c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DriftBootstrapper.exe
Size 322KB
Sample260730-yaastaee75
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	DriftBootstrapper.exe

Executes dropped EXE 6 IoCs

pid	Process
180	Drift.exe
3392	Drift.exe
4596	Drift.exe
240	Drift.exe
548	Drift.exe
4508	Drift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4564	msedge.exe
1084	msedge.exe
4552	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
332	powershell.exe
332	powershell.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5056	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	DriftBootstrapper.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	2200	taskmgr.exe
Token: SeSystemProfilePrivilege	2200	taskmgr.exe
Token: SeCreateGlobalPrivilege	2200	taskmgr.exe
Token: 33	2200	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2200	taskmgr.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
468	DriftBootstrapper.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 332	468	DriftBootstrapper.exe	89
PID 468 wrote to memory of 180	468	DriftBootstrapper.exe	91
PID 592 wrote to memory of 5056	592	msedge.exe	137
PID 5056 wrote to memory of 440	5056	msedge.exe	138
PID 5056 wrote to memory of 4564	5056	msedge.exe	139
PID 5056 wrote to memory of 4552	5056	msedge.exe	140
PID 5056 wrote to memory of 4552	5056	msedge.exe	140
PID 5056 wrote to memory of 4552	5056	msedge.exe	140
PID 5056 wrote to memory of 2512	5056	msedge.exe	141
PID 5056 wrote to memory of 2512	5056	msedge.exe	141
PID 5056 wrote to memory of 2836	5056	msedge.exe	142
PID 5056 wrote to memory of 2836	5056	msedge.exe	142
PID 5056 wrote to memory of 2836	5056	msedge.exe	142
PID 4808 wrote to memory of 4824	4808	msedge.exe	145
PID 4808 wrote to memory of 1084	4808	msedge.exe	146
PID 4808 wrote to memory of 3408	4808	msedge.exe	147
PID 4808 wrote to memory of 3408	4808	msedge.exe	147
PID 4808 wrote to memory of 3408	4808	msedge.exe	147
PID 4808 wrote to memory of 3032	4808	msedge.exe	148
PID 4808 wrote to memory of 3032	4808	msedge.exe	148
PID 3172 wrote to memory of 4688	3172	msedge.exe	155
PID 3172 wrote to memory of 1148	3172	msedge.exe	158
PID 3172 wrote to memory of 4552	3172	msedge.exe	159
PID 3172 wrote to memory of 1148	3172	msedge.exe	158
PID 3172 wrote to memory of 1148	3172	msedge.exe	158
PID 3172 wrote to memory of 3924	3172	msedge.exe	160
PID 3172 wrote to memory of 3924	3172	msedge.exe	160

C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEQAcgBpAGYAdAAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEQAcgBpAGYAdABJAG4AcwB0AGEAbABsACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARAByAGkAZgB0AFMAdABhAGcAaQBuAGcAJwA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABEAHIAaQBmAHQAQgBhAGMAawB1AHAAJwA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:332
- C:\Users\Admin\AppData\Local\Drift\Drift.exe
  "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
  2⤵
  - Executes dropped EXE
  PID:180

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:4596

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:240

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5e4eea7bhbf8eh4854ha2f2h27eb3816abd4
1⤵
- Suspicious use of WriteProcessMemory
PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5e4eea7bhbf8eh4854ha2f2h27eb3816abd4 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x298,0x7ff9ba35c188,0x7ff9ba35c194,0x7ff9ba35c1a0
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,10841920248879741983,6446713855675550817,524288 --field-trial-handle=2264,i,3671886031394354376,7881456168560390416,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10408285369500342181,14351017577491059230,262144 --field-trial-handle=2264,i,3671886031394354376,7881456168560390416,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,13300739098425910273,17603629790757297587,524288 --field-trial-handle=2264,i,3671886031394354376,7881456168560390416,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3228,i,17554265863586770647,3370926536922859026,2097152 --field-trial-handle=2264,i,3671886031394354376,7881456168560390416,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:2
    3⤵
    PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbad8341ah71e9h409fh9ca1h242d8c450c59
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ff9ba35c188,0x7ff9ba35c194,0x7ff9ba35c1a0
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6969237815470907671,13649475025447346032,524288 --field-trial-handle=2376,i,14182416874147044222,4100634661896537266,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,8789113911609144969,1346480213823521696,262144 --field-trial-handle=2376,i,14182416874147044222,4100634661896537266,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,15221036552797946718,15757969668679927394,524288 --field-trial-handle=2376,i,14182416874147044222,4100634661896537266,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3440

