Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://ts.bzzhr.to/...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    310s
  • max time network
    360s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    14/08/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://ts.bzzhr.to/d/iimft8js66zd?v=jcf_Bws5ne5wLOBWxpswH0hi1JjENP1tXrzLYuL5YOhjhalX_DB11j-oQa7OMaqPppjhZTYe9DQSwppJXDzMWGcWEWQzznWTpW6LpZ4R12h3yemYe3xkYlFyks6nU0FNB76ObmDqgwCO8ujS5ZA4UOm4PF5FKbU94yoydVTttU2rbId895nfPdJh_kE74UJLa-RLVDmK5flm2qf-GOCFHkdfal7LUWlySnYTKcQZtvHBwq5d4ROpuY1NJQxZfpio_A
  • Sample260814-ejs6zatzex
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 56 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ts.bzzhr.to/d/iimft8js66zd?v=jcf_Bws5ne5wLOBWxpswH0hi1JjENP1tXrzLYuL5YOhjhalX_DB11j-oQa7OMaqPppjhZTYe9DQSwppJXDzMWGcWEWQzznWTpW6LpZ4R12h3yemYe3xkYlFyks6nU0FNB76ObmDqgwCO8ujS5ZA4UOm4PF5FKbU94yoydVTttU2rbId895nfPdJh_kE74UJLa-RLVDmK5flm2qf-GOCFHkdfal7LUWlySnYTKcQZtvHBwq5d4ROpuY1NJQxZfpio_A
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5160
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ffef30ec188,0x7ffef30ec194,0x7ffef30ec1a0
      2⤵
        PID:2908
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15713856936577207743,17567830011943750781,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
        2⤵
        • System Time Discovery
        PID:2500
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,6930825565126435633,9390942565798446898,262144 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
        2⤵
          PID:4788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,5550389840453118528,9506732828550653493,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
          2⤵
            PID:4752
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9934170820668593579,11426792658868635383,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
            2⤵
              PID:4700
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3759904052194398459,1513072767355007332,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:3184
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1666373476771705331,13469926906996374006,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                2⤵
                  PID:1032
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,117410501692595867,6255294721992560760,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:9
                  2⤵
                    PID:3800
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4388,i,1572270303649252483,14843934788213724452,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
                    2⤵
                      PID:5064
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4492,i,4056518543403013737,16947201774174594878,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
                      2⤵
                        PID:3012
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,4612142299711412364,7547951883324922208,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
                        2⤵
                          PID:4068
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1737171599577305495,11467539202536586008,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                          2⤵
                            PID:2340
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6774713827093074824,390156191834789435,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
                            2⤵
                              PID:5360
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5860,i,14313189213993982086,15396008225956352134,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
                              2⤵
                                PID:5312
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,3955376803661323101,18173805755823775532,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5588
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1128
                                  3⤵
                                    PID:5524
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,13955220158334298905,10433754966854093342,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
                                  2⤵
                                    PID:5952
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,13955220158334298905,10433754966854093342,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
                                    2⤵
                                      PID:1616
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,8395740452617711619,3232192088898796898,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
                                      2⤵
                                        PID:4612
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,3170270262915735296,15686876674256338740,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                        2⤵
                                          PID:4956
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,14192076338474654108,11821473017957018356,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
                                          2⤵
                                            PID:3440
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5424,i,11718360562135639476,13751866338607762463,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
                                            2⤵
                                              PID:6060
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,1650216504634908382,5463805004987184914,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
                                              2⤵
                                                PID:2104
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6028,i,13358859917880899154,15498229558939795637,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
                                                2⤵
                                                  PID:4552
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6044,i,4590312410800257907,3318940783413901610,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
                                                  2⤵
                                                    PID:3472
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6052,i,16183402458520403729,786122689454316606,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
                                                    2⤵
                                                      PID:1696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5740093462290067767,6577078730164220238,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
                                                      2⤵
                                                        PID:1584
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10495861978030422279,16804110255714355470,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
                                                        2⤵
                                                          PID:5484
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,9390889388448461844,2929959487986525054,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
                                                          2⤵
                                                          • NTFS ADS
