Overview

overview

10

Static

static

10

2026-07-29...op.exe

windows10-2004-x64

10

2026-07-29...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 18:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_3997ee85ee5c263fce6551c805efd6d8_darkgate_elex_glassworm_icedid_remcos_stop.exe
  • Size 5.8MB
  • Sample260729-wlbhdace65
  • SHA256 4fd69d9d4e44066197d4131f10929984cd1928e1e3c9cded389e889844424ee8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoorgoogledefense_evasiondiscoverysalitypersistencephishingspywarestealertrojanupx

Malware Config

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Custom signature
    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 42 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 43 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Detected potential entity reuse from brand GOOGLE. 1 IoCs
    phishinggoogle
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:1204
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:3156
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
        1⤵
          PID:3228
        • C:\Windows\System32\ShellHost.exe
          "C:\Windows\System32\ShellHost.exe"
          1⤵
            PID:3460
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
              PID:4380
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:4424
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                1⤵
                  PID:4488
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                  1⤵
                    PID:4764
                  • C:\Windows\system32\ctfmon.exe
                    /QuitInfo:0000000000000268;000000000000026C;
                    1⤵
                      PID:4988
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                      1⤵
                        PID:5124
                      • C:\Windows\System32\SecurityHealthSystray.exe
                        "C:\Windows\System32\SecurityHealthSystray.exe"
                        1⤵
                          PID:5232
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                            PID:1964
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                                PID:2988
                                • C:\Users\Admin\AppData\Local\Temp\2026-07-29_3997ee85ee5c263fce6551c805efd6d8_darkgate_elex_glassworm_icedid_remcos_stop.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2026-07-29_3997ee85ee5c263fce6551c805efd6d8_darkgate_elex_glassworm_icedid_remcos_stop.exe"
                                  3⤵
                                  • Modifies firewall policy service
                                  • UAC bypass
                                  • Windows security bypass
                                  • Windows security modification
                                  • Adds Run key to start application
                                  • Checks whether UAC is enabled
                                  • Enumerates connected drives
                                  • Installs/modifies Browser Helper Object
                                  • Drops autorun.inf file
                                  • Drops file in Program Files directory
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:4824
                                  • C:\Windows\system32\regsvr32.exe
                                    C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
                                    4⤵
                                      PID:4140
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5968
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                                        5⤵
                                        • Drops desktop.ini file(s)
                                        • Detected potential entity reuse from brand GOOGLE.
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3568
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27097 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {d9389b40-fe7a-401f-b295-ba2458c5c551} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                          6⤵
                                            PID:2500
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {bf65d9a0-3fbd-43f3-9d03-f1ae2e5fb5e3} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                            6⤵
                                              PID:2888
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3712 -prefsLen 25164 -prefMapHandle 3716 -prefMapSize 270279 -jsInitHandle 3720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3728 -initialChannelId {6c08e894-2966-4cee-b198-754768bf57bc} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                              6⤵
                                              • Checks processor information in registry
                                              PID:3180
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3876 -prefsLen 27274 -prefMapHandle 3880 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {b96c97cf-5f98-405f-aa7b-c27dd5d25d8d} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                              6⤵
                                                PID:1604
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34773 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4484 -initialChannelId {ed44a3f9-4db8-4b88-aadb-050ec8927f41} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                6⤵
                                                • Checks processor information in registry
                                                PID:1404
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 35010 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 5036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {bbabfa01-e6d6-4371-99b8-c3e16219596e} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
                                                6⤵
                                                • Checks processor information in registry
                                                PID:2436
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3848 -prefsLen 35010 -prefMapHandle 3832 -prefMapSize 270279 -ipcHandle 3836 -initialChannelId {b0d202dd-2cb5-447e-80bd-20695fa62a36} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
                                                6⤵
                                                • Checks processor information in registry
                                                PID:1304
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4752 -prefsLen 32900 -prefMapHandle 1508 -prefMapSize 270279 -jsInitHandle 1592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {55a0b2b9-7794-44b8-82ce-794582b8eb1a} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                6⤵
                                                • Checks processor information in registry
                                                PID:3064
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32900 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {a4a39059-d0f0-425b-8bf0-a85bb6a3cd11} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                6⤵
                                                • Checks processor information in registry
                                                PID:1656
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {70498bd5-970d-4e8f-8998-46476ed4fa29} -parentPid 3568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                6⤵
                                                • Checks processor information in registry
                                                PID:4936
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1536
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4080
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3908
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5992
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b64
                                            4⤵
                                            • Drops file in Windows directory
                                            • Enumerates system info in registry
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4520
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffe3f2dc188,0x7ffe3f2dc194,0x7ffe3f2dc1a0
                                              5⤵
                                                PID:468
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8754926121211779311,222847415578574421,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
                                                5⤵
                                                • System Time Discovery
                                                PID:2568
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,8719495100708922929,413213065715614755,262144 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
                                                5⤵
                                                  PID:4948
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,5150744635627966488,12071315091672269592,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
                                                  5⤵
                                                    PID:4440
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8947952913971777674,1947098685412646150,2097152 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                                                    5⤵
                                                      PID:4260
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,16759680461952029423,4316366219410279771,2097152 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                                                      5⤵
                                                        PID:2744
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15690190139544853895,17711896964561126259,2097152 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
                                                        5⤵
                                                          PID:4132
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4890310545016569014,1736872065709109551,2097152 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
                                                          5⤵
                                                            PID:5792
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4416237042259283879,17147530256741037541,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
                                                            5⤵
                                                              PID:6356
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,5067928016328137687,71133714342212772,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
                                                              5⤵
                                                                PID:6656
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15718759777959348684,6545410551907090325,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
                                                                5⤵
                                                                  PID:6664
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17030642230849732424,11354978225199568138,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                                                  5⤵
                                                                    PID:6856
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17030642230849732424,11354978225199568138,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                                                    5⤵
                                                                      PID:6864
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,15345851670737754356,15365350203045801787,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                                                      5⤵
                                                                        PID:7104
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14667674503910829461,3557531561469484716,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
                                                                        5⤵
                                                                          PID:7112
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8380100787146737484,1902885018242408212,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
                                                                          5⤵
                                                                            PID:7068
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,11049399641805770820,830640825659965774,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
                                                                            5⤵
                                                                              PID:7088
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9817888156127549135,2576296102925547523,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
                                                                              5⤵
                                                                                PID:6844
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,16695266529820685616,281610120835610448,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
                                                                                5⤵
                                                                                  PID:6520
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,8570254525299668750,7412800344924534735,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                                                  5⤵
                                                                                    PID:6552
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16023039346263503478,5639470806056346726,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
                                                                                    5⤵
                                                                                      PID:2640
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14379483872154036650,2053767689993335825,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                                                                      5⤵
                                                                                        PID:2056
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,13875436730246751714,6079015032250230770,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
                                                                                        5⤵
                                                                                          PID:6048
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,16706825712599717732,10249198037817285473,524288 --field-trial-handle=2760,i,11187253846203634118,8356305120934073286,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
                                                                                          5⤵
                                                                                            PID:6816
                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                    1⤵
                                                                                      PID:2392
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3188
                                                                                      • C:\Windows\System32\smartscreen.exe
                                                                                        C:\Windows\System32\smartscreen.exe -Embedding
                                                                                        1⤵
                                                                                          PID:968
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                          1⤵
                                                                                            PID:204
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:2832
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:6912