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8cef81a9ha5f3h4bf7ha267hdb2a959069f0
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ff9ba35c188,0x7ff9ba35c194,0x7ff9ba35c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,3928633733422913715,4352219126556554537,262144 --field-trial-handle=2456,i,18009725528627810021,1728661431325360805,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,3264843894171523023,17133417151504779122,524288 --field-trial-handle=2456,i,18009725528627810021,1728661431325360805,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,11492434776956740045,18203655285281146740,524288 --field-trial-handle=2456,i,18009725528627810021,1728661431325360805,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Drift.exe

Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
Size 2.6MB
SHA256 b22c25831afd79c943c0ef6db76521fbf9efa412ea7c1b6621ff0d16855e900b
MD5 38af7bbc94d4210064e08060f1d3eec1
SHA1 9d5fcb3f88f8689eeb35f46ed20d16e352d3ec28
SHA512 8cfd73cb621e9462bed46aba65b202f2a8226925e4ac3aa2bdc3cc73bf9c7887588335d5b3d12ef0a68dc0a56cbe037a3ef25fce456933e743abde15395bd4d0
SSDEEP 49152:pgPw24cxp93W9KmE+toHmT6G7Ll1oAPzVK9Ebh+S5jalhe3M+0lZTp:FHimT6KfzVeEfjaiY
TLSH
T1D6D5AF6AE79A00A8D472D0BCEE57E617E6B1340503307ED713D08A191FAB6FC267FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d297ca3a18292c2972c07326aac6155925c83abb820251d77f0a0eec85cb76e
MD5 beb4da95b38e5952b9524ebc71458ac7
SHA1 855a1faa2001eac09f495deaaf31727876044997
SHA512 fbe11d1168246dc526def2e43d811962ba8f2eddd6248d7faab6d5cc95d15400e2b96a8a4648034496a58cfb44b1eb28518e898fe41638c06320da205e452cb6
TLSH
T158D080277E19A004F3964175E893D706131995A529575711F314C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 245008223b31493700d4a0b67de89b8816110e4f7b2fd0c450e8717dd3f1d9bc
MD5 8a7924c6089404c9e2e748573afc53a7
SHA1 d1d832b7df30110448d88275518be92f1a10e6c3
SHA512 3f980b42579375090a8f1f24fb7a317188294a09ea9a9f1cdc309f70a23095f9f179693968c8e42b5a1794e461df4d67f02371b7da4576dab9a8a2430707203d
TLSH
T101714DFD2A52419FF354C1BA40F2D10479F195E8F41FCEC9BD905C302516BA5C269B94
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 3466f61d074d3fc946d941b07159f07b8d5ca060badec571689c738353c2b52a
MD5 eb649a5a7a69708087a7b68d5324552a
SHA1 836fe837d66aa3901e0c88c6fde97edae8f22754
SHA512 5259380018f2d3573d5678e635d3133207d4c9f2f525edd1629a02f8022d35ad631c0ba105d1a173c0c98d609a685668cc224718de85054538b28fe38fc0ecb3
TLSH
T122E09298EDC6C25DED2435824364574FD2D83442D6C6AE072705ECE17702081E2415BA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 86b68bb58cb7365f9badbd995b43db40f530cd7b14a815f2ffca0f75030827a7
MD5 f750c48ebfcc7904f2cb3ea5a57cabf0
SHA1 c84f55612ffe717a58d327191a8a38e1cc508bcc
SHA512 f26b6388be54465c8d64de8144e5276e72e4a2ccd6906c8af4db53a9810f680f9c31242b13004b0745a45a00c855b56f22dd95defb0919b05a0414259a4d3da4
TLSH
T156E0D898A8C7C21DD920359641A46B4891D63442E7C6AD0717078CD07703801F7529F6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 847ea158551ff1bc11de27219bacd442b1e0869f5e4d1063744c2276d3726b49
