hxxps://www[.]mediafire[.]com/file/sbw1rcdgdp6mgni/farma[.]mp4/file

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/sbw1rcdgdp6mgni/farma.mp4/file
Sample260703-1853qagy6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275908235164371"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{EEA5B706-D673-4701-9FA0-8E8FC87A4E51}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5588	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5588	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe
5588	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3772	3756	msedge.exe	86
PID 3756 wrote to memory of 1720	3756	msedge.exe	87
PID 3756 wrote to memory of 4304	3756	msedge.exe	88
PID 3756 wrote to memory of 4304	3756	msedge.exe	88
PID 3756 wrote to memory of 4304	3756	msedge.exe	88
PID 3756 wrote to memory of 4308	3756	msedge.exe	89
PID 3756 wrote to memory of 4308	3756	msedge.exe	89
PID 3756 wrote to memory of 2812	3756	msedge.exe	90
PID 3756 wrote to memory of 2812	3756	msedge.exe	90
PID 3756 wrote to memory of 2812	3756	msedge.exe	90
PID 3756 wrote to memory of 1644	3756	msedge.exe	91
PID 3756 wrote to memory of 1644	3756	msedge.exe	91
PID 3756 wrote to memory of 1644	3756	msedge.exe	91
PID 3756 wrote to memory of 1936	3756	msedge.exe	93
PID 3756 wrote to memory of 1936	3756	msedge.exe	93
PID 3756 wrote to memory of 1936	3756	msedge.exe	93
PID 3756 wrote to memory of 468	3756	msedge.exe	94
PID 3756 wrote to memory of 468	3756	msedge.exe	94
PID 3756 wrote to memory of 468	3756	msedge.exe	94
PID 3756 wrote to memory of 4416	3756	msedge.exe	98
PID 3756 wrote to memory of 4416	3756	msedge.exe	98
PID 3756 wrote to memory of 4416	3756	msedge.exe	98
PID 3756 wrote to memory of 3856	3756	msedge.exe	99
PID 3756 wrote to memory of 3856	3756	msedge.exe	99
PID 3756 wrote to memory of 3856	3756	msedge.exe	99
PID 3756 wrote to memory of 520	3756	msedge.exe	100
PID 3756 wrote to memory of 520	3756	msedge.exe	100
PID 3756 wrote to memory of 520	3756	msedge.exe	100
PID 3756 wrote to memory of 2096	3756	msedge.exe	102
PID 3756 wrote to memory of 2096	3756	msedge.exe	102
PID 3756 wrote to memory of 2144	3756	msedge.exe	101
PID 3756 wrote to memory of 2144	3756	msedge.exe	101
PID 3756 wrote to memory of 1516	3756	msedge.exe	104
PID 3756 wrote to memory of 2724	3756	msedge.exe	110
PID 3756 wrote to memory of 2724	3756	msedge.exe	110
PID 3756 wrote to memory of 2724	3756	msedge.exe	110
PID 3756 wrote to memory of 1676	3756	msedge.exe	111
PID 3756 wrote to memory of 1676	3756	msedge.exe	111
PID 3756 wrote to memory of 908	3756	msedge.exe	112
PID 3756 wrote to memory of 908	3756	msedge.exe	112
PID 3756 wrote to memory of 908	3756	msedge.exe	112
PID 3756 wrote to memory of 3452	3756	msedge.exe	113
PID 3756 wrote to memory of 3452	3756	msedge.exe	113
PID 3756 wrote to memory of 3452	3756	msedge.exe	113
PID 3756 wrote to memory of 1416	3756	msedge.exe	116
PID 3756 wrote to memory of 5392	3756	msedge.exe	118
PID 3756 wrote to memory of 5480	3756	msedge.exe	119
PID 3756 wrote to memory of 5480	3756	msedge.exe	119
PID 3756 wrote to memory of 5480	3756	msedge.exe	119
PID 3756 wrote to memory of 5588	3756	msedge.exe	120
PID 3756 wrote to memory of 5792	3756	msedge.exe	122
PID 3756 wrote to memory of 5836	3756	msedge.exe	123
PID 3756 wrote to memory of 4608	3756	msedge.exe	124
PID 3756 wrote to memory of 4608	3756	msedge.exe	124
PID 3756 wrote to memory of 4608	3756	msedge.exe	124
PID 3756 wrote to memory of 2436	3756	msedge.exe	125
