Overview

overview

10

Static

static

1

anygo.exe

windows10-2004-x64

10

anygo.exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    anygo.exe
  • Size 101.0MB
  • Sample260826-gr57lsgq21
  • SHA256 24264e6186cb8c630737a989b9c5c1c685e40ee20da0e3e3ac60ad3a6f06c83b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealertrojanvmprotect

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
    defense_evasion
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 41 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 27 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\anygo.exe
    "C:\Users\Admin\AppData\Local\Temp\anygo.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\is-PT1OC.tmp\anygo.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PT1OC.tmp\anygo.tmp" /SL5="$70114,105162295,784384,C:\Users\Admin\AppData\Local\Temp\anygo.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im adb.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /t /im adb.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3252
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c tasklist | findstr "AnyGoW.exe" > "C:\Users\Admin\AppData\Local\Temp\findProcessRes.txt"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Discovers running processes
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4148
        • C:\Windows\SysWOW64\findstr.exe
          findstr "AnyGoW.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3528
      • C:\Program Files (x86)\AnyGo\AnyGoW.exe
        "C:\Program Files (x86)\AnyGo\AnyGoW.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Modifies system certificate store
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Program Files (x86)\AnyGo\QtWebEngineProcess.exe
          "C:\Program Files (x86)\AnyGo\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-gpu-compositing --service-pipe-token=4026585926241277896 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=4026585926241277896 --renderer-client-id=2 --mojo-platform-channel-handle=2652 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:540
        • C:\Program Files (x86)\AnyGo\apple driver\DPInst64.exe
          "C:\Program Files (x86)\AnyGo\apple driver\DPInst64.exe" /S /LM
          4⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:2256
        • C:\Program Files (x86)\AnyGo\AppleMobileDeviceProcess.exe
          "C:\Program Files (x86)\AnyGo\AppleMobileDeviceProcess.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2792
        • C:\Program Files (x86)\AnyGo\Helper\adb.exe
          "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
            adb -L tcp:5037 fork-server server --reply-fd 448
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4700
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itoolab.com/thankyou/install-anygo-for-windows/
          4⤵
          • Drops file in Program Files directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffcf917c188,0x7ffcf917c194,0x7ffcf917c1a0
            5⤵
              PID:1672
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3502586901574221166,11184993338318778171,262144 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
              5⤵
                PID:3368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,16162061108608310345,14243539785499262219,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
                5⤵
                • System Time Discovery
                PID:2276
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,8477712898771991034,3961595651578312024,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
                5⤵
                  PID:2940
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10520263437099225316,9951314552830865834,2097152 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                  5⤵
                    PID:4304
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,10616375188332625786,12896051066650197818,2097152 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                    5⤵
                      PID:3012
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13597315239903003768,17652133400137581321,2097152 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                      5⤵
                        PID:4424
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3821471416822926160,2629481125810930252,2097152 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
                        5⤵
                          PID:3240
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5910189323795145103,13046614696267013365,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
                          5⤵
                            PID:1904
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2641061496013824794,3515776230596402787,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
                            5⤵
                              PID:3892
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,14432742390524566845,383463959430246410,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
                              5⤵
                                PID:5032
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1234595279634655475,4089585748218005453,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
                                5⤵
                                  PID:776
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,11453539361008080541,14514357379472092215,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
                                  5⤵
                                    PID:5176
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,11453539361008080541,14514357379472092215,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
                                    5⤵
                                      PID:5204
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,18029725719215248357,8557949201466428312,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
                                      5⤵
                                        PID:5652
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9352582149491795254,10504945684946641608,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
                                        5⤵
                                          PID:5764
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14872213767763047844,17885067154219496738,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
                                          5⤵
                                            PID:6096
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14180582234261369681,3740839952578816720,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
                                            5⤵
                                              PID:6104
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,3647372272845415665,18210699427442500040,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                              5⤵
