377c7cb9207dfcc14e792a9e0002de502970d3dfb51f2d4c589ebbe53e8f860b

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 2.8MB
Sample260708-ppdzcafw7v
SHA256 377c7cb9207dfcc14e792a9e0002de502970d3dfb51f2d4c589ebbe53e8f860b
MD5 4c366b43bfac272150eba0245533d146
SHA1 8f123302d1df0c92a4112fd636f8a5f0219ba9c3
SHA512 fe2826d553bd94b4d6893d56730d6807704e9eb836b8111d619aeb18141758d28822b09e49fd97e4b2db38e5e45db32dba9d6a55dcc0ef3e9962246cff7e5bb5
SSDEEP 49152:0+0lmplyPZAlxMLrFiSIJQPEeDh+1MdVa2h/4:0+TfchPEDMza2h/
TLSH
T17CD58D4B7CD108E9C8AAA3328CB652967B70BC094F3623D72E90B6782F727D18D75754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 2984 created 2584	2984	Loader.exe	87
PID 2984 created 2372	2984	Loader.exe	88
PID 2984 created 4456	2984	Loader.exe	89
PID 2984 created 4480	2984	Loader.exe	90
PID 2984 created 1076	2984	Loader.exe	91
PID 2984 created 5640	2984	Loader.exe	92
PID 2984 created 5980	2984	Loader.exe	93
PID 2984 created 2584	2984	Loader.exe	87
PID 2984 created 2584	2984	Loader.exe	87
PID 2984 created 4480	2984	Loader.exe	90
PID 2984 created 4480	2984	Loader.exe	90

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2984	Loader.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2544_575148014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2544_575148014\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2544_1044258202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2544_1044258202\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2544_530506256\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	chrome.exe
3704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Loader.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279874291684083"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{4A92EA0B-36D6-425D-A46D-DB216FB82A6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2584	chrome.exe
2584	chrome.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe
2984	Loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	Loader.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2584	2984	Loader.exe	87
PID 2584 wrote to memory of 2372	2584	chrome.exe	88
PID 2584 wrote to memory of 4480	2584	chrome.exe	90
PID 2584 wrote to memory of 4456	2584	chrome.exe	89
PID 2584 wrote to memory of 4456	2584	chrome.exe	89
PID 2584 wrote to memory of 1076	2584	chrome.exe	91
PID 2584 wrote to memory of 1076	2584	chrome.exe	91
PID 2584 wrote to memory of 5640	2584	chrome.exe	92
PID 2584 wrote to memory of 5980	2584	chrome.exe	93
PID 2584 wrote to memory of 5640	2584	chrome.exe	92
PID 2584 wrote to memory of 5980	2584	chrome.exe	93
PID 2584 wrote to memory of 52	2584	chrome.exe	95
PID 2584 wrote to memory of 52	2584	chrome.exe	95
PID 2584 wrote to memory of 1296	2584	chrome.exe	96
PID 2584 wrote to memory of 2396	2584	chrome.exe	97
PID 2584 wrote to memory of 5764	2584	chrome.exe	98
PID 2584 wrote to memory of 2396	2584	chrome.exe	97
PID 2584 wrote to memory of 5764	2584	chrome.exe	98
PID 2584 wrote to memory of 3760	2584	chrome.exe	102
PID 2584 wrote to memory of 3760	2584	chrome.exe	102
PID 2584 wrote to memory of 2492	2584	chrome.exe	103
PID 2584 wrote to memory of 2492	2584	chrome.exe	103
PID 2584 wrote to memory of 944	2584	chrome.exe	104
PID 2584 wrote to memory of 944	2584	chrome.exe	104
PID 2584 wrote to memory of 1364	2584	chrome.exe	105
PID 2584 wrote to memory of 1364	2584	chrome.exe	105
PID 2584 wrote to memory of 3532	2584	chrome.exe	106
PID 2584 wrote to memory of 3532	2584	chrome.exe	106
PID 2584 wrote to memory of 5784	2584	chrome.exe	108
PID 2584 wrote to memory of 5784	2584	chrome.exe	108
PID 2984 wrote to memory of 2544	2984	Loader.exe	109
PID 2544 wrote to memory of 5464	2544	msedge.exe	110
PID 2544 wrote to memory of 1188	2544	msedge.exe	111
PID 2544 wrote to memory of 3704	2544	msedge.exe	112
PID 2544 wrote to memory of 1188	2544	msedge.exe	111
PID 2544 wrote to memory of 1188	2544	msedge.exe	111
PID 2544 wrote to memory of 4596	2544	msedge.exe	113
PID 2544 wrote to memory of 4596	2544	msedge.exe	113