PID 3756 wrote to memory of 2436	3756	msedge.exe	125
PID 3756 wrote to memory of 2436	3756	msedge.exe	125
PID 3756 wrote to memory of 872	3756	msedge.exe	127
PID 3756 wrote to memory of 872	3756	msedge.exe	127
PID 3756 wrote to memory of 872	3756	msedge.exe	127
PID 3756 wrote to memory of 2108	3756	msedge.exe	128
PID 3756 wrote to memory of 2108	3756	msedge.exe	128
PID 3756 wrote to memory of 2108	3756	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/sbw1rcdgdp6mgni/farma.mp4/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85a43c188,0x7ff85a43c194,0x7ff85a43c1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4597188364910444010,7207245091755751789,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2645714297933562094,15983574476873664178,262144 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,10094819605211634206,18391050728277143244,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,3241277708129225919,13661107810076512567,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,18286479496058483847,4653545563260623999,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,1226043177654719461,12873179903350010154,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,1866638551529241145,7331061253216353877,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5064,i,3379285552598623484,11772111213888615916,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,17073861659405178891,11975825696896098241,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5692,i,7690734420389120955,10975932949358251785,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9536943312869345644,9063899291695795201,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,13982965417687517079,5597738786423823706,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1708604547280798336,13015665298599692718,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1708604547280798336,13015665298599692718,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5236,i,13910058265304044683,16506796774405441637,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6067367715618152639,4511314140400039574,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5136,i,1679178095107237088,13905596233906189362,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7212,i,10418499550700381557,5854115692047305965,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12973515155927765867,9734346070379079965,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,776700663138893317,8962850749895103969,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,776700663138893317,8962850749895103969,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4312,i,18204864938352665120,14556316298964809222,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\farma.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5588
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\farma.mp4"
  2⤵
  PID:5792
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\farma.mp4"