MD5 f61bb7c119b7eda61208fa0d99139ccd
SHA1 1294a3de4c977472fbd8cae4952ee77fae6ec102
SHA512 232de52071e737feed6db2b4088383d5415e4a403fd56f9524f1e7f1fde8cf41c5fe2338d59b1202db0be0825956f1622c9843b86af6ce6c2f5b80d47eccc65f
TLSH
T146E026A854CAC269D4246DE78678534DD2E0340AB3C8B90A6F0B8870A381641B3A73F2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5768389ef8f2eaa23b34e291bde290f5251e91c531e1e95f2365434ba5a0a0ba
MD5 159a35f327eff30ccbef156f5dda28ef
SHA1 44b84c9d87fd542fc35694cb17a5b6c615191579
SHA512 7d69bf1ba83ce4bdb6d447aabd3f77984cfba010039c8f7312fde6604ab0c14700ec7c93e6ccd9b6fc772efcaa40fd4cc0ef0562b0efa30859f34c6098a9d190
TLSH
T1B7E0865859CAC629D4347DD382B8534AD2E53846A6C9F907170BACB16701E45A3A63F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 8ed578cfe7b6260f38464670cb2a30dba58810598820cff75724df37eca98d11
MD5 61ee5c20cb68b955f538c0d9375dc239
SHA1 5987931e9e2bfc69fd0585af1ba0428d6731d634
SHA512 f71fe0cbc41efb0b83c94aaea1eb4630aa17ade1ae21259c5151e67e27e1e8a7c4f13588078e258d760b2ebd82150b4731978ac066f9a742be1141d727290f41
TLSH
T1FFE0D86899CEC22DE624234742286749D3F13847D7C8AE055B0ABD51B205104B3861F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 fde10c23ce25d19dbfbc3585674f906255970b326a136ee0249e9c6f626de2b3
MD5 eda618c592b3d7aca2471ca9731c5d0c
SHA1 174ef8b53089fdfaf0c7c4eaa5a35698ef087b9a
SHA512 7b998e7f6138d78e2f22fd4e248dd208a444f436d34319a598a25de8c2ff582a746b3fc0f749117d187767a2410fc858e57a3bd17486c8e9c154a4ecfa5ccda0
TLSH
T1E5E0D86494DEC359E615219B42586748D7F03456F7C8AA069B0D9952B785004F3821F2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 00d8e094c40db08c139f635fd6009d239fc630800f49a88e9751a77e266e019b
MD5 7021bde0bfb4d23160ff2fa5a88f0240
SHA1 a9189fa3f0801cee03d2f0c8fda87fb924be0084
SHA512 93a15a38cdc47a8bc8a12b1cec3db3d90b5d5505719b7501a8d606e51924dca4b47105acfab00891724caf140d9a199670fc6a4e89186c8c572d2765f34faef5
SSDEEP 96:sa2jviEDWb0scdb9t7dHW+i046W6hfuH9EOx+WVoMfm+uecpYQjc0D67wVwUhgNr:sxTugs2xrpMHW6+WNGYOVxhgF
TLSH
T133F1BA566E28697B4CCBE11EFA267B53E2F5503275C5194CEBFC861C049B6CD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1534c374e9ba6a3f764627943cc557ebed8d87e6d6d8694c43564ca9738b93da
MD5 02d47bba650e92e4679394bcb76b0af9
SHA1 445c8e180551a989772093a6666c474cd25d664c
SHA512 84f689c8cb4831f803c17168ce60f03bdbcbd24b41efe2ba6596f535dd8ec886d53f78babbf3e4a3687af333779098058a1c85a2dfd95a1a4a4ef63a89a2499b
SSDEEP 96:sa2jviEDWb0scdbDt7dHW+i046W6hfuH9EOx+WVoMfm+uecpYQjc0D67wqWwUhgF:sxTugsMxrpMHW6+WNGYOqWxhgF
TLSH
T10CF1C9566E28597B4CCBD11EFA267B53E2FA502275C5194CEBFC8A1C04DB6CD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 36cc6cf1c21c1c9f142f8fd7ea91f4e29fe1e5f533e535ce00466c06a6bdaa21
MD5 5ddf17f87fddd57aa80032d3bb6c6f2e
SHA1 21f32388887f8462f487e0fd00af0a9aad1535b5
SHA512 d23840d2fbd55d04e9168b3c91911319124dd1fff9c275b768f38bff0fd6f05a392836dbe419b29376084df13d67393c6d38265873d8ac976a353563e2f45322
SSDEEP 768:JHqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKdmrosf:JHqbUj+WvSCs6u1jaaZLbWddsf