                                                          PID:5072
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,9108013222504739308,5974377076911687943,262144 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:10
                                                          2⤵
                                                            PID:6052
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1401062741563843767,17867555369257627036,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
                                                            2⤵
                                                              PID:5596
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,17053684183028082140,14481213496615390735,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
                                                              2⤵
                                                                PID:4924
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,8453858627886574301,6941908888362284252,524288 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
                                                                2⤵
                                                                  PID:3980
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4408,i,16243399034173738274,11500460636551809555,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
                                                                  2⤵
                                                                    PID:4424
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5116,i,12471956675993005029,5531260925954188250,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
                                                                    2⤵
                                                                      PID:2640
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=2780,i,9363848283572619291,10819064007962102471,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:1
                                                                      2⤵
                                                                        PID:1004
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7060,i,4479234834372476795,5159103710134960094,2097152 --field-trial-handle=2020,i,1256215618179261247,2611589409934946939,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
                                                                        2⤵
                                                                          PID:5624
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                        1⤵
                                                                          PID:5024
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          "C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260814-0459.dmp
                                                                          1⤵
                                                                            PID:4912
                                                                          • C:\Windows\system32\werfault.exe
                                                                            werfault.exe /hc /shared Global\c412225270444d51936c7b6083daacf4 /t 3676 /p 3608
                                                                            1⤵
                                                                              PID:2944
                                                                            • C:\Windows\System32\rundll32.exe
                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                              1⤵
                                                                                PID:1608
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                1⤵
                                                                                • Enumerates system info in registry
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2860
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                1⤵
                                                                                  PID:5360
                                                                                • C:\Program Files\7-Zip\7zG.exe
                                                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BorisFX Sapphire 2026.0 - Win - Keyflame\" -ad -an -ai#7zMap14888:140:7zEvent15647
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2008
                                                                                • C:\Users\Admin\Downloads\BorisFX Sapphire 2026.0 - Win - Keyflame\BorisFX Sapphire AE 2026 0\BorisFX Sapphire AE 2026.exe
                                                                                  "C:\Users\Admin\Downloads\BorisFX Sapphire 2026.0 - Win - Keyflame\BorisFX Sapphire AE 2026 0\BorisFX Sapphire AE 2026.exe"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4880
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-JSCOE.tmp\BorisFX Sapphire AE 2026.tmp
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-JSCOE.tmp\BorisFX Sapphire AE 2026.tmp" /SL5="$10023E,1464618932,917504,C:\Users\Admin\Downloads\BorisFX Sapphire 2026.0 - Win - Keyflame\BorisFX Sapphire AE 2026 0\BorisFX Sapphire AE 2026.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops desktop.ini file(s)
                                                                                    • Drops file in Program Files directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1820
                                                                                    • C:\Windows\system32\net.exe
                                                                                      "C:\Windows\system32\net.exe" stop RLM-BorisFX
                                                                                      3⤵
                                                                                        PID:5052
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          C:\Windows\system32\net1 stop RLM-BorisFX
                                                                                          4⤵
                                                                                            PID:844
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          "cmd.exe" /c rmdir /s /q "C:\Program Files\BorisFX\Sapphire 2026 Adobe\lensflares"
                                                                                          3⤵
                                                                                            PID:2308
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            "cmd.exe" /c mklink /D "C:\Program Files\BorisFX\Sapphire 2026 Adobe\lensflares" "C:\ProgramData\BorisFX\Sapphire\lensflares\GenArts"
                                                                                            3⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:5132
                                                                                      • C:\Windows\system32\sihost.exe
                                                                                        sihost.exe
                                                                                        1⤵
                                                                                          PID:2988