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7580,i,9319876982566428825,5894538964873875991,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7608,i,977657502782456929,15347273168267089674,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6496,i,8568654030671956947,6727124233423327360,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5280,i,14895064768482746059,3033638848819277272,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5660,i,14662114009015951975,12683559509334355422,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8004,i,3453509321648397821,3491968578175943578,2097152 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,7813642704728405179,10237907088508344391,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8124,i,4644192584104894761,15648311227053982131,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8128,i,1322830925594094743,828698552151099286,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,12054804575757979642,15057034713940494715,524288 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,8411459464051920682,7521438442303555228,262144 --field-trial-handle=2124,i,18015412583834704721,10992864622376002769,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27d61c282e4bf112aed3bd07eaaab8788d75224f5e199bab857064cbd5d982a1
MD5 46e65d035adc969e8d04500bca4c5db3
SHA1 fc81b055409d470ed84cfc8497034037eb5a1ee4
SHA512 26b4bf0615d85574c1a8017270ee3e215341811d6c55c46a00d6a9c6c2e6ebbca4202d7b57c225f8b253c27394d706b1e2825b17c78aa7a2e17599e82aceedfe
TLSH
T13FD0231076397AD3D23A147E54718B01B91581777377F3417151440D9D750C6F68B6D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 1bb68fbc4cdf2e0cfbbdc6bcefa79ebff95ad928942ad05278526c06885d9dae
MD5 afda86f76fa21b7cf8b8e8acf320af70
SHA1 5cc7bcf518ffcf13f7fb4851fccc95658e84ab3d
SHA512 bf6836ff72cd47835ad2432a706ce781875753c80b5be059ef20e79c1014e13990d3bc87076d927cd73ac059c0d24eec05cbcd61b4cc4d9e6de04762a3469bab
SSDEEP 48:xqv5xpm1olmWJCceXkULPnCbiW9lmW/fBt4hZRE04FiBvcmJkyhGzqqBWn6CENin:gxw6pCcmkUCeC8uU004FChJ3cWuWe0
TLSH
T1AAB17EB8120321A3D3255FB965E3EA88BDB087C8F467EEE7A551D17811C6351C138F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594b48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594b48.TMP
Size 3KB
SHA256 4e889943a197495348d3162690d54816ea2715aa49837f44aa54ff96d63fa97c
MD5 af9ddd117ca3d7964678adf1a592cb14
SHA1 57214899e0c93174418dec673e63992c3a0b9e1a
SHA512 728700ecb1bc3907aeb344296aaf97180e03d141352557838900f94f1530bdbcf91273b4ee9b3e43339a56e01f8cbf9718f751d1d8176241fbbc566bd51ff256
TLSH
T1217150BC020701A1E352933AA8D3C1D67CF18BDAF96BEDE61110D4BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 f77570007f9cbcc61d2a667eed380a4d49760681f0a5c0a3fc1ef2c785d485e9
MD5 5c050e4f12e8ea0ad7f2e1bc6837f948
SHA1 b2b5bc7c1d424132e162e55c4b481098b5eb86e1
SHA512 0e5d5c2d73a90aae1108f8fcde22492cf35dc4c75b50fd9172f7a1bab270a9e3b958e3aa63d4da722f4267bd8f522c3760935fb8a58570c770212a56d7cd6a01
SSDEEP 384:DfUtfjA02VNNe+Imyk3cgeoSeazJFf6lNmLyK474vQpEsYmY+LqYXRTqv+uTQvA6:GCl0fRgNxe+RuTjVKZn
TLSH
T1E0A277F383E5D52E891157F896146E1BCF1D1629832C3C2589D5EE8BE3E2072E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e83c2ef653596d1b04121af70cd63201c8b10f648643a936ae52d1cefe6cca5
MD5 e92999c70d98a6ea9dc1536d436e84a9
SHA1 f2171b01f0df25bf55947e5407fdad61b6d1c35d
SHA512 607599613694f7866402f444c535fbfd481bfcc6f670fa76656c0199935cc42106673721ef0c9b41985c79e4100f35df9bb25ff3d1d06be44d9bfa8bd2701d40
SSDEEP 192:sxZGRXyM/jK1Ml8Mk0/fOsa9OhIdp80HW6+WNm3U/YI/rLAIgrJ:sxZGXM0/fOsaQKRHbZ/29
TLSH
T1B052E8126B34597BCCDBD209FA45BF53D6F94562E2900D84A9FCDA0C05E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7271be8e0d58149c77f3bb24236538a142e287b1849a299cf86e1f3e6ff56fde
MD5 fd383acae51fdec8861caa914499895d
SHA1 21b618c57335992a29b69ff4e2033153bbbefce4
SHA512 5946cba5376bf9141cac8cbc6a62e7d60c36007dc81598c2d4059a555ac1e01229ddf3bbca8b97779f3876aea1e00bd07f94f475fe057f0c11dc92b6917eca2c