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Replication Through Removable Media

                                                                                                    1
                                                                                                    T1091

                                                                                                    Execution

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Browser Extensions

                                                                                                    1
                                                                                                    T1176

                                                                                                    Create or Modify System Process

                                                                                                    1
                                                                                                    T1543

                                                                                                    Windows Service

                                                                                                    1
                                                                                                    T1543.003

                                                                                                    Privilege Escalation

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Create or Modify System Process

                                                                                                    1
                                                                                                    T1543

                                                                                                    Windows Service

                                                                                                    1
                                                                                                    T1543.003

                                                                                                    Defense Evasion

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Impair Defenses

                                                                                                    4
                                                                                                    T1562

                                                                                                    Disable or Modify System Firewall

                                                                                                    1
                                                                                                    T1562.004

                                                                                                    Disable or Modify Tools

                                                                                                    3
                                                                                                    T1562.001

                                                                                                    Modify Registry

                                                                                                    8
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Unsecured Credentials

                                                                                                    1
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    1
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    Browser Information Discovery

                                                                                                    1
                                                                                                    T1217

                                                                                                    Peripheral Device Discovery

                                                                                                    1
                                                                                                    T1120

                                                                                                    Query Registry

                                                                                                    4
                                                                                                    T1012

                                                                                                    System Information Discovery

                                                                                                    5
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    System Time Discovery

                                                                                                    1
                                                                                                    T1124

                                                                                                    Lateral Movement

                                                                                                    Replication Through Removable Media

                                                                                                    1
                                                                                                    T1091

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    1
                                                                                                    T1005