PID 2544 wrote to memory of 4256	2544	msedge.exe	115
PID 2544 wrote to memory of 4256	2544	msedge.exe	115
PID 2544 wrote to memory of 4256	2544	msedge.exe	115
PID 2544 wrote to memory of 1140	2544	msedge.exe	116
PID 2544 wrote to memory of 1140	2544	msedge.exe	116
PID 2544 wrote to memory of 1140	2544	msedge.exe	116
PID 2544 wrote to memory of 2956	2544	msedge.exe	117
PID 2544 wrote to memory of 2956	2544	msedge.exe	117
PID 2544 wrote to memory of 2956	2544	msedge.exe	117
PID 2544 wrote to memory of 1292	2544	msedge.exe	118
PID 2544 wrote to memory of 1292	2544	msedge.exe	118
PID 2544 wrote to memory of 1292	2544	msedge.exe	118
PID 2544 wrote to memory of 4812	2544	msedge.exe	119
PID 2544 wrote to memory of 4812	2544	msedge.exe	119
PID 2544 wrote to memory of 5800	2544	msedge.exe	120
PID 2544 wrote to memory of 5800	2544	msedge.exe	120
PID 2544 wrote to memory of 604	2544	msedge.exe	121
PID 2544 wrote to memory of 604	2544	msedge.exe	121
PID 2544 wrote to memory of 5196	2544	msedge.exe	123
PID 2544 wrote to memory of 2188	2544	msedge.exe	124
PID 2544 wrote to memory of 2188	2544	msedge.exe	124
PID 2544 wrote to memory of 3992	2544	msedge.exe	127
PID 2544 wrote to memory of 3992	2544	msedge.exe	127
PID 2544 wrote to memory of 5436	2544	msedge.exe	128
PID 2544 wrote to memory of 2280	2544	msedge.exe	129
PID 2544 wrote to memory of 2264	2544	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5b8bc728,0x7ffd5b8bc734,0x7ffd5b8bc740
    3⤵
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,3569329399695505559,5442435842965776682,262144 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,11120355029155229969,17754725404812048388,524288 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,9686582336422129903,1008085014173044438,524288 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
    3⤵
    PID:1076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,9407295003623502049,18367895084316265165,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,6296039826124397643,14791421345670592404,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,5626409208841717093,6894097908863825771,524288 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:52
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,15146106223686813310,2828468105045823876,524288 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5452,i,17619864200830441420,12109787649391867726,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,15706267019636785440,3024843402597819024,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4716,i,2360063979320776688,18098639163786836155,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,4236980998748914248,7384804140468861632,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5444,i,16467486765020972575,9182235259118036462,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4684,i,17462445284899826430,823370058530850867,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5760,i,6162004055096744606,17428424970004554221,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5492,i,2290982154947172278,4382948699067569316,2097152 --field-trial-handle=1920,i,14020279341751270376,104580778442945462,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffd4413c188,0x7ffd4413c194,0x7ffd4413c1a0
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1704,i,15936211273632428882,17397996206214952375,262144 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2539592831066223100,11720306517620531605,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,14299603453824441806,11616296541960242388,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16217788195711697527,16693808567856483038,2097152 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,2537130610551326751,14679798514687133353,2097152 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,5308756762987994973,14579652047342245586,2097152 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,7592242917119261618,8795519074674904257,2097152 