SSDEEP 192:sxZGRXyM/jK1Ml8UQPd0/fOsR9Z9IdpbrwxyyyHW6+WNUFyYRFegC3U/YIH+zAIA:sxZGBqF0/fOsRr+YyHbUE+9/pZ
TLSH
T12162C813A6345A7BDCD7D219F541BB57D6F9547292900E84AAFCCA0C06E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 81bffc342dc342e03eff4cf700861a85ebd3f0d3fe54fd1ba34683fbaac1e814
MD5 aed268946c2a35d3e0560c3c4497cb2a
SHA1 1de0a80fdd0716a2eee24a9a0b14abf0135efffb
SHA512 ca498117f5351f69a2be638f805c1be269d1ca2a7e99e3f1de9ff5488d4237fc0e5ebd66ea0ab4d23dbfe262ae87f50e311545f58e4250d9ea0cb0ef41aa81d1
SSDEEP 192:sxZGRXyM/jK1Ml8Md0/fOsR9Z9IdpVrwxyyyHW6+WNUFyYRFegC3U/YI11LAIg5D:sxZGB10/fOsRr+2yHbUE+9/mZ
TLSH
T17A62C912A6345A7BDCDBD209F541BB57D6F95472D2900D84AAFCCA0C06E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9aa5fe84169a36588c51c28a5fe4eb3f175c632c010479d775d2c62c652905e
MD5 d17b2227ec90f47e48c856d31b2c2b76
SHA1 f2fef4439a125470a5884f2385de277915574aec
SHA512 8d20a3830543c2667fee5a02ec14cfeeb374f54a182c237d3c7a9a094be2638daba941e4d994f58c06257e24c50336202e7aa782a951b7991d86282f3a084bd8
SSDEEP 192:sxZGRXyM/jK1Ml8Md0/fOsR9O9IdpVrwxyyyHW6+WNUFyYRFegC3U/YI/FLAIg5N:sxZGX10/fOsRQ+2yHbUE+9/wn
TLSH
T12C52C712AA345ABB8CDBD209F541BB57D6F95472D2900D84AAFCCA0C05E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 10461e23ff4a82ae2597d5513d0cc14ef2c4013277449568df5c3bc8057193db
MD5 fe1509143d2f6b5f781051a4a74181b3
SHA1 fca71a8732651572e5ad2b3a25b1f3931a89dbdb
SHA512 8f73409d594c0c2671db5edf902817d576dd35b490c0a47341c315c464966edcb6ded1a4d26267a48d96d2ebd8d39ef1ebe3146c4602acf9dce12e07355a57f5
SSDEEP 768:N1sqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9lro0hA:N1sqxXlWvJD0Tu1ja54LAs9e0u
TLSH
T161E20B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec19a552647d5ef9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\ec19a552647d5ef9_0
Size 63KB
SHA256 b0b0ed28563a14d0c47fa7911ca6dcdb213bd87992fe765c9d9a98c977f7b9d0
MD5 29883c89663f6b2cd83e9f4cdc606b52
SHA1 907aa8ac6d1131d251edaf480ac69321d447be8e
SHA512 0dc68f7ef34030152ef9f3fdb9e9af84551ec84da795781e14fb8b6f1684a9c9c67b61075597ce309c35ede6bd6e532b6a4c64fd1409b02d4bcdadd6b1562fd7
SSDEEP 768:IeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:IDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T139535CA633707477827BA1F1905F230B713AE167F40494E8B194EEE54A44BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 57e17fc74ed0d59e7d443f30b8652bd4a99c94cb7aeb6f88b065f747c33e827a
MD5 3f9c348c23ce686c17b39e753854d8d7
SHA1 7feb221a9ba25b73c7ea3ab6ee9e5a686a1f73c6
SHA512 a097aa05d68ff2a901677bb31a619ffb5ef0eaefe306f3900e38c6b1549c8229278e1ffdd85d7f1d14244393f4206c0c3514122a5a0ac90972625da01e82fed7
TLSH
T190A002A435888353E15157F0748196887A947DD02143C2927AE00C5A8870289461A001
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8f3834ed8bcfc121252c01f47ce9b5549d9584b00ae937bd0d7b047ba4bde214
MD5 7777d939886dccdd0334cd4733e2cbf1
SHA1 9908983254f3d7640dd0de0fba437c70ee1a0a25
SHA512 35868f05ecf2bdb7f40b5bff35003fbbf3cc14c88d178b7850430644f94635a2a7e9fb4748dcb5f13bf3907ca13c489e1d0f29a43c4d2c3df9607cc5e27afa43
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3qBxOf7Js:ExbPz4h3UxOf7Js
TLSH
T145E1D516713E061239FE1988B2A685374F423163305CA86F7FB950654E6BE235CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8f5a04e-0186-4b64-9419-29b03209feb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e8f5a04e-0186-4b64-9419-29b03209feb7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f3c21b527b1948068213437bb36ebcbeff896bb17d4add49ea9ed9d8bcf10743