                                                PID:5640
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14545980880120616167,11387796411646794763,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
                                                5⤵
                                                  PID:5276
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4051260525384340215,15196360859210522051,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
                                                  5⤵
                                                    PID:5300
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,3629572756505230581,15072606478596182370,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
                                                    5⤵
                                                      PID:2820
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10975528575797592686,4916126057880687568,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                                                      5⤵
                                                        PID:2948
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11654131130466342773,2040124228059210455,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
                                                        5⤵
                                                          PID:2564
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,1047197422837621001,3958827588173879653,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
                                                          5⤵
                                                            PID:6016
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,3537387314581661020,17374849252017714831,524288 --field-trial-handle=2296,i,15337803591925895360,3714879123262846631,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
                                                            5⤵
                                                              PID:776
                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                            msiexec.exe /i "C:\Program Files (x86)\AnyGo\Bonjour\Bonjour64.msi" /qn
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2844
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5920
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:6044
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5564
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5796
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5180
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1676
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5672
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5228
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:4660
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:4228
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5980
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2612
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2256
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5636
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1160
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5476
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:4728
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2864
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:6020
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5360
                                                          • C:\Program Files (x86)\AnyGo\Helper\adb.exe
                                                            "C:\Program Files (x86)\AnyGo\Helper\adb.exe" devices
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2856
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                      1⤵
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2736
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{618af139-a5ba-3b48-a98c-100eb4b33474}\usbaapl.inf" "9" "4edfb156f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\anygo\apple driver"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:3748
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{00ac188a-9b13-cc47-a117-7447ccafa395}\usbaapl64.inf" "9" "47547eba3" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\anygo\apple driver"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:4344
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:4620
                                                      • C:\Windows\system32\msiexec.exe
                                                        C:\Windows\system32\msiexec.exe /V
                                                        1⤵
                                                        • Badlisted process makes network request
                                                        • Enumerates connected drives
                                                        • Drops file in System32 directory
                                                        • Drops file in Program Files directory
                                                        • Drops file in Windows directory
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1456
                                                        • C:\Windows\System32\MsiExec.exe
                                                          C:\Windows\System32\MsiExec.exe -Embedding 7A4D0C48C2AA34C1DE2F57939A48CF02
                                                          2⤵
                                                            PID:6004
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 71629C2B04948D22F45A105F2C4564EE
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3824
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding E9D75DC77D5EF0067F15B432A9FBD0D4 E Global\MSI0000
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5708
                                                          • C:\Windows\System32\MsiExec.exe
                                                            "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
                                                            2⤵
                                                              PID:2828
                                                            • C:\Windows\syswow64\MsiExec.exe
                                                              "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5796
                                                          • C:\Program Files\Bonjour\mDNSResponder.exe
                                                            "C:\Program Files\Bonjour\mDNSResponder.exe"
                                                            1⤵
                                                            • Modifies firewall policy service
                                                            • Executes dropped EXE
                                                            PID:5824

