Overview

overview

10

Static

static

3

Art Launcher.exe

windows10-2004-x64

10

Art Launcher.exe

windows11-ltsc_2024-x64

10

Resubmissions

05/07/2026, 14:39

260705-r1qhmagw7l6

05/07/2026, 14:36

260705-ryz92scz5t3

05/07/2026, 14:16

260705-rlgl6sgv7p10

Analysis

  • user interaction
    yes
  • max time kernel
    96s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 14:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Art Launcher.exe
  • Size 35.1MB
  • Sample260705-rlgl6sgv7p
  • SHA256 f957714a843fa9e2855c2a0b5809caf1a150327554dd2dea324b9b9eb32c8f4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdiscoverysalatstealerpersistencespywarestealerupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 16 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Art Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Art Launcher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5896
    • C:\Users\Admin\AppData\Local\Temp\Art Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Art Launcher.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\ArtLauncher\xxx.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Users\Admin\AppData\Roaming\ArtLauncher\xxx.exe
          C:\Users\Admin\AppData\Roaming\ArtLauncher\xxx.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5584
          • C:\Program Files (x86)\Internet Explorer\lsass.exe
            "C:\Program Files (x86)\Internet Explorer\lsass.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:960
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2884
            • C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3468
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ibispaint.com/
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5548
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x250,0x7ff8ea1ac188,0x7ff8ea1ac194,0x7ff8ea1ac1a0
          4⤵
            PID:1908
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,14728752079630028079,13540592205222426517,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
            4⤵
            • System Time Discovery
            PID:4328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6027027572393164740,8754494799364159239,262144 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
            4⤵
              PID:6060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,8247735273700584980,10002679992434200104,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
              4⤵
                PID:4448
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,4088244875460577003,2329298783383221229,2097152 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                4⤵
                  PID:3472
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11393197581056604328,7792518574350337359,2097152 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
                  4⤵
                    PID:4556
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3632,i,10951960586698021722,6292441934393493706,2097152 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
                    4⤵
                      PID:3928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,5104756720213219831,12678718380966601498,2097152 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
                      4⤵
                        PID:3920
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5316,i,6298010311213506199,9440856129971952444,2097152 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
                        4⤵
                          PID:2612
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3987433121624140547,3820297140732613940,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
                          4⤵
                            PID:1516
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,6200160546986994917,9032927912561727944,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
                            4⤵
                              PID:5280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,4563019424303211338,13531473028560540465,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
                              4⤵
                                PID:1612
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1844206504400395249,186741366266702083,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                4⤵
                                  PID:2828
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1844206504400395249,186741366266702083,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                  4⤵
                                    PID:5528
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,18145425883054186070,17862166723345218148,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
                                    4⤵
                                      PID:2172
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,4309446662256381193,3173145923549244909,524288 --field-trial-handle=2720,i,8986281228095422210,18351965228665535885,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
                                      4⤵
                                        PID:3512
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                        4⤵
                                        • Drops file in Windows directory
                                        • Enumerates system info in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:5740
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x330,0x7ff8ea1ac188,0x7ff8ea1ac194,0x7ff8ea1ac1a0
                                          5⤵
                                            PID:2516
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,2860796364518815321,13611914950622697492,262144 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
                                            5⤵
                                              PID:4616
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8101916883399532410,8816722801428510805,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
                                              5⤵
                                              • System Time Discovery
                                              PID:5272
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,8629226411022142456,2389177842666541119,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13
                                              5⤵
                                                PID:3928
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,13297822940908315056,10610659716081019991,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
                                                5⤵
                                                  PID:5412
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,10245860956035578534,16213820792634598905,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
                                                  5⤵
                                                    PID:2060
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,10245860956035578534,16213820792634598905,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
                                                    5⤵
                                                      PID:3228
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,16787924363518356615,12296319339020086992,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
                                                      5⤵
                                                        PID:4852
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,8551551526546087200,3701992652868247037,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
                                                        5⤵
                                                          PID:4184
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5124,i,2955112582701850821,4062479316454955519,2097152 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
                                                          5⤵
                                                            PID:2052
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5128,i,14110046196621877013,17131101167166486082,2097152 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
                                                            5⤵
                                                              PID:3416
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,17472955192147513992,11138748130898477096,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
                                                              5⤵
                                                                PID:4712
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13783045641118158331,8965865669725545788,524288 --field-trial-handle=2256,i,7600202133964222176,13913731778547968585,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
                                                                5⤵
                                                                  PID:1560
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                  5⤵
                                                                    PID:5096
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x2c8,0x7ff8ea1ac188,0x7ff8ea1ac194,0x7ff8ea1ac1a0
                                                                      6⤵
                                                                        PID:4340
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,15340021929717051383,6110599943082272933,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:11
                                                                        6⤵
                                                                        • System Time Discovery
                                                                        PID:3180
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,11115562494140962353,10131527150320157829,262144 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:2
                                                                        6⤵
                                                                          PID:2864
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,11557907414185869616,15251702126717422689,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
                                                                          6⤵
                                                                            PID:780
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4068182115970414879,11935164469947979920,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                                                            6⤵
                                                                              PID:4912
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4068182115970414879,11935164469947979920,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                                                              6⤵
                                                                                PID:3864
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,919231303266383889,7497265811525458979,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
                                                                                6⤵
                                                                                  PID:5624
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,11690906131657996549,9473276407509268615,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                                                                  6⤵
                                                                                    PID:2172
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,18084239237102443204,3046181928533647125,524288 --field-trial-handle=2956,i,2917066069714996012,17507025492282534251,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
                                                                                    6⤵
                                                                                      PID:1364
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ibispaint.com/
                                                                                3⤵
                                                                                  PID:2516
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.photopea.com/
                                                                                  3⤵
                                                                                    PID:6040
                                                                              • C:\Windows\system32\sihost.exe
                                                                                sihost.exe
                                                                                1⤵
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1204
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                  2⤵
                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                  • Enumerates connected drives
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:576
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:264
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2924
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:3160
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:4336
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:1776
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:3872