MD5 5d30f2a2308fc2e71e9b58c6192a24d9
SHA1 b6bd5d6e4b9a575288065f659b06e395b6be2e04
SHA512 7abd83f35cf92e31d2c8166a16974eb9c70910aabbfb9dd86f08e7b61c36a00c0d7871341614169bf255dd758dadeea489b09630927b271dd48b5ff07d1b0f57
SSDEEP 384:8tNn/s3n9SfsNhFLgbJYDuVRNaExuOObjI9G6w7Of0:8j+9UKYHa4u29Ms0
TLSH
T178929E367C284DBB4DE39955B58B2A1B9FF8D06B97C42F80D1DC6F0C02DB5AC530692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 67f40c1802ddd77cd40096a6adbc6894dda8194a5958c083ff582f0667f8b7c8
MD5 4dd2d39738d032bf61bd50589590a75d
SHA1 0b379d4d2418f93ddef15d3dc750d6cbff00ce69
SHA512 16b5f08c30b9b46d79345b6982292fd8137be3635533bc16e3ba4302d2f227d35ac1bf0ef4356ff10ac7444340b2305f36fed1fee9bcb9a26a11d979388ae70d
SSDEEP 384:8tNn/s3n9S+sNhTLgbx7DEVRNaE9uOObjI9G6w7Of0:8j+9pHWHaou29Ms0
TLSH
T1FE929D326C284DBB4DE39555B58B2A1B9FF8D06B97C42F80D1DC6F0D02DB5AC530692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97bcecc37923369f5b6559139febb760dfe80ea0d82149698ded4ec68e159afe
MD5 dc32df23152d6c03de3a168759e3f278
SHA1 045bd6be441ddf91c226568e0b7f7312ef233e68
SHA512 5c9eca8000a641b0d78c556f112510536887ee75f66afbea5f7a4e159fcf2d350af6d82f36a1100867eb64d29af68ea5fac46457f0363b5f7556a049083cc03a
SSDEEP 192:tONC6JkRtQmiUy8jW+RNfCk7Omth39RwU6:tONC6UrDW+RNaETMU6
TLSH
T12502FA357C382C7B8EF2AD05B58B27175FA4206BB9952F80DAD81B1C01D769C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2cbc1e05de3c322cc1ea69bf6bf94371b859585b8c3e1f6d4c50bfbba55a2e8c
MD5 4fb42b3190d52b35109d4b0a3c377860
SHA1 0b66ad88814f8be9cbb35ca5acdf702be00a14bc
SHA512 03d691f5bf3e3055fa1d40f9140d752caf8893c7a8aaacdb0dd6035bb7b25fd9cd918aa1f28815b2182b073f718a68d28b8a4056b423a82f0cfc09d71cd3207e
SSDEEP 384:vTiF9tNn/s3n9SVCsNz8TUNTUlIl2LgbxI++hDEVRNaEEuOObjI9G6w7Of0:2F9j+9zewgK++hWHaru29Ms0
TLSH
T1F5C229F258D7497AD99E4B43B77E2D0A8EBCD067B5846A80B3885A0CCD871BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 788aec34659653091f48aeb4b2895c1be8199f6221573e6313e90f6775c0e8ec
MD5 1937fa2022d1ba10f4f284a7dd53189a
SHA1 08b6343b442161d61b2badd9b8ec3dc5a3e8abbf
SHA512 f0e277b021d7b098992c07f0bd6b66ee2d80282d8f41ab36c80ca9892e2af7a99cd5e7723b682dc55a98976f513b03b404e7e96c2b226cf8e2b0f91981475d6b
SSDEEP 192:dONk6JkRSQmiUyxjW+RNfCk7OmqZZLVcBqssU6:dONk6UOEW+RNaE3uU6
TLSH
T19B12193278685C7F5EE2A841B48736175FB5916BEE897F80D5DC1E0C02EF59C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e85c35760d633b6a7b4fc4298f7cdf9f28fe7cf91e92ddd23c67753709d4abe
MD5 682bd17d87c75d9fb0c7f890fc6769a4
SHA1 3c0e70a32e06d3242149e6dc367b1f886be3a177
SHA512 a9e592608b1980bcf42628e96077fafd2a6138c83e7f95750c773b6f7c824db7270249315ee5ec71e568cfddf9ebd778782cce34900d4d9cef57eb293f680b38
SSDEEP 384:XftNn/s3n9SesNh2Lgbx7DEVRNaE9uOObjI9G6w7Of0:Pj+9piWHaou29Ms0
TLSH
T145928D326C284DBB4DE39555B58B2A1F9FF8D06B97C82F80D1DC5F0D02DB5AC530692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3df8990f-170d-42d3-be59-4b3d1903b9f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3df8990f-170d-42d3-be59-4b3d1903b9f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5d29e2c5530ed8aa60a95c6b412ffa5190965f04b8aa98e514bde3179265f3b9
MD5 60eea9f7301b96c2047adb368c5c8a06
SHA1 76a651c03d7ef4810633959d670056fb1e6d9069
SHA512 39715b67e15d9d93f73c4ca248f029f69596029bfed60950934b60ff74dfdc2761d7108fce3f19aa17b98066abfa2f8e599bffb475233476ee9056ef112e4438
TLSH
T19941176CA6EA0108B3B76E5A9BF7686D887BB8732E06D56E00110D4F0673E40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