                                                                                                    Command and Control

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 2KB
                                                                                                    • SHA256 07e66bdf1e28c412d3bb884c4d783f4ef346a707f9b8aaedc2db1f1bdd541d53
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe5a87a0.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a87a0.TMP
                                                                                                    • Size 2KB
                                                                                                    • SHA256 3dd13599a1c4766ccc2a3962fd01ba0b5a5d3da2b88a6afd08d856fc30f6b9e7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SiteList-Enterprise.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Edge Profile.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    1615b228-da11-4c55-9d60-856fc9244ad2.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1615b228-da11-4c55-9d60-856fc9244ad2.tmp
                                                                                                    • Size 40B
                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 b6ae941e4fc2976eae2ad05b7fd3805c6a0d3e9b6520617c57ceae65623691dc
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 11KB
                                                                                                    • SHA256 6a9300ab3881855a457955a712c9d2f33b50aa6420aef49c118e0b45d31dc14a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 d1cc64bd757f6dd9e818df28c1307326a26bc3efb75456cb1b7ffcc093fac6a0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 b7854b2b634e604c8c53b1372166f630215786e1b1867af0f2271d107f75e8a1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Secure Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                    • Size 29KB
                                                                                                    • SHA256 6997f6b243975372d9c7ca903ddd73f7586abc80e008a61cd56a45ee33f41ae0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    a7e90f5b-231b-4525-a855-6ad22381b4ee.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a7e90f5b-231b-4525-a855-6ad22381b4ee.tmp
                                                                                                    • Size 22KB
                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 35KB
                                                                                                    • SHA256 c253105a3b2f2081fe51cf1767d59bd0df46a57439f6637128aa4f6866582592
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 35KB
                                                                                                    • SHA256 573309fe79f216db4d5ddf7a8f1c12c60a2d2fecad22965c1945474bec878071
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 38KB
                                                                                                    • SHA256 bf676f82e023215d34a51b88b45d84e0c81828eace4551cc3f3453c5632301a6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 4471f76a86b505fb4252d5bc19118a5a514885718126901856c8bc7b2bb5159c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 43KB
                                                                                                    • SHA256 687c571df78f5541455e43a885640f7255a908d25579219b33cd25452d5769b0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 132B
                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • Size 153KB
                                                                                                    • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                    • Size 132B
                                                                                                    • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                                                                    • Size 15KB
                                                                                                    • SHA256 0d84287ce8c208745d4ba23f967a978239b196fd01b09ae3f4ae1aa8fc9eda8f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    webext.sc.lz4.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\startupCache\webext.sc.lz4.tmp
                                                                                                    • Size 104KB
                                                                                                    • SHA256 188984c91851137d0c662ac30a0b39f5d462d5e176740484417b3bc3b0d37a0b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    74623d65-c7dc-4172-94e7-4719454a0e32.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\74623d65-c7dc-4172-94e7-4719454a0e32.tmp
                                                                                                    • Size 1B
                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    edc3e784-53d8-4bfb-bad6-1d9e72034f04.zip
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\edc3e784-53d8-4bfb-bad6-1d9e72034f04.zip
                                                                                                    • Size 3.7MB
                                                                                                    • SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    content_new.js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_317098948\CRX_INSTALL\content_new.js
                                                                                                    • Size 10KB
                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    tmpaddon
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                    • Size 11KB
                                                                                                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    tmpaddon
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                    • Size 502KB
                                                                                                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    compatibility.ini
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\compatibility.ini
                                                                                                    • Size 198B
                                                                                                    • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 30KB
                                                                                                    • SHA256 92ad79b53b3011f62033e7ddcf080af658587c50e243ed7915702dcdb7d5bc79
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 6KB
                                                                                                    • SHA256 8f4d56cadca9306c98d2404d7cfdc56f05e48de64a1d8133c9a6167931affd12
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 7KB
                                                                                                    • SHA256 9b37804422c5209d50114e975f7409fec840d904bf62889adbc60cfa1b4af4be
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 30KB
                                                                                                    • SHA256 f9a23a22fc9bc77e9312c485f72b0e3e9bfabb1d1668ca07ab57c53cf8cc7cf5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 3KB
                                                                                                    • SHA256 c687052b84f67ba7563c2c246851ee6f397abdf48c31f5cf91841cef950a2343
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    events
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\events\events
                                                                                                    • Size 1KB
                                                                                                    • SHA256 c11f88910abbf7f73f563b82ec8c590804b7fdab63af0bca00857b315d75486e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    3ec962de-3c21-47f1-8b8b-9af2096063ac
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\3ec962de-3c21-47f1-8b8b-9af2096063ac
                                                                                                    • Size 886B
                                                                                                    • SHA256 5736ecf886ce148449c731929f824357a98761dd074ae0412e34ff4355db6ff7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    5a3587f5-9775-474c-bfff-e5c34f00a937
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\5a3587f5-9775-474c-bfff-e5c34f00a937
                                                                                                    • Size 16KB
                                                                                                    • SHA256 38738418dc4de1407a7e9a7ee5ae49cea12076a6e95b1d3cfe910d9891c41579
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    6188cf5c-b36d-4784-8b80-c0895752bd68
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\6188cf5c-b36d-4784-8b80-c0895752bd68
                                                                                                    • Size 2KB
                                                                                                    • SHA256 9483df6f92d59286a5f06779dacfda05b0266295a0f57c4fc4d99514a094ddef
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    6cfc9b0a-94d4-4140-a89b-2993a90f56f5