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            lsass.exe
                                                                                            • Path C:\Program Files (x86)\Internet Explorer\lsass.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 05ec73a7f19830bdc84c6a122b1e3bea9d537f84213001b2fcc99834cc83d54e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 d027e41305c78ecbbd01b0f2e9b79eb90b2755585709b552886ad5ebc5a4a959
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 56ba52427ece10b53dc5ad26b268efb78e7400b13b5c3b3414bc32ba2f5f8c0f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 1170e5747b6f443c291e38c75b242908fe9c5da2d51cb33cb4b5bac6ce1f4a0e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            2b8ff49c-49cb-4a52-b0dd-ba490dd92b89.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b8ff49c-49cb-4a52-b0dd-ba490dd92b89.tmp
                                                                                            • Size 6B
                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            3393f31c-22c4-4578-8645-0fe6e28fe1e3.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3393f31c-22c4-4578-8645-0fe6e28fe1e3.tmp
                                                                                            • Size 106KB
                                                                                            • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            88278043-b076-4f48-a394-949fc869955f.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88278043-b076-4f48-a394-949fc869955f.tmp
                                                                                            • Size 1B
                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            f_000086
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                                                            • Size 16KB
                                                                                            • SHA256 827ae434531bf0ada59ed353b7d5305a7b982c34da1ad59d4b9ccce971489b32
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 3KB
                                                                                            • SHA256 aa0ba4622c8e95b6d3fac36062b72ec46643cc828965c073a53668380cee33f6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index~RFe5a8d4d.TMP
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8d4d.TMP
                                                                                            • Size 3KB
                                                                                            • SHA256 048f4749aff088016bb6e6d8be5ad786392aa7ccf1816e0fe1b8b2a89de7aa9f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            SiteList-Enterprise.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                            • Size 2B
                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            Edge Profile.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                            • Size 70KB
                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            73eef65d-e0b6-492e-a556-f050bd41ce30.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73eef65d-e0b6-492e-a556-f050bd41ce30.tmp
                                                                                            • Size 40B
                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            Network Persistent State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                            • Size 2KB
                                                                                            • SHA256 733494a467ae26c1b88b126b594f1bc65d0a358534e7674f9cd6269d27cda028
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Network Persistent State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                            • Size 2KB
                                                                                            • SHA256 b59ec83c4a3e64a1d916fa62cc6ac117e9edd5bd02d9e2c94503b9f7616ee388
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            SCT Auditing Pending Reports
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            • Size 16KB
                                                                                            • SHA256 d72043eb5ba9909288faa8cf442e79de3fe92d866837a628da67609d4c180500
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            • Size 15KB
                                                                                            • SHA256 24b38e715cb9ffbfcfa390fdebc472661ee3e4c86719d405208480ef9da2731f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Secure Preferences
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                            • Size 30KB
                                                                                            • SHA256 1c40efad75bfeb30004790d9fdd9cd19de9528c49a06129fe641dbd348cb4449
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sync_diagnostic.log
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                            • Size 4KB
                                                                                            • SHA256 37dadcb501ee4f048fa9d831c82a86a67f11363a1b2951abc7af2bd579579766
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            aa3086dc-679f-4f89-9c4e-4976c778bb54.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa3086dc-679f-4f89-9c4e-4976c778bb54.tmp
                                                                                            • Size 414B
                                                                                            • SHA256 d21f8d09e6096e1829196045da602171bb472ac3c95ee07bcd31c0c7d863302c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 38KB
                                                                                            • SHA256 3153ea3e15fabb565945523ea99a50f46dd41d49ace510ef488324bdef19e0b0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 41KB
                                                                                            • SHA256 7bdf372ab66c92b084f732b44a2541fade918dda3d068230cf52cfc5d7af36bd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 41KB
                                                                                            • SHA256 d622d302ba171da321906bbcaebc9eabc7387807d6086b78294eed2d06b6ce7a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 35KB
                                                                                            • SHA256 caef10a3ce1660f0896baa80b2e3278263efa6e114d84ecab702b8d535b76c24
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Local State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            • Size 41KB
                                                                                            • SHA256 3b11411dc5afb673efe30b4374bc7c563778203f2d187af763d2aba1696fc97d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            data_1
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                            • Size 264KB
                                                                                            • SHA256 b42252397ec7a59ee39e7a2ebe03e269aca07c7e3b5ea61e5acfd03115eadf3d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dd1173e2-a639-4543-ab34-854f23340822.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd1173e2-a639-4543-ab34-854f23340822.tmp
                                                                                            • Size 13B
                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                            • Size 599B
                                                                                            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            _imaging.cp314-win_amd64.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\PIL\_imaging.cp314-win_amd64.pyd
                                                                                            • Size 2.4MB
                                                                                            • SHA256 82ae998248c6785a4101e98b8c85a598d51df8f951ce3759ac27ede43b763467
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _imagingft.cp314-win_amd64.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\PIL\_imagingft.cp314-win_amd64.pyd
                                                                                            • Size 2.0MB
                                                                                            • SHA256 eb309945f9c9c500e37548da1e0058e4496beb7ac8906e1f31f4e68448da358b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            VCRUNTIME140.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\VCRUNTIME140.dll
                                                                                            • Size 117KB
                                                                                            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            VCRUNTIME140_1.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\VCRUNTIME140_1.dll
                                                                                            • Size 48KB
                                                                                            • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _brotli.cp314-win_amd64.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_brotli.cp314-win_amd64.pyd
                                                                                            • Size 836KB
                                                                                            • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _bz2.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_bz2.pyd
                                                                                            • Size 85KB
                                                                                            • SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _ctypes.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_ctypes.pyd
                                                                                            • Size 139KB
                                                                                            • SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _hashlib.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_hashlib.pyd
                                                                                            • Size 67KB
                                                                                            • SHA256 d4524b261f09806a828c62fc97e8517328b23d65ab87d20706a4bafd86bbf345
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _lzma.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_lzma.pyd
                                                                                            • Size 157KB
                                                                                            • SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _queue.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_queue.pyd
                                                                                            • Size 35KB
                                                                                            • SHA256 cb529f77bc4665dfa3b66fae3d00ab84de1e9618d0cb94900efbf28527623c0f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _socket.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_socket.pyd
                                                                                            • Size 85KB
                                                                                            • SHA256 ff3e97cd11bdc68798e5b3dcd5295d1efba179b7344142d50d066bbf1c2d79cd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _ssl.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_ssl.pyd
