J+Jxd9tqEqVaN:7j+9dryjL/ttqVaN
TLSH
T1AE624B726C345C2BADA7E589F14A36075EF0916B96C42F95E6ED7F0D01CB2AC030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d3fbf2eb737c5738ae26ac711339b3f7d71465f9fc4f093a7a9b8ee21bfa0df
MD5 f3d77ff1c6f9c613deed36d5567f3fc2
SHA1 25cd7d7ce89af191cbe88b556f25f56a3c73760f
SHA512 9bf86aabba4f5995c6cf7fcdb51d35736ca0e5fed8558b9bd7bb52a3ac6c31ba1e109cb70ab19f95d9aed859a1fd75d73f8cad6653e9537c421a7bc396d7ade8
SSDEEP 192:lON46vMtPQmiUyV6V/ThTRV+FdLJ67847iBqOU/u:lON46UtRlTad9IqNU/u
TLSH
T196020A36AC785C7BAAB3AE49F48A27175FE4217FA5D01B54EBE92F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 24b748e0a013fea01c36fd1618f63af280277c97414681c94d824231cb143dcf
MD5 28eb61332f3e028b0ac59098e35a7028
SHA1 4230a6ccc1218c96db665b14a72077a85bc433a3
SHA512 56144a042d2dfc0bc9bfd24f09ede3cad14cb0851b4f6da9352baf551d57ddb27c2d223190de0108b36fd5fc410c844182e9a310079ed63c5cec06cd6442e7e1
SSDEEP 384:NtNn/s3n9S2sNmCvEy70J+Jxd9tqEqVaN:Nj+9dLyjL/ttqVaN
TLSH
T1D9624B726C249C2BADA7E589F14A36075EF0916B97C42F95E6ED7F0D01CB29C030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e4fc1590bc3d6ad5dad226cc65f5923f7e9fd7e14faf5ab7535de4463edd8000
MD5 c97232e3a4e8cb7e5119f17aabf76f3e
SHA1 b33bc7d6235b9c9238552a1695c01cbe892dbdc3
SHA512 0804d71e441b84b2cde7dcf1cc7d58c84d75321d8db299eded2890f1b8c93c8430c3cfe0e0b2352e572e5acee24f743a3074caecadc254226bcb1e48d7b21ec9
SSDEEP 384:ziFKtNn/s3n9SQrJsNm8TUNTUlIlCvEy70l+Jxd9tqNqVaN:eFKj+9LJXwgDyPL/tyqVaN
TLSH
T1CAB2F7F258D7883BD9AE9787B33D2E034DBCC167B5806A55B3985A0CCC861BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3075cec432a6e771a4cd813402bc353c4de43859b4c187aed85c49b69cd3f88b
MD5 f26aa00c03b80caee3d56d2a8a86843f
SHA1 c9dd048d9d3ecd6cfae4708353ea9d91572ae022
SHA512 71ef1c4f4a998fa9e6e57f314f123640784098d13d44bf03ac55a0585bda7b6791200f9bfff84caee0d7b8c6d41bd4d38172efe855b0f29c51cfdcf17ea8efa7
SSDEEP 192:fLONr76vMkVPQmiUyVzV/fzhTRV+FdLJ65rSfyw80IiB2qEOU/u:jONX6UqRarad9tq1qVU/u
TLSH
T1A8122933AC649C6BAD93F585F08A32135EB0916BEAC46B64E7DC3F1C01DA69C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