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                            2⤵
                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                            • Enumerates connected drives
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3244
                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                          1⤵
                                                                                            PID:4604
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3840

                                                                                            Network

                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  is-AD7GN.tmp
                                                                                                  • Path C:\Program Files\BorisFX\Sapphire 2026 Adobe\help-dialog\is-AD7GN.tmp
                                                                                                  • Size 62KB
                                                                                                  • SHA256 ac241109a82d2474396ce96dfe3b0700002a7a2a0ddc0bfd2bba9f271e38ec90
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-M8QTH.tmp
                                                                                                  • Path C:\Program Files\BorisFX\Sapphire 2026 Adobe\is-M8QTH.tmp
                                                                                                  • Size 9KB
                                                                                                  • SHA256 3251ed5538f47a42d39cdaad216ff240c0b01d33e76d22252ed638048ea92e8b
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-1T37Q.tmp
                                                                                                  • Path C:\Program Files\BorisFX\Sapphire 2026 Adobe\lib64\Mocha Sapphire.app\resources\ocio\default\luts\is-1T37Q.tmp
                                                                                                  • Size 92KB
                                                                                                  • SHA256 cca228596b733b0c6815b33da62c6714d75c38e1514a3a548e1866c9a9373377
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-M69TG.tmp
                                                                                                  • Path C:\Program Files\BorisFX\Sapphire 2026 Adobe\pylib\is-M69TG.tmp
                                                                                                  • Size 76KB
                                                                                                  • SHA256 15759264bff82498f9ebf50f1ad6023b4e7df07f594dfeeaf692b609d61d91f8
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-TAH4L.tmp
                                                                                                  • Path C:\Program Files\BorisFX\Sapphire 2026 Adobe\pylib\is-TAH4L.tmp
                                                                                                  • Size 66KB
                                                                                                  • SHA256 895e59cb8de51691843180f52e652706d00c4e7154b6a58081853fc1ddcc7c1d
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-2R9MP.tmp
                                                                                                  • Path C:\ProgramData\BorisFX\Sapphire\Sapphire\presets\GenArts\is-2R9MP.tmp
                                                                                                  • Size 76KB
                                                                                                  • SHA256 2e9445d3667de153f6a80c169a7d9d6ff02683801d084673a71bad5f54d3ad14
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-4JPCV.tmp
                                                                                                  • Path C:\ProgramData\BorisFX\Sapphire\Sapphire\presets\GenArts\is-4JPCV.tmp
                                                                                                  • Size 68KB
                                                                                                  • SHA256 32e1f0db096286494a307f21c84ab39da8808e4e2434e74a45fb07dcb1d4647e
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  is-7Q0J7.tmp
                                                                                                  • Path C:\ProgramData\BorisFX\Sapphire\Sapphire\presets\GenArts\is-7Q0J7.tmp
                                                                                                  • Size 70KB
                                                                                                  • SHA256 14d598ffadf8b21545b07bb22b53f49347a908eb1e2b8e4bfccc776efc0b589a
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Sapphire AE Configuration Editor 2026.lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Sapphire AE Configuration Editor 2026.lnk
                                                                                                  • Size 2KB
                                                                                                  • SHA256 ff19c60209b249eacefc047590586fde801217da3a403fb1c82b8fa7d6051469
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Sapphire AE Effect Builder 2026.lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Sapphire AE Effect Builder 2026.lnk
                                                                                                  • Size 2KB
                                                                                                  • SHA256 dd97d26d6de3b938b5503abb9dfa70987f864eb959fac4401ad5d5885a715af9
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Sapphire AE Flare Designer 2026.lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Sapphire AE Flare Designer 2026.lnk
                                                                                                  • Size 2KB
                                                                                                  • SHA256 6dacb141cd0a2f48ed65566288691d3bced4a5d09f15f9a9f7dd42299ee79eae
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Sapphire AE Online Help 2026 (HTML).lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Sapphire AE Online Help 2026 (HTML).lnk
                                                                                                  • Size 1KB
                                                                                                  • SHA256 e0ff167a7ccc1ecf94374e5944b6b4c90991f3dd20d6a9455bec909e8abad5b5
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Sapphire AE Online Help 2026 (PDF).lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Sapphire AE Online Help 2026 (PDF).lnk
                                                                                                  • Size 1KB
                                                                                                  • SHA256 ea7fa4358c0356605aa866079747991479ecdd5017e9c55cf12b782ca2199f18
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Uninstall Sapphire AE 2026.lnk
                                                                                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boris FX Sapphire 2026 Adobe\Uninstall Sapphire AE 2026.lnk