                                                                                            • Size 180KB
                                                                                            • SHA256 43e60bbdff2fe41701f39fa25ea6a8251a2b7623ff18f980a209a451eb5e648f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            auto.tcl
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tcl_data\auto.tcl
                                                                                            • Size 21KB
                                                                                            • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            cp1252.enc
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tcl_data\encoding\cp1252.enc
                                                                                            • Size 1KB
                                                                                            • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            init.tcl
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tcl_data\init.tcl
                                                                                            • Size 25KB
                                                                                            • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            tclIndex
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tcl_data\tclIndex
                                                                                            • Size 7KB
                                                                                            • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            tk.tcl
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tk_data\tk.tcl
                                                                                            • Size 23KB
                                                                                            • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _tkinter.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_tkinter.pyd
                                                                                            • Size 67KB
                                                                                            • SHA256 b2e1dbe2079b52535b60dbb72ee54ff0da145324afcdb6a7c915c61b8006758b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _wmi.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_wmi.pyd
                                                                                            • Size 39KB
                                                                                            • SHA256 5a7f3444f1c2f85fb5573bc330c1aea2c583912bb6f948ff81f8fd89a30e67be
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _zstd.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_zstd.pyd
                                                                                            • Size 491KB
                                                                                            • SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            base_library.zip
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\base_library.zip
                                                                                            • Size 1.3MB
                                                                                            • SHA256 2a9d82839260c6459c21b3facc504f0d2b9d00416071a038376e72314ed35837
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            md.cp314-win_amd64.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\charset_normalizer\md.cp314-win_amd64.pyd
                                                                                            • Size 10KB
                                                                                            • SHA256 394271ca355a08eff4e268efef85f3f817bcc7d8661ac655cb47f24132e7eedf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            md__mypyc.cp314-win_amd64.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\charset_normalizer\md__mypyc.cp314-win_amd64.pyd
                                                                                            • Size 120KB
                                                                                            • SHA256 7d28dad4be5242b16e17e75d94bb1117451754f95c8749aae554caa6973d1c6f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            libcrypto-3.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libcrypto-3.dll
                                                                                            • Size 5.0MB
                                                                                            • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            libffi-8.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libffi-8.dll
                                                                                            • Size 38KB
                                                                                            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            libssl-3.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libssl-3.dll
                                                                                            • Size 776KB
                                                                                            • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            python3.DLL
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\python3.DLL
                                                                                            • Size 72KB
                                                                                            • SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            python314.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\python314.dll
                                                                                            • Size 6.4MB
                                                                                            • SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            select.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\select.pyd
                                                                                            • Size 32KB
                                                                                            • SHA256 05734bd352ce60c944d474aa62468cc5eebf400097f1d9d0c453d37aed26fcca
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            tcl86t.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\tcl86t.dll
                                                                                            • Size 1.8MB
                                                                                            • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            tk86t.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\tk86t.dll
                                                                                            • Size 1.5MB
                                                                                            • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ucrtbase.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\ucrtbase.dll
                                                                                            • Size 1.1MB
                                                                                            • SHA256 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            unicodedata.pyd
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\unicodedata.pyd
                                                                                            • Size 740KB
                                                                                            • SHA256 4445b894f836e89a8b9fdcc88b5e59fbc76aca805baaf40aeb69e869978d4e6d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            zlib1.dll
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\zlib1.dll
                                                                                            • Size 142KB
                                                                                            • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            a337700b-d260-421a-b113-0aef4a3fc7c5.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\a337700b-d260-421a-b113-0aef4a3fc7c5.tmp
                                                                                            • Size 10KB
                                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            content_new.js
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5548_1752959696\CRX_INSTALL\content_new.js
                                                                                            • Size 10KB
                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5740_1820297502\CRX_INSTALL\manifest.json
                                                                                            • Size 626B
                                                                                            • SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            memory/576-1299-0x000000000EEF0000-0x000000000F05C000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1333-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-2016-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1991-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1120-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1490-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1337-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1340-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1123-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1122-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1753-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-2027-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-2032-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/960-1300-0x0000000000590000-0x00000000011E7000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1305-0x0000000005750000-0x00000000057B6000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1332-0x0000000008B40000-0x00000000090FA000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1326-0x00000000078C0000-0x00000000078DA000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1310-0x00000000067D0000-0x000000000681C000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1309-0x00000000062F0000-0x000000000630E000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1308-0x0000000005F50000-0x00000000062AB000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1304-0x00000000055B0000-0x0000000005616000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1325-0x0000000007F00000-0x000000000857C000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1303-0x0000000005510000-0x0000000005532000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1302-0x0000000005900000-0x0000000005F4A000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1301-0x0000000002A90000-0x0000000002AC6000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1327-0x0000000007920000-0x000000000792A000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1319-0x0000000070030000-0x000000007007C000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1328-0x00000000079D0000-0x0000000007A66000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1331-0x0000000007DB0000-0x0000000007DD2000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1315-0x0000000006710000-0x0000000006758000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1318-0x0000000007720000-0x0000000007756000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1324-0x0000000007780000-0x0000000007823000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1323-0x0000000007760000-0x0000000007780000-memory.dmp
                                                                                            Download