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,13821457833713009855,11919347801597260113,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3401641424629116344,1747043913655527855,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,17525401127198459473,8685794576980470202,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5788053225918425171,5282273642272691363,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5788053225918425171,5282273642272691363,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12235291443467533715,580175387292456696,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,6764597445392521046,10248418378916561640,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,5648020140776152067,12193711312498678602,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,6332883584462920689,12796096787800314823,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,15079519741130946004,16754709302957029925,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15227467109464575438,3141260113300942822,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,15959679379611578251,6928853488294876388,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,907362024968312391,9609701392300748585,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7710460520975892014,16804811536912417426,524288 --field-trial-handle=2392,i,15976844899869000524,14454098985161128056,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:3168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d0a5558faa7a47b156619ceead85a12ad9e5f6e7527d9456d8854e7f1523b4a5
MD5 3960d701ef867f975b31131bfcb4e975
SHA1 a77cbec2bcd15a94ccda9b135bf94ee9f060cd54
SHA512 8c60357553c463f6af68f3bd218af4285e5d11c84748f235ac39181c95e1868b217c6e5ae88f0a87ffe8a33f97f1d4e80a76715878e1379cbe99953b38523f11
SSDEEP 192:BRveyeH4v7KvAPRp2Q9XHsb+WNnxEPLge6DVyIsnAUgR:BRveyak26XX9weP8lR
TLSH
T1B922962FAD54653F5CDBD22AFB617B53E2F5102132952E84E6FC8A2C11D7ACC2217827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 cd06cc6d3bde587fe5786b153e4e62ccacc8e70eb40100bc621d70e61aa533f3
MD5 7e91321d0ae3a2e0ab65bb992bc621c2
SHA1 30881a7b14ab99ca57eab43c6bd0163a03c09cff
SHA512 ec1601443136c535692e9de892a21f5b45ff5a61e70234558cdd6fbbd66faabb621990834251fd835bb0fa2faebee4505d6d58b3961e69a3ad789d1662e5c8d6
SSDEEP 192:evI4K6C87KxkXqK4I40pUZNCgVLHrKHfFKslEZ35XzKD/hk+ErUkKN9J3OhlIcZ/:SIjp87KxkXqKf/pUZNCgVLH2HfgslE5/
TLSH
T10032D827A88D9A3F4FE8D51CDC126F4B7CF502927778092856FB9D0403A978D114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 59e86a8e4bbe30f5905e04b5ebc5c751781f98236d07bf96bb73ef4042d5816d
MD5 c3b95caa3b2185e5fc09a87d4aada95b
SHA1 aa8dacc140a235a02760a954fb2a431e98e0280f
SHA512 ef0ee17d606ed3272918e00e9496182ca5da99c8c78afd2cc80957c0c3a9a79cd8923ef60742d9eea844731479a678f48c1ecacd1a8a36b024e45d0de8eac7ee
SSDEEP 96:bC6Jd+eQNFnwQWu5sf/XjhTGRQSl8h4otop5XPDGB6+dGyvVmEBK1QzbTpPhPI0S:bC2bQ4Vu56piU2bWpwBEB/jpPhPIU0
TLSH
T1DBC1093168AD9D7399E7E184B4132B53CEB4707BA501DF94EAE50B0D16E74BC1386933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7892ea5282aa362a54e8160323e7c3f0df14d16cc63e4b2a14c3376978fff9c0
MD5 766485a05d8217c8fb20cc40f3056329
SHA1 9e17db80bbdb901ad2005753804008d9f90c812b
SHA512 b9c7c9649e9528b73a759abdac7d6c577e21b3ca1ecc9ed4e19878bbdab56799fa62ff6fa29dafe2452b206009faacb6a24f4f15e403682c62f01c2d189ad120
SSDEEP 96:XC6Jd+eQNFnwQWu5sf/XjhTPRUERDotok5XyDGB6oGyvVQQP4bhOv4a:XC2bQ4Vu56GiDUDkWkpQP4bq
TLSH
T13DA1F83259698D7384B7D08474626B53DF78B07BA521EFD4E9E91A0C16BB4E81382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 33c6e6bae4ee9250332fc0a0b2e5c986f8eb2deb7cfb0ec751d4103398239b4c
MD5 74727b4352a31c683cbe2509206d5bb1
SHA1 9cf653b0f525a7c883fb4a377664b4e16e5557f8
SHA512 9adea13063f4c2028e884bd6c48340080dd142efb6412a6eaced0704a4106259503e51aa0760da81e53710d62c167935e2cb0c8a9f4f9e7b7e210cbbbb7e4c70
TLSH
T19CD022A232388808CEC0303230A082A8A322C030000A0A0A0080FA38CC80AF3C20A0AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9a80f6c421414a8b66bf8507c53a0c4ffeb5ba8b94b60ab018ba461aa97acd
MD5 7d69ac67ab7824947bec495abe90ec4a
SHA1 a3c132aa3f49dcdcce56c4c6968c36937f0281d6