                                                                                                  • Size 1KB
                                                                                                  • SHA256 26518111d977312f95d09471f9c61baaf7685eaa680dd8367d4458da48807948
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  blocklist
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                  • Size 105KB
                                                                                                  • SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  settings.dat
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  • Size 280B
                                                                                                  • SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  settings.dat
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  • Size 280B
                                                                                                  • SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  LOG.old
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                  • Size 334B
                                                                                                  • SHA256 d2549dccbfc934a201564448d29d077eae252c6b72c9072b8deaeca1ef98c68b
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                  • Size 6B
                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  the-real-index
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  • Size 3KB
                                                                                                  • SHA256 9a4e567b62ef541b3af5727a4f75678af3a66e24ea72d02946511fa49ff7d5d2
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  the-real-index~RFe585b0c.TMP
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585b0c.TMP
                                                                                                  • Size 3KB
                                                                                                  • SHA256 1f0fa720ebcf3fba37a292e4d7abdabd1d3bc879f3edc11f16405bb7eb5a5f81
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  SiteList-Enterprise.json
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                  • Size 2B
                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  Edge Profile.ico
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                  • Size 70KB
                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Network Persistent State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  • Size 1KB
                                                                                                  • SHA256 a7cb75188b470abf465893f63f3a2785a6ef4552031c76d6eb488f9659da7142
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Network Persistent State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                  • Size 111B
                                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  SCT Auditing Pending Reports
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                  • Size 2B
                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  Preferences
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  • Size 12KB
                                                                                                  • SHA256 2a58f4a30b429e20dbf731b2a5f4b5e69dc8e08ed954a08fa47e6250b13a00a3
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Preferences
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  • Size 14KB
                                                                                                  • SHA256 f427e7859642ac5f82c93ec6ed4f28b447f280cdd182009c380747de0d07c3d9
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Preferences
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  • Size 13KB
                                                                                                  • SHA256 7f3d58829bf4165763f1808662b86252dee325b5b0c46b15e47ef209a2f367d2
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Preferences
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  • Size 12KB
                                                                                                  • SHA256 3eb5e4dcbd1fe2b84eb5bc08ab5b6a761f9bb39b98c88dc4e0b275209a60ea70
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Secure Preferences
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                  • Size 31KB
                                                                                                  • SHA256 e6793b21e93d94c9976f6aa200a72436e54f07f5051f38833acc73112d2b7487
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  sync_diagnostic.log
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                  • Size 7KB
                                                                                                  • SHA256 48f830f0d58e61fc57ec2f4122b2050757717a84ef901f407592857600d0b33a
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  OperationConfig
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                  • Size 22KB
                                                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  OperationConfig~RFe58f7a9.TMP
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f7a9.TMP
                                                                                                  • Size 3KB
                                                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 11KB
                                                                                                  • SHA256 09d4bc502172a7a057fda6e4162eb47875b290d57799fe0d15f14b14dad8b9f7
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 23KB
                                                                                                  • SHA256 4416cb892ad3e21d8719b1508f4beea56d51cf3c8c25c82c6682f6c59519419b
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 22KB
                                                                                                  • SHA256 b58b89379864255cde90c60aa1a081b7e89173c6df44473ebb4dc5082f04104c
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 12KB
                                                                                                  • SHA256 f2ba722d258db7eed43512a1bf38df017479183007d7e4848e96f8e9029105ba
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 11KB
                                                                                                  • SHA256 c63bb045f301aced0f9a1a93bb135371dd907a15c63397aba3b24350c58eb8e0
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 12KB
                                                                                                  • SHA256 3db7d24755e39a2b397d3d87de128ac5b5d0faec1ba4a32589802aa4caa1d208
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 8KB
                                                                                                  • SHA256 0f7ac1d19cb4db7fe48475136d4a48f640804d09b85654d2e38ed967704dbcfa
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 20KB