1f6267ad-8e0b-4e5c-8a71-410f01f71414.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f6267ad-8e0b-4e5c-8a71-410f01f71414.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1.3MB
SHA256 2986707736353efe31f439bf32ab9e6ef2220bfc6c16ab0bb63e722a09e74318
MD5 ce3013fccd9d4ab4a607cfeed4242300
SHA1 dfcbb22a308b01ac9d5f268e6454f999786e4e9c
SHA512 0d5626967197655332427d30b5d2867bb8e4ad8f266b7413e23eb9ebf7ece82678c0f4d6c07f9df12b2b3ee95ad657be79a03c91a632982229d92c2e09a0de9f
SSDEEP 1536:mwHoZMgtOk4iS+/FcY8AqEMWDTaBacJGq4eNi:uOYIiS+9hTalJ
TLSH
T1E5559737D690E0C5CE2DB171ECADCB09FA62A14B129023465FFC95397A673C89D0B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 7760f82b6a46d16c5b600408d41d825fde866da4fceb377c59aebcd811c1eeca
MD5 329173e6f27c69f939ea178012bff40d
SHA1 7057ae3ebd96de5ed2a3095ffa11bb7729ebe3fe
SHA512 ea88d1495130f6b99cb10e9eef9e4795afdcbe79501daf686579b947f3f58d305624e8b9ee22a48e4f9878591758d9a8addca12ed0bee0f0330727bae3fac75d
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba:rZP2tFP3vqY8AqEMWDTaBacg
TLSH
T1CE257437D190B0C5CF2CB171E9ED8F09BA23B10B11A052465FF8A57A7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b33f3d18cdb743070374e3e69cb618380f8a7150997bf3a10ef9f6b60eba2380
MD5 f228702cc390ff84553d57c4c9ccca8c
SHA1 dc76225498a3f19cc5d703ae19044c7fccaa639b
SHA512 4ca0b8bfc6a87758900e7fc40eadf61458727d0eace6689ec860a709289db9b5887b0b44054e9ed6d699656a2550331fd3f7bfa0864e10fb242d89a57fb58748
SSDEEP 768:60aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba:UZP2tFP3vqY8AqEMWDTaBacg
TLSH
T1B3257437D190B0C5CF2CB171E9ED8F09BA23B10B11A052465FF8A57A7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 65257b0c298251fc6f9ab55b15d734bf989858e50c3f34b80e5fc6e7126c7e0e
MD5 d28a3b3e54a062b836b007a4a966d89d
SHA1 61aad904be359c10205a63cd99684f6c8e810953
SHA512 9c75c17823b3926a1ec40b18a4384c9c236681fb53a6f96c10d8ebf08bbb52e4366bfdaf8d50c4eb066aef7b34f6f15022f99a59cf7d5847858d24785506f5e2
SSDEEP 768:f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba:RZP2tFP3vqY8AqEMWDTaBacg
TLSH
T11B257437D190B0C5CF2CB171E9ED8F09BA23B10B11A052465FF8A57A7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 d7037fdfadd3e1d3b8c9ba7b21f323a66cfdc35cb15973f094df9bb7ed168ce0
MD5 632788ac552c760a7ee093eaafa9c6bb
SHA1 e7ff49c9be4ed96ade091536eb269644ab0d53c5
SHA512 9ccfc6d450149dd0d5674dbb48c2b0c86464c142cc1c741b67fc560d8b13cfd695b2f478c3c4b5db04c15dac7befbc46c89575b33de856643756bd1cad94c5e1
SSDEEP 768:e0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba:wZP2tFP3vqY8AqEMWDTaBacg
TLSH
T10C257437D190B0C5CF2CB171E9ED8F09BA23B10B11A052465FF8A57A7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 9eeee663bfb43a69a7a62e788fdbd025e1d260e734ec6332a58b79a69f05adda
MD5 975d4d75a396374f0eeafe86c1716fd4
SHA1 cb4029714edac730651e3f9988baffb021720c79
SHA512 72bdf72eb5ae603412fb359b79e48afd89d798ffb4beb69d8aad08dc2780d115494d78c2211b73440ceff3220a7808101eadda37d00c319979549ba70b5247ef
SSDEEP 96:AaltoRNXtdUMUst17XtuUMbstJUMlstKOXtHL2tMLXt0tbAttt:4nynsna
TLSH
T11F63A11066F4568AF3FB2EB02AFA55171F7A79E15E35D54C1224424E0DA0F2CDE30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lastplayed.wpl