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Command and Scripting Interpreter

                                                                1
                                                                T1059

                                                                Windows Command Shell

                                                                1
                                                                T1059.003

                                                                Persistence

                                                                Create or Modify System Process

                                                                1
                                                                T1543

                                                                Windows Service

                                                                1
                                                                T1543.003

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Privilege Escalation

                                                                Create or Modify System Process

                                                                1
                                                                T1543

                                                                Windows Service

                                                                1
                                                                T1543.003

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Defense Evasion

                                                                Impair Defenses

                                                                1
                                                                T1562

                                                                Disable or Modify System Firewall

                                                                1
                                                                T1562.004

                                                                Modify Registry

                                                                2
                                                                T1112

                                                                Subvert Trust Controls

                                                                1
                                                                T1553

                                                                Install Root Certificate

                                                                1
                                                                T1553.004

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Process Discovery

                                                                1
                                                                T1057

                                                                Query Registry

                                                                6
                                                                T1012

                                                                System Information Discovery

                                                                6
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Network Configuration Discovery

                                                                1
                                                                T1016

                                                                Internet Connection Discovery

                                                                1
                                                                T1016.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Web Service

                                                                1
                                                                T1102

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                e58f25d.rbs
                                                                • Path C:\Config.Msi\e58f25d.rbs
                                                                • Size 126KB
                                                                • SHA256 e627f4f67f8af5d37c1dacd336fc5b56da062b540cf30d362133c046522362b8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AnyGoW.exe
                                                                • Path C:\Program Files (x86)\AnyGo\AnyGoW.exe
                                                                • Size 27.0MB
                                                                • SHA256 866894682be92d7ee65ff55cd6fea1d7b9c732a954a710be2dde43c571067a88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                BugSplat.dll
                                                                • Path C:\Program Files (x86)\AnyGo\BugSplat.dll
                                                                • Size 452KB
                                                                • SHA256 087dae8d16c27e55a5eda59c12a2bbac2b58e8b9ae7226fcf4d849457b8d405f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Core.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Core.dll
                                                                • Size 4.9MB
                                                                • SHA256 2df5061ff70243e344f5b6a08d7129dc69729122c1fcf2474acf37e29b75f7d1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Gui.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Gui.dll
                                                                • Size 5.2MB
                                                                • SHA256 3d4e71b09aaea83644237c204355a6bebe6faa5361d6115c75500b804f5a2f3c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Network.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Network.dll
                                                                • Size 1.0MB
                                                                • SHA256 105fdd20c6d9e560ed5c3aeb53dee0d73357ab04941e784b910552b94cb43360
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Positioning.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Positioning.dll
                                                                • Size 279KB
                                                                • SHA256 950fb875ee89c55384055dba45a94540dd73878b4b623ab664df5e72ef9a5757
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5PrintSupport.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5PrintSupport.dll
                                                                • Size 287KB
                                                                • SHA256 c734ea3d1410e948d73c8b1fc3734895f8b57e13aeb9ad7b8c55f2ea0af01419
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Qml.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Qml.dll
                                                                • Size 3.2MB
                                                                • SHA256 b8b805f6282c3252e8398910c0e8cfb1515b6f216bd50ebc21775839ed7835c6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Quick.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Quick.dll
                                                                • Size 3.1MB
                                                                • SHA256 bd9da2e1c19c940f61a5725d9668fb10c5b38513a804a7104b0b6d90755e6cbf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5QuickWidgets.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5QuickWidgets.dll
                                                                • Size 84KB
                                                                • SHA256 43124af78a91d11701df09d7282b4401e9c0b74a29c1a9bb14c6e26d80b492dd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5WebChannel.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5WebChannel.dll
                                                                • Size 116KB
                                                                • SHA256 a50da88e80ce2906fcf45a9bba92fc4dd360d72d0176f93b71169f7c8ada08b0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5WebEngineWidgets.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5WebEngineWidgets.dll
                                                                • Size 207KB
                                                                • SHA256 53475061c283cfe30549a3f5da0604cf9c5777a55c0b154e11eef0ef286b2b4d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Qt5Widgets.dll
                                                                • Path C:\Program Files (x86)\AnyGo\Qt5Widgets.dll
                                                                • Size 4.4MB
                                                                • SHA256 2c6283448b01f79b861a61d202ba76d3b96887d4ce75d19d0d49643db228939d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qgenericbearer.dll
                                                                • Path C:\Program Files (x86)\AnyGo\bearer\qgenericbearer.dll
                                                                • Size 63KB
                                                                • SHA256 8dddfc2338112b9aee48a3492907ed86c82451496cab55082ecab4ed0e421828