TLSH
T1A4C2E83F240CCA7E4FC01E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 3ec46f2ed029d18ad6f4de1750d51cefa4d5a9615933113e28eba5b4f495c723
MD5 b56409d419b76bb3449cbbf3cf1182e9
SHA1 0c08c03e8cceca43c19cd114c5a7d6217987fea2
SHA512 fae89f21d5eb24201ccd5baa8e00915bcc3c737598ae23bdc608d3cf5dc4d31f4d156bd97efd2996d46bdccae89547577ba9e871d43e4199134fb6099b76683d
TLSH
T1F1E0DF9855CAC2B9F125766302288348A2E87407F3C8B9066F029AE6A782605B2931F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 7976f02a067387bfefac869f34a8773d2ffa3505fe294fe76e20c1d5a2aa30d4
MD5 6223d4762afd6abe9965b0dae0d2e1c1
SHA1 1a9b93701ebf6c20d3d5b4252c07c0623ae1f21f
SHA512 ba22af357b11ade946553d39433b25f1c6717137362442d4515b4b75abbeceba3a9e19da78eb33a7f0573dddafcb7e666e70f27a4f9334744eaa75e54bbfede4
TLSH
T136E0DF2456CAC279E03532870234834AE2E8B50BD2C8B9072F02AE606742D05B2A31B2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 be3239cec5ab979552382a0627952d4a6c19b27713e536066a7824b6c9cff289
MD5 e97cd13f4aa3e5a4a818c7dd040faa79
SHA1 7458db70355e05c9c0acd38de6723a51566ab30e
SHA512 202a9fd294795d2f6255c69339484d289ee53d7c1031510b8b781b808a1fda37f4e48858a65e9f840a70cbfbcec19de214c5e040e741caf6eed155cc30c13196
TLSH
T1EEE0D86466CAC73AE56B718B4224D749D1F67406D7DC69162B0EB8506306940B3B71F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 1de30d916c9f861c8a8ebbf56b2ff0cd210eb11fd3a4d8bbe8c4558b237bf83b
MD5 c70e3f1bbdd78d80e954484e52e64993
SHA1 bbb9d54a6695e13f81a572c2dbdb346f3dee86ea
SHA512 73cc7a9d93b5b36b327ff37180b676153bfb6788423d0a3dd4ea871b43c591a675215ae4c9eee35c9a305706d8ec7ef4472f7b68a3ee4064ba104320407a226c
TLSH
T1F7E0D86866CEC36AE15522A74228D34CD2F27406F7C8A9156F09A551638618073431F0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 194B
SHA256 f9a497be96dcab58091e4d5d2389fea3cf4fbde7f8e2e4abac7010cb35ca84ef
MD5 b3b74961bff7ab9fc0f4f3a57f637184
SHA1 1f77ba6e313bc4c498df1c7c4157d79e3df685bd
SHA512 7cedf227788ff68e18579e70187c3dff712652063f322be6eba969f768f719ae9ee7b52c721ce92b7717c29c7e58e480a8739cf862cef123b87ff0b11ebf3c2c
TLSH
T14AC04CD55A903023FDCA59390DAB53041B20C4752F74CE57D28430901C0A285FE61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 9a14ae6ea9da96265309ee5c8aeb7a5b227ace7906da03b781fbf5a893b5fad4
MD5 2d6e0b0651a1bcf8695ee93ceb0a83f5
SHA1 12b17598dd2c47c5be951a212624cf9d28d54bba
SHA512 54fbacd9f2b955259478f60ae3e9dfcae377234f2cf73b532355c5c568b7fd691f5b2459ac24606c22e6d157d4dbe3d62aeead224a57b81c1fd89eed5a12cba5
TLSH
T177E02078E6D5C739D5147AC34278974F92F27806D7C439475709A854630250473751F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d19e4b8a82e1ed03cede99adfeb904871104daccb28691f5841bbe615387e290
MD5 df77eebe57e8dd35c82fe7e40e98a620
SHA1 254da7bd89021f70791758483cf9a300b8258760
SHA512 1629120b62e9bc25416eee7962229f73e89e69c3bb4dd26813f0f70e005b68e9407643ded85d8291473b8f57cc1e68539da8b611c939d27b4b618df2de4d3539
TLSH
T1B8E07D7C96CAC779D450619B42649B4DD2F07C0BF3C8BA0A5F084C62B341190F3A72F0
MD5 SHA1 SHA512 TLSH