SHA512 96cc53c1ea47adf6bf5c07be3692a428e441878e2f62d51e8f602bd99412a2004cb5f7f97f8d380a16d29844233c2d6b1a7141b6130f93761e62ba2cb077211d
TLSH
T151D09B9672258914CDC03572745452696766C53055094A465441B678CC556F3C51B1AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 42b731d1465b33a33d5827f3ab9849e7d87648e5a4806548e0b46513ae1fbea7
MD5 8d7491def089dc675a34267ff4e5b262
SHA1 b7ccba3acc949f7487b3796e9112acc3ffb4f7b4
SHA512 514ccdf9254d17abb68c6491b7bf4d08da5596dd14603613d2fd40e4cffd3be138ecc192135fa4e510ff80baed9fc9ccc2e6a0a3a8a3182e4d4c1533e21a5d74
TLSH
T16C512E4033F1AB9FD7AB4D7271DA2844397EA4F9055B6E020398E1ECE82E6A1B0C5D70
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5979d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5979d9.TMP
Size 2KB
SHA256 4405cd50b42504cc1e280f354590645a6a252c50d470f227a66db005c1c4dc97
MD5 8e7d4171f93f6cf8c6ed0ad74b8c9e25
SHA1 b2206cbb29097022f42c2073e065c00e061bc663
SHA512 09409c046ea696d115f09c2f8c4d445fb7e0561b1a5c6a3f5d74f850ba3bd0dc513fde9d2e4d5adaa190d2bba88c5a2c9a5c5d35e7e360136376c4d82afe4ab6
TLSH
T10E513E4033F1AB9FD7AB4D7271DA2844397EA4FA055B6D020398E1ECE83E2A1B0C5D70
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a72ca0c24d5914e0c196a852375b415dca3c54349d69d2c3a4b2d92d2c39f30c
MD5 ffcda769afc7dd11d74e05b936553f77
SHA1 e4ac04fde536ec2382d07d646d36fa47a6aa1dbc
SHA512 c67d4fbd8b336ebbebe3c41d9d11afc75f0ac6a27610eed4abef1dd56af2bce667dfdb0866531bfb4ff0156305d5bc9fd0eafc8d92e6bf5b1fd7e5034bed9d96
TLSH
T1E951BEF7C3E8866DCA1196F0BA186E2BCE1D0914432C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e8972b33efdfa691df63ff23a67362bf7892543a5e2979490a26ec0b82e8d61f
MD5 b0ab122ab41359d938429562ddeca03e
SHA1 7aece6ce11b39dc6ea5b1c24dbda62bf46e52a4c
SHA512 935d433c8314d55851b43f3a8c2e70c04328d8e8f2e5eadf7a4bb5567ba8da7a2f5bbb96ee143227cb56403519a0baa9c4ea61ef3ec83f372db1e08e96d1ba17
SSDEEP 192:sxRMRbyM/jK1Ml8wCR/fpsJmtviZoRiCzoA8pi/g6+WNIYV5j+GWIgtJ:sxRMv8R/fpsJmBkoEPi/5Imk3
TLSH
T11D52EA056A389977DCCBD219FA557F53D6F81523A2905E44AAFCCA0C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a3497fe249da0e979fe4d6d1a1b6620e1397946ded821c97998692c8aba3b1ab
MD5 150d89a31aba9b20ca93845a6b1a3d1b
SHA1 f3219d94f46c01e3c0153bfcbdde782d152362f1
SHA512 5104a85a4f585834b7ba18cf4fdc670ecfebe201ed85832660be61dbc6945da12da7f033229a6b30b9e397cdd1e80f3306ac69f0e378bc6ac9749e46c0c2ea43
SSDEEP 192:sxRvRbyM/jK1Ml8wCR/fps3umtviZoRiCzoA8pi/g6+WNIYV5j+GWIgDiJ:sxRvv8R/fps3umBkoEPi/5Imkq
TLSH
T10352EA056A389977CCCBD219FA557F53D6F81523A2905E44AAFCCA0C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2e590dad2e7c8a2b72b3ff499fa7986dffe55fb985405fa2e9da0b5ac720d1e0
MD5 ddea462e3657d80cf67556ea1d04b2c4
SHA1 a9f33d4751b12ba73cc5a02d25a0276d2e9bfaa7
SHA512 bcb0e2e8c3a94f961d1bee8161366c2080f13827f86d8fadf53b1a594f3287265cfd758e9a2c9b5b7758609454aa306185c6b734ebf082a18f90cde9302e70d6
SSDEEP 768:7Oo6Hm7pLuL73mWg/zfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0HVypY4ro0ojyT:7Oo6HGE73mWg/zfmju1ja7HVwYD0pr
TLSH
T138E2EC6B680CCB7F4F40499CED2A7E9AADA801CF56D8CD5447FA880C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 504b2fb69c2597187d8564819cfafcf873e7264c60d2be3f6324e6431c424e41
MD5 dca679d05e34c53dca6a2eeb87c45520
SHA1 22d0c8b7ba5bc4653a85ba02661f709783b90bcc
SHA512 00e08d02d9afa11e008b445b727073f767f41d41ded6f118cb1352ef0c9385076e5512e785b8e1e759b5f974d513bf034119a88d9b694f27dadefbe6f21fae6a
SSDEEP 96:KROfOIOtOpOfOdO9OxWOJOmOsgOROxK4O4gO/OxcOnOvOOORO9OSH8dIsGK+MW6L:COfOIOtOpOfOdO9OcOJOmOtORO7O4gOy
TLSH
T108914B56B73582903D7E685C81B88C27C9C3B862351AA92F3BE852E51F57E018DFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28fba9c6-d45b-44eb-8974-ed36b8ad189a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\28fba9c6-d45b-44eb-8974-ed36b8ad189a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 67547da00565b4bc9bdce4e64e710f191f46bee91ccdf6576aaa1d3842650a01
MD5 9d7c9a3905ff11e6067fda414fff6e13
SHA1 b73b5a6c1f6baa7c0dfd4546fd9e888847b7a32d