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\6cfc9b0a-94d4-4140-a89b-2993a90f56f5
                                                                                                    • Size 883B
                                                                                                    • SHA256 04858cdb7e472c00ef5a4d8ff26a4d4b3cb5fc75c5c24091ff9c4769b4e385b9
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    9adc16a8-6046-4d9d-a698-96ac26b13aed
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\9adc16a8-6046-4d9d-a698-96ac26b13aed
                                                                                                    • Size 235B
                                                                                                    • SHA256 b109d1a8c32f78b213a204b7c03a7a3af890a2e54f86891c2078b6955ce8aae0
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    c98a441a-3205-4b53-a8d8-d802c6f78d09
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\c98a441a-3205-4b53-a8d8-d802c6f78d09
                                                                                                    • Size 235B
                                                                                                    • SHA256 c13db59fb6800aca597fa8201f7cee56a51200565e21ce75022b63b0eee83fa2
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    extensions.json
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\extensions.json
                                                                                                    • Size 16KB
                                                                                                    • SHA256 0e0a1889cf929907ed47e8527ce7166566432bd08481da8a62390239f3a53a56
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    gmpopenh264.dll
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                    • Size 1.1MB
                                                                                                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    gmpopenh264.info
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                    • Size 116B
                                                                                                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                                                    • Size 1002B
                                                                                                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    widevinecdm.dll
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                                                    • Size 21.6MB
                                                                                                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs-1.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
                                                                                                    • Size 8KB
                                                                                                    • SHA256 7985438af5857debb0aa2b8cfcb7a2d41336a7e8bc05355ac45b14e591f94dcc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs-1.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
                                                                                                    • Size 6KB
                                                                                                    • SHA256 abb858128713e8fdeba417e8c2abcb28bb23f807078ae9222a3aa8b503877aef
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                                                                    • Size 6KB
                                                                                                    • SHA256 dcb5bea1395311c935a8cec87afedb41c6f87b19cd70718fc79a4fc5887a56a9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                                                                    • Size 12KB
                                                                                                    • SHA256 df3626df8d7b08796f96563474f74545283982c3bb1df6a098b0cfe677189093
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                                                                    • Size 6KB
                                                                                                    • SHA256 5b129c7d9d164357e7dae3496a8f5f4c0cad9071e7b1e342c6e4e123a830764f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                                                                    • Size 7KB
                                                                                                    • SHA256 727ba89c8345691bc93409597be63c7d6ae02ca3889376f0bd1031ec8a02ff48
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    recovery.baklz4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.baklz4
                                                                                                    • Size 4KB
                                                                                                    • SHA256 31482305d91b519b00ae251db8dba368c78c07f301a56bd3e7bc3270f67e49cf
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    recovery.jsonlz4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                    • Size 4KB
                                                                                                    • SHA256 c96f5ffe0fa37f82f9eeb1daa235fc3341c1db9b56912b20817a433bed26d28d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    luhdg.pif
                                                                                                    • Path C:\luhdg.pif
                                                                                                    • Size 97KB
                                                                                                    • SHA256 cc669cd70d4b1acb432e41ad5185a7bf3b851d4d13e932cc8abd929553745868
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    memory/4824-37-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-475-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-470-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-483-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-484-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-461-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-446-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-441-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-419-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-418-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-369-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-98-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-70-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-63-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-61-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-59-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-55-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-49-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-47-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-945-0x000000000A060000-0x000000000A062000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-940-0x000000000A900000-0x000000000A902000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-938-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-959-0x0000000000400000-0x00000000009E2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-44-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-41-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-39-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-1-0x0000000000400000-0x00000000009E2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-36-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-35-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-34-0x000000000A060000-0x000000000A062000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-32-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-30-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-29-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-28-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-27-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-24-0x000000000BA90000-0x000000000BA91000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-26-0x000000000A900000-0x000000000A902000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-25-0x000000000A900000-0x000000000A902000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-22-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-21-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-10-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-14-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-19-0x000000000A060000-0x000000000A062000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-17-0x000000000A060000-0x000000000A062000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-16-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-20-0x000000000A060000-0x000000000A062000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-18-0x000000000A4B0000-0x000000000A4B1000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-15-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-7-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-9-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-5-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-3-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-4-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4824-0-0x0000000003500000-0x00000000045BA000-memory.dmp
                                                                                                    Download