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dbghelp.dll
                                                                • Path C:\Program Files (x86)\AnyGo\dbghelp.dll
                                                                • Size 1.0MB
                                                                • SHA256 9a26ffaffb26fa6549c6da75f76238a903ca723f9dad356fba8d91067fe312fd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qsvgicon.dll
                                                                • Path C:\Program Files (x86)\AnyGo\iconengines\qsvgicon.dll
                                                                • Size 53KB
                                                                • SHA256 57f4777271dd96d5114cefaf86b8f7b0b4e87a1758c31681d210fcf08bbf78aa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                imobiledevice.dll
                                                                • Path C:\Program Files (x86)\AnyGo\imobiledevice.dll
                                                                • Size 210KB
                                                                • SHA256 1640169d52bdf86e0f8e7ffb90aa859bbf6690f133600b8e1b4ecb46e1e1531d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libEGL.dll
                                                                • Path C:\Program Files (x86)\AnyGo\libEGL.dll
                                                                • Size 41KB
                                                                • SHA256 e88f9979a0c09f88995900731452398fa424d87e2074c5c32a10f1b010a2b344
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libGLESV2.dll
                                                                • Path C:\Program Files (x86)\AnyGo\libGLESV2.dll
                                                                • Size 2.7MB
                                                                • SHA256 87d67a598c7e63b03d59462319228d79597a8b097d77d28bf7baac2c54ef5dd7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libcrypto-1_1.dll
                                                                • Path C:\Program Files (x86)\AnyGo\libcrypto-1_1.dll
                                                                • Size 2.4MB
                                                                • SHA256 ae63665ce62963ca0367113e54b6c54acbbb533496c4008f099915dab4a38220
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libcrypto-3.dll
                                                                • Path C:\Program Files (x86)\AnyGo\libcrypto-3.dll
                                                                • Size 2.7MB
                                                                • SHA256 b772f00036cc88025796a6859115cdd46f2c0651664e35c759d9fb8c6f49bc5a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libssl-1_1.dll
                                                                • Path C:\Program Files (x86)\AnyGo\libssl-1_1.dll
                                                                • Size 543KB
                                                                • SHA256 740a568cb25b705c7a7ba0c017bcdfea264fd25eca14c88526fdd63e084c1346
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msvcp140.dll
                                                                • Path C:\Program Files (x86)\AnyGo\msvcp140.dll
                                                                • Size 429KB
                                                                • SHA256 bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qwindows.dll
                                                                • Path C:\Program Files (x86)\AnyGo\platforms\qwindows.dll
                                                                • Size 1.2MB
                                                                • SHA256 9c55c159d6bb4d90be7bac1ef3188860f0da235eef1872a74d87ac46821bef21
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                plist.dll
                                                                • Path C:\Program Files (x86)\AnyGo\plist.dll
                                                                • Size 81KB
                                                                • SHA256 12ee7687576e7004a2adbb9b46848062a2f3f901102d941bfa8eadcbc3ca5eb6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                snvrfy.dll
                                                                • Path C:\Program Files (x86)\AnyGo\snvrfy.dll
                                                                • Size 5.3MB
                                                                • SHA256 c3079acc96fa948ba03cc03056ada5b729c6f3a0c24d5fed98190f75d99ecb61
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                spdlogCore.dll
                                                                • Path C:\Program Files (x86)\AnyGo\spdlogCore.dll
                                                                • Size 263KB
                                                                • SHA256 e7225ca396d667ab1962b15fb2997dfe0ee83849384c56133ac57cf147be8153
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qwindowsvistastyle.dll
                                                                • Path C:\Program Files (x86)\AnyGo\styles\qwindowsvistastyle.dll
                                                                • Size 145KB
                                                                • SHA256 327ed2c2ae8fbf401993170bb0c774d86257634dddf987990fc4c5495887a9ac
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                usbmuxd.dll
                                                                • Path C:\Program Files (x86)\AnyGo\usbmuxd.dll
                                                                • Size 60KB
                                                                • SHA256 9e4d6544688029c601b966474b7b9da74cd4306756d65aa71309fd1416f19a37
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vcruntime140.dll
                                                                • Path C:\Program Files (x86)\AnyGo\vcruntime140.dll
                                                                • Size 81KB
                                                                • SHA256 be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dns_sd.jar
                                                                • Path C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar
                                                                • Size 17KB
                                                                • SHA256 cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1944_1186810911\manifest.json
                                                                • Size 43B
                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1944_163698173\manifest.json
                                                                • Size 160B
                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1944_728362862\manifest.json
                                                                • Size 135B
                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                protocols.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                • Size 3KB
                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 57b65604523f4f4098ba500f6beb2e9397ec9e9cf3e2409f060e9fbbf8c6d8bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe595a7a.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595a7a.TMP
                                                                • Size 3KB
                                                                • SHA256 de1a51d3c4edbf3088cf772ea32ae7032dd2a7702073053370e5c9e7276dcba2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 5KB
                                                                • SHA256 8bd5810852cb8167599baddaf7fc89952dfe4bd003e8ea0e232abd8f5a6e41c5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 111B
                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 14KB
                                                                • SHA256 f7438f0fd3eeb99d19cfbc835f5e8d54dcb93d16e515d21560c3c26d497f3856
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 35KB
                                                                • SHA256 2f065d54591f6b72aea01d1972104ebd7bab13b301777625644b1586e0f8d1f2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 6KB
                                                                • SHA256 7392394f2c13384b0737137552ffddd9c482c54dc0eadd572afc75a2067345cd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig~RFe59d8c2.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d8c2.TMP
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 28KB
                                                                • SHA256 c522f24cf38ed6c4112688709641ff3ba111891283d33fb7b5eadfba2b6faf2e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 18KB
                                                                • SHA256 3476c03d0f344a812ec1ae6a5b4b992eaad5e7c95e6c78caffbb50986a199389
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 d6f1b41de386a182c9f16416c4bea195ea0ecfaedaae8e82a6da20ffa339f65d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 18KB