SHA512 d1b287ff3ce1922fddb1d68e7b3a948f4f709b3a18096f1256d0e7ac3ecf77d8dce0cd68d4e1b1446134b499878d661864c03caaa4d7a0e9975df25da7fa193c
SSDEEP 768:wF1j+9D3WwgMNjwOu9tfK3lJiGcC3aHOQiBp3MjhY:d9D3/37EifSY
TLSH
T185038D32E915DE7BADE68BC5B716B65ADFE451A382C868C4DAD81C4D00C72EE0307C39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8ac67d3e85082b775b5dd2b82fe400bdb2f13ed2de8a2555e8ebb2b794263e69
MD5 92d986e9e130f75ffaab8967f6cc5c41
SHA1 d31093700a241fbe75fd27e5568f187df840291b
SHA512 49e3724751b7d9a2f041d1a91c6e2bb9b907781015318c5d8d18d19e79834d2f51e9d63174e3e5630b1b973209e900acfb1ce9944fb15d6ec8d1a029ecf70531
SSDEEP 768:/j+923Q0xwOu9tfK+JiGcC3aHOQiBp3MjhY:y923J2EifSY
TLSH
T19BF2BF32A925DD739DA6CB89B7177356EFA851B342C41D48DED82D4E44C72AE0313C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 61523f943b8a7e7046e8d5ffd6fd052fdde4f7a30b5e8e0e384d65e0cbf1067b
MD5 f6ed1fe24bb168559fcff9cd63abe2ec
SHA1 5ef318791c1803f09d9fb82207414ca022b8bf0f
SHA512 d11ab906fd245fd048cf8e3c92bdb2b40e337590678bd42e103067ae71c9d7d985cc07cd8d8103506fd3aa28a60062c5c2aafa8594656f3a4f3a850e7ac57676
SSDEEP 768:krv+4UNbd838J5xwOu9thJiGcC3aHOQiBVDUirYb:kbsbS35EijUiK
TLSH
T12403CF32A928DD33ECE6C284B287B613BFB8916356C81B44C5DC2D5E459B1AE0307D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

75227ee4-afb2-4764-a0d9-609d3741931a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75227ee4-afb2-4764-a0d9-609d3741931a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2544_1334469801\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-46-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-82-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-83-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-93-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-100-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-108-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-120-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-129-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-138-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-150-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-149-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-148-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-143-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-142-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-141-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-131-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-128-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-127-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-123-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-122-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-118-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-116-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-111-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-107-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-99-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-98-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-97-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-92-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-87-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-81-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-67-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-60-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-50-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-70-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-68-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-59-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-51-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-45-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-19-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-18-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-1121-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-17-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-16-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/2984-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download