farma.mp4

Path C:\Users\Admin\Downloads\farma.mp4
Size 27.4MB
SHA256 4590f2c0140e3eb338224fedf63701749db1ad70e2c920df866e241fbf9ab56f
MD5 f23da3215bef14ab13f8f7fb0ef8df73
SHA1 6366f481b8b5b46129bd232acbd2fabd13f18b73
SHA512 00a3abf204496df42a020f71f8b1773a90ef23de15032422264ed25af1c5ffc52dc3e0533f617cedde4b9c40116000f87da1da4fc2b6c6d120d80840fb7abbaf
SSDEEP 393216:xI+Eij0eu4jSKKNa68UZiOV7QTEH5yIL5Q1b81/QK+tONS:i+f0euISjNF8UHV70EZyILSy1/3+0g
TLSH
T1FE57330229C4513CF89A6E38404B367478741E6B84998BEE6797BF32B4359F8BD36734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5588-461-0x00007FF84DA70000-0x00007FF84DAA4000-memory.dmp

Download

memory/5588-460-0x00007FF7C0440000-0x00007FF7C0538000-memory.dmp

Download

memory/5792-418-0x00007FF84A450000-0x00007FF84A461000-memory.dmp

Download

memory/5792-381-0x00007FF84D890000-0x00007FF84D8BB000-memory.dmp

Download

memory/5792-423-0x00007FF84A400000-0x00007FF84A44F000-memory.dmp

Download

memory/5792-427-0x00007FF848790000-0x00007FF84883B000-memory.dmp

Download

memory/5792-431-0x00007FF849EF0000-0x00007FF849F0B000-memory.dmp

Download

memory/5792-420-0x00007FF848840000-0x00007FF8488D8000-memory.dmp

Download

memory/5792-432-0x00007FF849ED0000-0x00007FF849EE2000-memory.dmp

Download

memory/5792-433-0x00000241D0950000-0x00000241D09BD000-memory.dmp

Download

memory/5792-419-0x00007FF8488E0000-0x00007FF848AEB000-memory.dmp

Download

memory/5792-417-0x00007FF84AA80000-0x00007FF84AA91000-memory.dmp

Download

memory/5792-415-0x00007FF84B6B0000-0x00007FF84B6CA000-memory.dmp

Download

memory/5792-435-0x00007FF83E220000-0x00007FF83E465000-memory.dmp

Download

memory/5792-382-0x00000241D03C0000-0x00000241D0750000-memory.dmp

Download

memory/5792-412-0x00007FF84AAA0000-0x00007FF84AACD000-memory.dmp

Download

memory/5792-380-0x00007FF84D8C0000-0x00007FF84D8E2000-memory.dmp

Download

memory/5792-426-0x00007FF84A3D0000-0x00007FF84A3F5000-memory.dmp

Download

memory/5792-410-0x00007FF84AAD0000-0x00007FF84AAF6000-memory.dmp

Download

memory/5792-407-0x00007FF84B6F0000-0x00007FF84B708000-memory.dmp

Download

memory/5792-374-0x00007FF7C0440000-0x00007FF7C0538000-memory.dmp

Download

memory/5792-375-0x00007FF84DA70000-0x00007FF84DAA4000-memory.dmp

Download

memory/5792-405-0x00007FF84AB00000-0x00007FF84AB2F000-memory.dmp

Download

memory/5792-378-0x00007FF85A940000-0x00007FF85A951000-memory.dmp

Download

memory/5792-403-0x00007FF84D800000-0x00007FF84D841000-memory.dmp

Download

memory/5792-379-0x00007FF84DA50000-0x00007FF84DA69000-memory.dmp

Download

memory/5792-402-0x00007FF849F10000-0x00007FF849FF3000-memory.dmp

Download

memory/5792-396-0x00007FF848AF0000-0x00007FF848D86000-memory.dmp

Download