Submit Download

bb5cddfe-0030-42c8-a295-2b8578e04b8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb5cddfe-0030-42c8-a295-2b8578e04b8e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c6e527300cf59049d46f9708f64045458067f6444676fb60cf8359043a8a7b7a
MD5 20f7219b7cbe40a20aa7a99341803142
SHA1 11a7dc3aae99508b0829eecd7966206bcabe8360
SHA512 3d3c5f6184fec77b0b10f810f80b7b4b921c8e407bb234d1fcbc556e1bc61cae0f2e850e3e26b5965955ec82ac10d1a6aedc5145e23cc8f7e92e850873a22cbf
TLSH
T17EE02064F4C5C29EE42429DB0134434DD2D43407FBC4690D6F02C474E38510077572F3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 d416bddf5c95a4f132f2c58504a7804da1d1ec60e8969187fa78ae2318caf72a
MD5 2b1facd38f1636b258fd2d88ebb9ed43
SHA1 65499c5c7a777c10924d0a9b0c8438a8aee003e8
SHA512 ae48380ad3a39c14c405d04aa8b08c12f47b5905010d934f42bfe33db50c5546b6cd0bcd77d7309abe30a0e6db50af17477e56508c9548b73bc1f637c1972b88
TLSH
T136E0D814A5C9C65EE42831870124438DD2D53403EAC4BA0A1B02D865AA0550073555B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0209ad171575d99c295d971ecd2e3385589804ed1a56e6eac024c13f2b046ad7
MD5 c607f36023c88906d7be75ade8d4c456
SHA1 b8d9d734d142f7397b6d4a3915c8e7524f6ec4d9
SHA512 e6677a2b401ed06a039e13558eb134653a311798c793100c45b2af0426711f3e1096e74bd431e17d96d1d566c719fa68f7173da745c0ea252f6f7af846cbf4fb
TLSH
T10321F55AF334C245E649467A143E6B511330D5069FF8EC0F04B620642E72A491D4F2E6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f33d0345a3729d87fc76489cf44271d617693bd35d9508e16109f2dcdc473b9a
MD5 6daa67924a4d90b510299bfb8d8cb24e
SHA1 2b205db739054c3b0515902ee58b746f4e829b03
SHA512 f5162dc9a3de1225e2d0cd624ed44a30c8d2e42acddb65a9000fc80d13a8f9bcf022febe5e61a7f57913cade396fdc0ca085d009c1bc26b80a759e0b2b6812b4
TLSH
T18521495AF334C145E549467A143E6B611330D506DFF8EC0F04B620652E73F050D4F2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 2b5e2c0bda14d389b86ddcfb0b4830191c617ecffe5820a31147e01097fe2d20
MD5 5646075fb0505aa20517cbd76c974388
SHA1 d531ff8026645fe69a35029ebf6fc613def40846