                                                                • SHA256 f198a668f3566df1dc67268a52d2bf32b5d51af58bea5c3a62f42b5785858c14
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 3e1e1d329b6dcee3974e90d56473fd8056c2c529f852299c6216d1a16849928e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nav_config.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                • Size 2KB
                                                                • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 252B
                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Size 2KB
                                                                • SHA256 98c5f92b97a0ea97bb7a7e61ae71fde8495fd2929ae9f15d97ae7c908601d0a9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                0db4913f-d27d-4f7d-910a-a6d0c13b6900.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\0db4913f-d27d-4f7d-910a-a6d0c13b6900.tmp
                                                                • Size 10KB
                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ce74bff3-5c73-4f10-afeb-34575740d438.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\ce74bff3-5c73-4f10-afeb-34575740d438.tmp
                                                                • Size 1B
                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                anygo.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-PT1OC.tmp\anygo.tmp
                                                                • Size 2.5MB
                                                                • SHA256 b23d626c65515216d8cbc29412cc92262d6a067ad67322599d67ab1455fde6fd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1944_1094570879\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                1dd88d58-54c1-43ba-99de-56c618cd7f60.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1944_1701584383\1dd88d58-54c1-43ba-99de-56c618cd7f60.tmp
                                                                • Size 154KB
                                                                • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                USBAAPL64.CAT
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{00ac188a-9b13-cc47-a117-7447ccafa395}\USBAAPL64.CAT
                                                                • Size 14KB
                                                                • SHA256 946b0a8150213d6a4dd3aef6248ebb923f8167c84c7ff1b10137e5030ec8bf30
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                usbaapl64.inf
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{00ac188a-9b13-cc47-a117-7447ccafa395}\usbaapl64.inf
                                                                • Size 5KB
                                                                • SHA256 edea577e694efceec5b26d745fff8125e9fc8a78cacd7365e77ef35031ebc49b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                usbaapl64.sys
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{00ac188a-9b13-cc47-a117-7447ccafa395}\usbaapl64.sys
                                                                • Size 53KB
                                                                • SHA256 4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                usbaaplrc.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{00ac188a-9b13-cc47-a117-7447ccafa395}\usbaaplrc.dll
                                                                • Size 5.8MB
                                                                • SHA256 5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                USBAAPL.CAT
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{618af139-a5ba-3b48-a98c-100eb4b33474}\USBAAPL.CAT
                                                                • Size 14KB
                                                                • SHA256 1daa9a80eaf692e1c1490afafcc435e37cafa94e9a9dfe453a82b1b472f3b1ba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                usbaapl.inf
                                                                • Path C:\Users\Admin\AppData\Local\Temp\{618af139-a5ba-3b48-a98c-100eb4b33474}\usbaapl.inf
                                                                • Size 5KB
                                                                • SHA256 4494c8af156d9dc7deea76491d73716e16b42e3e8b5b4555b0fd247b6cacab8b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MSI490.tmp
                                                                • Path C:\Windows\Installer\MSI490.tmp
                                                                • Size 75KB
                                                                • SHA256 2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MSIFF2E.tmp
                                                                • Path C:\Windows\Installer\MSIFF2E.tmp
                                                                • Size 76KB
                                                                • SHA256 8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                e58f25a.msi
                                                                • Path C:\Windows\Installer\e58f25a.msi
                                                                • Size 2.6MB
                                                                • SHA256 46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/208-561-0x0000000008870000-0x0000000008871000-memory.dmp
                                                                Download

                                                                memory/1160-1432-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/1568-553-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                Download

                                                                memory/1568-1-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                Download

                                                                memory/1568-7-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                Download

                                                                memory/1676-1358-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/2256-1399-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/2612-1396-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/2856-1484-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/2864-1464-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/2868-8-0x0000000000400000-0x0000000000688000-memory.dmp
                                                                Download

                                                                memory/2868-550-0x0000000000400000-0x0000000000688000-memory.dmp
                                                                Download

                                                                memory/2868-162-0x0000000000400000-0x0000000000688000-memory.dmp
                                                                Download

                                                                memory/2868-9-0x0000000000B50000-0x0000000000B51000-memory.dmp
                                                                Download

                                                                memory/2868-5-0x0000000000B50000-0x0000000000B51000-memory.dmp
                                                                Download

                                                                memory/4228-1381-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4660-1380-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1441-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1482-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1495-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1382-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1379-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1425-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1386-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1337-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1463-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1359-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4700-1348-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4728-1451-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/4732-927-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5180-1349-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5228-1378-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5360-1483-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5476-1442-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5564-1338-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5636-1426-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5672-1361-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5796-1339-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5920-940-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/5980-1383-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/6020-1473-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download

                                                                memory/6044-1299-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                Download