                                                                                            memory/2884-1320-0x00000000702E0000-0x000000007063B000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-1168-0x0000020701DF0000-0x0000020701E10000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-1157-0x0000020701A30000-0x0000020701A50000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-1190-0x00000207141F0000-0x0000020714210000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-1158-0x0000020701E70000-0x0000020701F70000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-1145-0x00000207001E0000-0x00000207002E0000-memory.dmp
                                                                                            Download

                                                                                            memory/3468-1317-0x0000000000DB0000-0x0000000001A07000-memory.dmp
                                                                                            Download

                                                                                            memory/3468-1314-0x0000000000DB0000-0x0000000001A07000-memory.dmp
                                                                                            Download

                                                                                            memory/5584-1119-0x0000000000FE0000-0x0000000001C37000-memory.dmp
                                                                                            Download

                                                                                            memory/5584-1111-0x0000000000FE0000-0x0000000001C37000-memory.dmp
                                                                                            Download

                                                                                            memory/5584-1109-0x0000000000FE0000-0x0000000001C37000-memory.dmp
                                                                                            Download

                                                                                            memory/5584-1106-0x0000000000FE0000-0x0000000001C37000-memory.dmp
                                                                                            Download

                                                                                            memory/5764-1107-0x00007FF8F92C0000-0x00007FF8F92E9000-memory.dmp
                                                                                            Download