                                                                                                  • SHA256 110f8e169d9c1d7eee4b2d7cb5b51473fac1b45ff692c09c34e42757ebcb188f
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Local State
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  • Size 8KB
                                                                                                  • SHA256 f4a0e659539131d0555088b60ca4dc10614c096653fea4c89d31fa657c353181
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  47e50c73-c3f6-421e-91e8-ae57b01889fe.tmp
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47e50c73-c3f6-421e-91e8-ae57b01889fe.tmp
                                                                                                  • Size 13B
                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  www.bing[1].xml
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\C8JJXACA\www.bing[1].xml
                                                                                                  • Size 133B
                                                                                                  • SHA256 a3ddc18591925c4130f57e93ab21fa8cb1767c7ed72cca7acced1cdf07d8e0b4
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  www.bing[1].xml
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\C8JJXACA\www.bing[1].xml
                                                                                                  • Size 11KB
                                                                                                  • SHA256 2ab2931381c4aa1ce61d757f6cf4fe1329961f8c3a9666a4b0fdacfbc8594259
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Zrtu2hQ08VU_1.bytecode
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\5F7B31A6-C939-4B2B-B8AA-553307ADA5FE\Zrtu2hQ08VU_1.bytecode
                                                                                                  • Size 136KB
                                                                                                  • SHA256 f7a78d2cdcd9c6a659cc2cf70cb59f1d9ded7617372f6f0bc47fce0f2ccaa456
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Zrtu2hQ08VU_1.metadata
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\5F7B31A6-C939-4B2B-B8AA-553307ADA5FE\Zrtu2hQ08VU_1.metadata
                                                                                                  • Size 192B
                                                                                                  • SHA256 7de8dd887c8b8c0e03c6acf3d25da7e36246a150ab3f6a57e71d0f88f11ee6ad
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js
                                                                                                  • Size 1KB
                                                                                                  • SHA256 25fb7bf394d8d314dbc01f3c4b85f20dd82e9feb70c3e8f5129eeb7ebd478352
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  JeCqhfudDT5jqgZAez_E1lIkDPk.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\JeCqhfudDT5jqgZAez_E1lIkDPk.br[1].js
                                                                                                  • Size 297KB
                                                                                                  • SHA256 294cbf05a92f6b0be3cd33dc877e005907d966417540bb2f1a13ed59a5677325
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  NCBKPxK3CYivs-rIJek293npJlE.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\NCBKPxK3CYivs-rIJek293npJlE.br[1].js
                                                                                                  • Size 396KB
                                                                                                  • SHA256 8fe9cbbfa5284f9dab04f490dae4223e9847d58a4d29020d9fe16c8a4e2b2a3c
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  T4mBEGsyNb6pBf2K5IRNTZSelG0.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\T4mBEGsyNb6pBf2K5IRNTZSelG0.br[1].js
                                                                                                  • Size 62KB
                                                                                                  • SHA256 c60d752763af5762c3d76e8b164fc149cbd39b5d7ab4756b35bf044565c9ffcf
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  ULhL7TFAv-kC5wKIeLRTYnOFkoQ.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\ULhL7TFAv-kC5wKIeLRTYnOFkoQ.br[1].js
                                                                                                  • Size 54KB
                                                                                                  • SHA256 59e66d752e5bdc9100b8f68cdb9e454c47fe82d4ecfa363e98e58fb89accb347
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  dDM2XMU5pvrKZt9KLb_VAVPBoq4.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\dDM2XMU5pvrKZt9KLb_VAVPBoq4.br[1].js
                                                                                                  • Size 80KB
                                                                                                  • SHA256 d7a3e337c94d193fb849462be52f2d2bb47726cfb375125e13c00659c372afea
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  kKDH_Zwhs7fhB09C7rXcLKAhJEE.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\kKDH_Zwhs7fhB09C7rXcLKAhJEE.br[1].js
                                                                                                  • Size 100KB
                                                                                                  • SHA256 cc8695861560c3b76b4535b9a14057746e078d8f3a8135a53ea2d3bf6a8968a6
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  t7yyUu5fmN505pfncaghxG6U5O8.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\t7yyUu5fmN505pfncaghxG6U5O8.br[1].js
                                                                                                  • Size 102KB
                                                                                                  • SHA256 923caf4db82ccfeee11d2aaf2bd04fe213b2ea964c6979a3a0c012cef188fdca
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  v4byIDUEty_wAUBG409UBZa9Wic.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\B3JUN3A8\v4byIDUEty_wAUBG409UBZa9Wic.br[1].js
                                                                                                  • Size 29KB
                                                                                                  • SHA256 4fb3e33d494e2653790197d1cdb2b99af7b3bc0edad09f6587a99cc1912a1d3d
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  3CXzOctRkkq39HinuD99Ne6QTy4.br[1].css
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\3CXzOctRkkq39HinuD99Ne6QTy4.br[1].css
                                                                                                  • Size 315KB
                                                                                                  • SHA256 842189dd86c9bf800ab74646b64ef6670e26c949892aad1a67fd89ad052b2ee7
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  8qgG5W3ncSQFlIRNEJkTkEx2-PA[1].css
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\8qgG5W3ncSQFlIRNEJkTkEx2-PA[1].css
                                                                                                  • Size 2KB
                                                                                                  • SHA256 63adaaa1d69f790d5d7ab4b89046ef1553b19b7bde8b8d108a4c2fe0295c3819