SHA512 0ef61702ecde669572f4e674096e354f91164d9308bfeff115052be190f651093b5caccebe528ddd8081987183434ccb691a46ac7b12020af113af54080bf73f
TLSH
T1A0E0D814B5C9C65FD0243183017483CDD2E63802EAC4BF061F02DD659B0554173565B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 c4fdcc344b79316752ea3fc4fb4b19a7b85dd464684b1a95bc042ac2ad2dda4a
MD5 6452b587cd941aac4f2cfd60d0bdc160
SHA1 f957b1312451bdb51867dc151cd4243fda438daf
SHA512 6dbd2e536b6ce38160b88b87777986c33acdeb3ccea77c1a065a56247ce1b108e6c213379b217f27b600ddf1677b8b751d040fe379bbcccaf933e77ce4630308
TLSH
T11FE0D864B4C5C29FD02029D70174938DD2E53806FBC46E096F028964938514177572B3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 5085758586423ab9a5b71fb6f58e91b13053b6ba0048cbaff33c41c62edc4bd7
MD5 6534ec4fdf21006a72e683280dca7980
SHA1 655e8c7b4ee45e7cdab31934d55f77848995cb85
SHA512 2211b7906ac1a14917770e36e19e9c7e030a1f9aaef7413e4a7a82d660a49eee902ff17c112e50b13d5de7291de5ee967f8fadc20035bc1009066f94304a4700
SSDEEP 192:zAsNL6DbivQmiUyQNwaEa+joOmw+4z5FaNmArqHlCUO:zAsNL66xdwaEa+UOH+MHfLCUO
TLSH
T18F12073A693C9C775CE66549F88736639F992073D84A6F95E6D84F0C00D764C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ffc2c0816f13176d6bf2b79e7a78339d8fed8b8707c23389bf8d6476e2046aa8
MD5 31d732dec0c20b8253d69ec48ee02a43
SHA1 b79f5870fd51622b3a9575878100b3985a4790b3
SHA512 57dbbf558a675e0ed52b7f6e1a251b36fc25763cd4369c985ae9e8219a10d6102e80217038333d364f19e70da612633f30a54f4765932c34c61ea5e1ee8f5622
SSDEEP 192:zAsNL6DbivQmiUyVNwaEa+joOmw+4z5FaNmArqHlCUO:zAsNL66xEwaEa+UOH+MHfLCUO
TLSH
T14912173A683C9C775CE6A549F88736679FA92073D84A6F95E6D84F0C00D764C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2ca6c2ad9c34634c61520a811dc4e539b080a97d59643e7d0757d708380d77a8
MD5 976dc3e5a8c4a10312cd910b6ea875d7
SHA1 1c6c180b1f95fb4995033edc362c68a7b7727bfb
SHA512 e1d487f9b1731c722665c1f8f957cec3035c649d0f3be72c11d7f455549933ae3da146a7c84c6071c25aaceca8dbed493ba33a9b56d57711a5e87cd500bd721b
SSDEEP 192:zAsND6DbivQmiUyoNwaEa+joOmw+4z5FakHHrqpbUO:zAsND66x1waEa+UOH+MHxyUO
TLSH