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl
Size 358B
SHA256 ca50c8baf8ebdc13e3d89d31f34d367d6a5f144f9cbe8dfac8b09dcaf41d4ae0
MD5 7ca75182ccf95b4f1edc862c5ad451c6
SHA1 c779374dcb7597f1d5fb114c1052b7456f96873c
SHA512 cefd4230a66e3b3f19a5489de720158e7544cfd41719d643ad675d39e664b955a73c0ed536bcda150dcaa4666f4273c0a90100356fa1bac7e2557770262f11ce
TLSH
T12CE08C33B2C47D259AB060002A82F963EEA118C3420A0690B0CC228B5FB6E9486C31A4
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03ded5c7fa0d05e6e7c2dfbd80aa1ae94a0bb11ac18a36669b1edd7f23b0988d
MD5 f0226648eb4f1da8257eb33b6a01641d
SHA1 6551d5a2fddad0646d96e800bad9567d827915c4
SHA512 2cac2efcf2859feeb1d53cf8591275c1e13164a21a7e5f489dea1505bf43d854f2ddce331622c1ae39f909b0601be75f70a72996fe2586721eeb527b89e432b2
TLSH
T159413D6CAAEA1058F3B76E5ADBF6686D487F78371E06D45D10110E8F4623B40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 f7ed44c82cee239871db5a0fca19ef59c788ee6ccfd4b394e8911127b665ce9e
MD5 9a87f60bc3e90d9c8a333f4154401900
SHA1 c6baabe81b0ae4219ba590065f17cd83e402eba3
SHA512 667a152c8364b7c0a167d5a5da21fb2e26ebaa44a93e4950f9f8457685144518e003d625edd541010257032c252e0622e5762c0a620b432383e089b1838f81f4
TLSH
T181216E571B4DD8708AE01BE71DEC8E2573B7D7CA83A1D0A5B38DA0394C0652D5B3D16D
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.7z - Shortcut.lnk

Path C:\Users\Admin\Downloads\Velocity.7z - Shortcut.lnk
Size 1KB
SHA256 ced81666b9a4a62c8216b9f78aa6870278824d4a240fd645bf8a9847a61cdb92
MD5 2e915b8fbf244a872b0e602b27fb6913
SHA1 87c4dc23c9cf91e37551bbc7c7f3c20897913d7b
SHA512 0562c44d7a1ccf9973b891c1978dbcf436853a2c9d75d4b7fc8ea6adea436dddca99f5e6d277a80902e4f1423f41343b96aa53c7fa315b906f4b7315ec9db45e
TLSH
T1FC11C055079F5623C2F64539EDA7B787DB64BC02AF0A0F4A148093444E52B16F86DF2F
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.7z.crdownload

Path C:\Users\Admin\Downloads\Velocity.7z.crdownload
Size 19.7MB
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2504-527-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-549-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-519-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-518-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-517-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-521-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-523-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-522-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-524-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-526-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-516-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-528-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-529-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-530-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-532-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-533-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-534-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-531-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-535-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-537-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-538-0x0000000003A70000-0x0000000003A80000-memory.dmp

Download

memory/2504-536-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-539-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-541-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-540-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-542-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-544-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-546-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-545-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-543-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-547-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-520-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-548-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-550-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-551-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-555-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-554-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-553-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-552-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-556-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-557-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-559-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-560-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-563-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-564-0x0000000003A70000-0x0000000003A80000-memory.dmp

Download

memory/2504-562-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-561-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-565-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-566-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-567-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-568-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-569-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-570-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-573-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-575-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-574-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-572-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-571-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-576-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-577-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-515-0x0000000003E70000-0x0000000003E80000-memory.dmp

Download

memory/2504-514-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-513-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/2504-512-0x0000000003A70000-0x0000000003A80000-memory.dmp

Download