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js
                                                                                                  • Size 20KB
                                                                                                  • SHA256 38edf0f961c1ccb287880b88f12f370775fc65b2e28227eee215e849cdbe9bbc
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  DKsE3SyhVIjZH9mpM4Nc3LQ7l5I[1].css
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\DKsE3SyhVIjZH9mpM4Nc3LQ7l5I[1].css
                                                                                                  • Size 15KB
                                                                                                  • SHA256 fcee9301e6c08f566ed9a3812a525a4b7177cc66406f64d8ca10eb59b3394768
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  GZM6Qex0i_1GLvsFeiXPnqmU7o8.br[1].css
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\GZM6Qex0i_1GLvsFeiXPnqmU7o8.br[1].css
                                                                                                  • Size 323KB
                                                                                                  • SHA256 9c6bdf1eb811f2ca8672e177a885a2c5e34707e158ecb3a7af3f3131ef51d37d
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  WX9O23KevnUEq_dyoCNlvDdZFDw.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\K3CELKOX\WX9O23KevnUEq_dyoCNlvDdZFDw.br[1].js
                                                                                                  • Size 7KB
                                                                                                  • SHA256 a744bc789aa33f11acbc4ee100c817a977be040e914f72a6dceec955caa433ab
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  jmA3BASGGQP6fujXEHFHx-dppZU.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\Q3B0S0W5\jmA3BASGGQP6fujXEHFHx-dppZU.br[1].js
                                                                                                  • Size 135KB
                                                                                                  • SHA256 5fc03d527d1baca4bb9aa5785d6ac2c480fa298d5780df148b6ede80eebd8356
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  pDwvLkUFstEF3TLqd2P5V7buRhI.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\Q3B0S0W5\pDwvLkUFstEF3TLqd2P5V7buRhI.br[1].js
                                                                                                  • Size 1KB
                                                                                                  • SHA256 1586c957e99af271c2f866ca5dd76c4a2c6d3bec1d4e6e471bbe7f5290bcbfc3
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  YPhtXVohQtjhx_9FkpA5fZTyWLA.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\X1ES3H3M\YPhtXVohQtjhx_9FkpA5fZTyWLA.br[1].js
                                                                                                  • Size 131KB
                                                                                                  • SHA256 a598f44bb68f2bb7d28740f4a316a7054eb4394de1df0a81c23b08b2dfc76722
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  c22_DF4nWg85wYbuW_0PXnaGNSY.br[1].js
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\X1ES3H3M\c22_DF4nWg85wYbuW_0PXnaGNSY.br[1].js
                                                                                                  • Size 21KB
                                                                                                  • SHA256 8b38ee9572e2c44c0d9f62a84169f1a446b90181774f92f7c09dba9beb00dda7
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  BorisFX Sapphire AE 2026.tmp
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-JSCOE.tmp\BorisFX Sapphire AE 2026.tmp
                                                                                                  • Size 3.6MB
                                                                                                  • SHA256 211310a789a3fda80b3a99ffc64f2e6698c8951d7d1433a80bc9f5fe07ee6a48
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  BorisFX Sapphire 2026.0 - Win - Keyflame.7z:Zone.Identifier
                                                                                                  • Path C:\Users\Admin\Downloads\BorisFX Sapphire 2026.0 - Win - Keyflame.7z:Zone.Identifier
                                                                                                  • Size 331B
                                                                                                  • SHA256 3d1c28142b117ad12071d0bf1e1468daca792be337e6f8852002de720c97e776
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  memory/1820-2563-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2579-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-9224-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2591-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-5821-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2585-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-4717-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-18418-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2737-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-18411-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2581-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2583-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-2463-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1820-16070-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2860-325-0x0000022AAE340000-0x0000022AAE440000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2860-466-0x0000022BD3560000-0x0000022BD3660000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2860-376-0x0000022BC13B0000-0x0000022BC13D0000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2860-375-0x0000022BC13B0000-0x0000022BC13D0000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2860-326-0x0000022AAE340000-0x0000022AAE440000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3244-16920-0x000000000C3E0000-0x000000000D5E9000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3244-18420-0x000000000C3E0000-0x000000000D5E9000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3244-18489-0x000000000C3E0000-0x000000000D5E9000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3244-18539-0x000000000C3E0000-0x000000000D5E9000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4604-16209-0x0000014042B40000-0x0000014042B60000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4604-15915-0x0000014020650000-0x0000014020750000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4604-16568-0x00000141451D0000-0x00000141452D0000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4604-15946-0x00000140202A0000-0x00000140203A0000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4604-16182-0x0000014042BE0000-0x0000014042C00000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4880-578-0x0000000000400000-0x00000000004EE000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4880-18419-0x0000000000400000-0x00000000004EE000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4880-2422-0x0000000000400000-0x00000000004EE000-memory.dmp
                                                                                                  Download