T1C812E83A693C5C779EE26E55F8873A279F951067D9862E95EAD81F0C00C764C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 849999611e431f0ea9b329f8b1a47bb21057e35f4fa8bdb6362aa3abcba5c044
MD5 4bced2ba0e2f797143cbb623f34e550b
SHA1 615a17b9cfa42dc2c04244aa16580a2f4304292c
SHA512 fadf82e91d9c95381df69c0ddaf66ccd49101cd1a3e53cd7d5aebebc13d511544efd00b123ec31eff2940a984371efa99b2f808c0d62ef4959a5fd3f16798388
SSDEEP 192:zAsND6DbivQmiUyoNwaEa+joOmw+4z5FakHorqpbUO:zAsND66x1waEa+UOH+MHx/UO
TLSH
T19012E83A693C5CB79EE26E55F8873A279F951067D9862E95EAD81F0C00C764C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7985401636335a230304ee67912833e81f4460786e20490f83703056a08022b1
MD5 11a28a423685c7cb9eac10942f5bbab6
SHA1 0709c77db49e8bf7fbd60a0e7e9d7d0088a19d65
SHA512 579a38d22dd662bf45e757bfef27870c0e85defbdb7d13545185ee87cc2f1159861d523e040a357e0a5b3084c28f4356792250f433e192de192b873099949b30
SSDEEP 192:zAsNX6DbivQmiUyuNwaEa+joOmw+4z5FaPIsrqp3UO:zAsNX66x/waEa+UOH+MHv3UO
TLSH
T19912F93A693C5CB79DE26E46F8873A279FD52067D5862F95EAD81F0C00D764C230A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d6ebe5f61ec3417ba7fa5108e9f89f6dad29f69bfdb11267a1d842ec63b2d57
MD5 aeb21d97320415a0e336c793fc0c74a0
SHA1 ce357bc1974e777db1356b673296545012a28bf9
SHA512 921f5b06ad2aa6de753edd1f490dcd17fb1464819add54a02b240c4437afb19491465c36eed8480c156b82c236c197fe09fbaaaf35c8a083b0928de187fa14fa
SSDEEP 192:vONJ6Db6QmiUyzNzHBa+joOmw+4sRg2wCU6:vONJ6u0zHBa+UOH+W2XU6
TLSH
T18B02D839697C6CB79EA26E49F88B37279F94203BD9966B94D6D81F0C00D764C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2c97fc7502b2d4f2540291b1303f28c8c05cf07c9b988844f964317ed1f7402
MD5 064629e1b936ab82a4bfbe12b6b7c42a
SHA1 5b9f241c2fc05b03df9d803f5c3e2269bdb56c3f
SHA512 f8d90d7b4629c9b281cea98111a0cb05365298d24cf938c68b4597cabc9705e6b0ab638d205224e2f4ab180137066c3cf18c42576fce22bba27513c7e903bc11
SSDEEP 192:oONK6DbpQmiUy1NzaBa+joOmw+4z5FaNz21rqHlCU6:oONK6fMzaBa+UOH+MHO2wCU6
TLSH
T1BF120739683C9C771DE2A549F8C736A79F992077DC866F95E2D84F0C04D7A4C270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