memory/5792-399-0x00007FF84A000000-0x00007FF84A0E8000-memory.dmp

Download

memory/5792-390-0x00007FF84D870000-0x00007FF84D884000-memory.dmp

Download

memory/5792-392-0x00007FF84D850000-0x00007FF84D861000-memory.dmp

Download

memory/5792-394-0x00007FF84A470000-0x00007FF84A542000-memory.dmp

Download

memory/5792-376-0x00007FF84A550000-0x00007FF84A806000-memory.dmp

Download

memory/5836-398-0x00007FF84A000000-0x00007FF84A0E8000-memory.dmp

Download

memory/5836-387-0x00007FF84D8C0000-0x00007FF84D8E2000-memory.dmp

Download

memory/5836-384-0x00007FF84A550000-0x00007FF84A806000-memory.dmp

Download

memory/5836-383-0x00007FF84DA70000-0x00007FF84DAA4000-memory.dmp

Download

memory/5836-400-0x00007FF849F10000-0x00007FF849FF3000-memory.dmp

Download

memory/5836-377-0x00007FF7C0440000-0x00007FF7C0538000-memory.dmp

Download

memory/5836-389-0x000001ED92BD0000-0x000001ED92F60000-memory.dmp

Download

memory/5836-393-0x00007FF84D850000-0x00007FF84D861000-memory.dmp

Download

memory/5836-395-0x00007FF84A470000-0x00007FF84A542000-memory.dmp

Download

memory/5836-391-0x00007FF84D870000-0x00007FF84D884000-memory.dmp

Download

memory/5836-397-0x00007FF848AF0000-0x00007FF848D86000-memory.dmp

Download

memory/5836-401-0x00007FF84D800000-0x00007FF84D841000-memory.dmp

Download

memory/5836-404-0x00007FF84AB00000-0x00007FF84AB2F000-memory.dmp

Download

memory/5836-385-0x00007FF85A940000-0x00007FF85A951000-memory.dmp

Download

memory/5836-406-0x00007FF84B6F0000-0x00007FF84B708000-memory.dmp

Download

memory/5836-408-0x00007FF84AAD0000-0x00007FF84AAF6000-memory.dmp

Download

memory/5836-409-0x00007FF84AAA0000-0x00007FF84AACD000-memory.dmp

Download

memory/5836-411-0x00007FF84B6B0000-0x00007FF84B6CA000-memory.dmp

Download

memory/5836-413-0x00007FF84AA80000-0x00007FF84AA91000-memory.dmp

Download

memory/5836-414-0x00007FF84A450000-0x00007FF84A461000-memory.dmp

Download

memory/5836-416-0x00007FF8488E0000-0x00007FF848AEB000-memory.dmp

Download

memory/5836-421-0x00007FF848840000-0x00007FF8488D8000-memory.dmp

Download

memory/5836-422-0x00007FF84A400000-0x00007FF84A44F000-memory.dmp

Download

memory/5836-424-0x00007FF84A3D0000-0x00007FF84A3F5000-memory.dmp

Download

memory/5836-425-0x00007FF848790000-0x00007FF84883B000-memory.dmp

Download

memory/5836-428-0x00007FF849EF0000-0x00007FF849F0B000-memory.dmp

Download

memory/5836-429-0x00007FF849ED0000-0x00007FF849EE2000-memory.dmp

Download

memory/5836-430-0x000001ED93160000-0x000001ED931CD000-memory.dmp

Download

memory/5836-434-0x00007FF83E220000-0x00007FF83E465000-memory.dmp

Download

memory/5836-388-0x00007FF84D890000-0x00007FF84D8BB000-memory.dmp

Download

memory/5836-386-0x00007FF84DA50000-0x00007FF84DA69000-memory.dmp

Download