7d9e8c9c-90cc-48fa-82be-4cab36753c58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d9e8c9c-90cc-48fa-82be-4cab36753c58.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

OFL-PlusJakartaSans.txt

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\OFL-PlusJakartaSans.txt
Size 4KB
SHA256 995c7199cab65954f545996326755daee7b63cc6b42b06c13da1f9502ab08a99
MD5 028e355944f58645eb2a8d190e6b24f6
SHA1 06a13446af986261b9604de9c012035fd95b193d
SHA512 3167472583c4301d1de3369dd9021187dcdb331daeb1a28be89270f44d753f56ff453be3918e8ed82cae92692f6476efda8c3108e3435170a82491beb09697d0
SSDEEP 96:snPUibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:TsMPZW88f+XvR9QHtE
TLSH
T13991D92A3F4423B519C0D242F737E9DEE21A517D33AB69C9505AC16C23A6D2C03FE390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-Bold.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Bold.ttf
Size 129KB
SHA256 14972f80fb151f32fb7129c6ad1893f6dd2a9d8bac30c40508c99e7f289b6682
MD5 1c51d1fb8daa95760a726496b2c5efd7
SHA1 9ea84454ec3da3a53230f846f2f21f284540ab3c
SHA512 ca056108693bec764a70644648539656d1245918ac1932d2c521a1e0fc900892416b85a65582dac4ea1f85fe27d2e9b027989ad98ec6dd0858a30271b8a899c9
SSDEEP 3072:dhXdj8wQ5IrWAZpy/kgkvL//wzIbQLKFisOmmXYUAiFHAvnFK4:dVdIZ5IrWkp3/z24
TLSH
T1E9D33B56BB17D38EEE162D7891F5EBC47338F9583E29C24F94E52E2DA8560D00C272D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-Regular.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Regular.ttf
Size 128KB
SHA256 6bcfbb10639b8a206b4f8a0a1a29459e7255b1481c95e20d587dd1f1a4b24646
MD5 086a38d660fc107d0a20aa9a91979237
SHA1 c0ba4d6c0f708c739f5b69be136e7306ccc4f61c
SHA512 991ce1891178d37526e5a9bf8ac488ee0cec1ad4df997819c5dea0e03b5a98f2ea89e4d5f5e5e65579d419d2e9470d98c7c2db6f44f97160eca7ea745ef71d66
SSDEEP 3072:WhXdjqsJwWk4SBeoPNFQvQvOfEDIwzIbQLKFisOmmXYUAiFHAvntb7:WVdWsJwWk4EeoPNWfEDGP7
TLSH
T1DED33B23FB5BD38EDE111D388175E3D83B29FA65AB36C24794B46F6CA85B0D00C57298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-SemiBold.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-SemiBold.ttf
Size 129KB
SHA256 de75ddb3917c5a3f2b7d0cd65fcf63795710f2e1fd944199a73a01731e66fd43
MD5 94fe9cdf95a72756739bdf895abd57a5
SHA1 0e0454a943671b35d44c7c704299c6a09c9e0607
SHA512 f77f9a84c6aae68cd6fff197a277e258ea7f833d19fdf1d2b6d1ad970dd7d108d8028e75951d69fed4afef12efc8829f792d79d23d148bd8801f476c5719c962
SSDEEP 3072:FuihXdjEWQBjlNp8b9rXbKyOmOv/DxuQtwzIbQLKFisOmmXYUAiFHAvnr2k:0iVdQWQBjlNp8b9rrWDx1Zn
TLSH
T1A2D34C26BB5BE38EEA073E7881B5B3D43329F9A11F29D20754752EACD85B1D00C533A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa-solid-900.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\fa-solid-900.ttf
Size 409KB
SHA256 fbbf06d7437aa30f3cd44c968380193545a8fc3eadfb7ad897bbb101eefec5a2
MD5 25914cfeafced317e1a0372187fbb2b9
SHA1 54217d79e7b35011798d712a96d1c4ea08a0ca70
SHA512 ee22fdcae2600a3ceb16f562ae88477ddf20b865aeba8f242400d3215ada4ad9b560aa2b84969c9da65f88c687564707f26f21f1452ffa11585e9e145d8454c5
SSDEEP 6144:Yma14LJlyQ0nqgBohapS3Asznhp+vvpt93aGqFHhjqYa89C:7Fly1WaAJrOvht1aBJZ280
TLSH
T15494F8D3B7DD9D06E42339784B405E0F2356A13882558226FF875AAEC5BE8E0C736F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iqavs3po.dwc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqavs3po.dwc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/332-7-0x0000018FB9560000-0x0000018FB9582000-memory.dmp

Download

memory/2200-90-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-82-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-81-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-80-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-92-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-91-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-89-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-88-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-87-0x0000021224010000-0x0000021224011000-memory.dmp

Download

memory/2200-86-0x0000021224010000-0x0000021224011000-memory.dmp

Download