297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
Size 1.4MB
Sample260924-d3mb4ada99
SHA256 297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a
MD5 101b84cb3a6e78a69f82714635aeb2f5
SHA1 40f5e21b4c40271701446f11818abdb27c7bc7b8
SHA512 358d7acdf443bd721d078f106f5d269bf89f5d9eba5c22718b6b579588db3e7f683bf6040d2bc555fe954d87c588f9095a25644d096bed90b6e29602cd0638db
SSDEEP 24576:AHDBrKa3qKvIvKrenkkggVLexuKwQAQVJ5t9hn:AHyPBnTrLeARyJ3nn
TLSH
T1F3658D22F381C872D5671A34DC0B8AF86A20BE209E7456877BF53F0C7F356913939696
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\W:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\Y:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\R:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\V:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\B:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\O:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\P:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\S:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\Z:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\Q:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\J:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\K:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\T:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\U:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\D:	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
File opened (read-only)	\??\X:	unregmp2.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5092_2091138697\nav_config.json	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5092_1607871098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5092_436643152\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5092_436643152\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5092_2091138697\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346943727548100"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{09B9AD5E-3E78-4B55-9280-6DE6D8323897}	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{09060BB4-13F4-4723-AF87-92D940AD8C3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4376	unregmp2.exe
Token: SeCreatePagefilePrivilege	4376	unregmp2.exe
Token: SeShutdownPrivilege	2204	wmplayer.exe
Token: SeCreatePagefilePrivilege	2204	wmplayer.exe
Token: SeDebugPrivilege	1408	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
Token: SeShutdownPrivilege	2204	wmplayer.exe
Token: SeCreatePagefilePrivilege	2204	wmplayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2204	wmplayer.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 5456	2204	wmplayer.exe	91
PID 5456 wrote to memory of 4376	5456	unregmp2.exe	92
PID 1408 wrote to memory of 248	1408	jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe	94
PID 248 wrote to memory of 5092	248	IEXPLORE.EXE	95
PID 5092 wrote to memory of 2132	5092	msedge.exe	96
PID 5092 wrote to memory of 1772	5092	msedge.exe	98
PID 5092 wrote to memory of 1284	5092	msedge.exe	99
PID 5092 wrote to memory of 1772	5092	msedge.exe	98
PID 5092 wrote to memory of 1772	5092	msedge.exe	98
PID 5092 wrote to memory of 2100	5092	msedge.exe	100
PID 5092 wrote to memory of 2100	5092	msedge.exe	100
PID 5092 wrote to memory of 4804	5092	msedge.exe	101
PID 5092 wrote to memory of 4804	5092	msedge.exe	101
PID 5092 wrote to memory of 4804	5092	msedge.exe	101
PID 5092 wrote to memory of 464	5092	msedge.exe	102
PID 5092 wrote to memory of 464	5092	msedge.exe	102
PID 5092 wrote to memory of 464	5092	msedge.exe	102
PID 5092 wrote to memory of 4124	5092	msedge.exe	103
PID 5092 wrote to memory of 4124	5092	msedge.exe	103
PID 5092 wrote to memory of 4124	5092	msedge.exe	103
PID 5092 wrote to memory of 5716	5092	msedge.exe	104
PID 5092 wrote to memory of 5716	5092	msedge.exe	104
PID 5092 wrote to memory of 5716	5092	msedge.exe	104
PID 5092 wrote to memory of 2396	5092	msedge.exe	105
PID 5092 wrote to memory of 2396	5092	msedge.exe	105
PID 5092 wrote to memory of 2396	5092	msedge.exe	105
PID 5092 wrote to memory of 2412	5092	msedge.exe	106
PID 5092 wrote to memory of 2412	5092	msedge.exe	106
PID 5092 wrote to memory of 1620	5092	msedge.exe	108
PID 5092 wrote to memory of 1620	5092	msedge.exe	108
PID 5092 wrote to memory of 1620	5092	msedge.exe	108
PID 5092 wrote to memory of 1748	5092	msedge.exe	110
PID 5092 wrote to memory of 1040	5092	msedge.exe	113
PID 5092 wrote to memory of 1040	5092	msedge.exe	113
PID 5092 wrote to memory of 1212	5092	msedge.exe	114
PID 5092 wrote to memory of 1212	5092	msedge.exe	114
PID 5092 wrote to memory of 4928	5092	msedge.exe	115
PID 5092 wrote to memory of 4928	5092	msedge.exe	115
PID 5092 wrote to memory of 3420	5092	msedge.exe	116
PID 5092 wrote to memory of 3420	5092	msedge.exe	116
PID 5092 wrote to memory of 592	5092	msedge.exe	117
PID 5092 wrote to memory of 592	5092	msedge.exe	117
PID 5092 wrote to memory of 592	5092	msedge.exe	117
PID 5092 wrote to memory of 1140	5092	msedge.exe	119
PID 5092 wrote to memory of 3792	5092	msedge.exe	120
PID 5092 wrote to memory of 3956	5092	msedge.exe	121
PID 5092 wrote to memory of 5304	5092	msedge.exe	122
PID 5092 wrote to memory of 5304	5092	msedge.exe	122
PID 5092 wrote to memory of 5304	5092	msedge.exe	122
PID 5092 wrote to memory of 2592	5092	msedge.exe	123
PID 5092 wrote to memory of 2592	5092	msedge.exe	123
PID 5092 wrote to memory of 4112	5092	msedge.exe	126
PID 5092 wrote to memory of 4112	5092	msedge.exe	126
PID 5092 wrote to memory of 1140	5092	msedge.exe	127
PID 5092 wrote to memory of 1140	5092	msedge.exe	127
PID 5092 wrote to memory of 1140	5092	msedge.exe	127
PID 5092 wrote to memory of 3204	5092	msedge.exe	128
PID 5092 wrote to memory of 3204	5092	msedge.exe	128
PID 5092 wrote to memory of 5172	5092	msedge.exe	129
PID 5092 wrote to memory of 4668	5092	msedge.exe	130
PID 5092 wrote to memory of 4668	5092	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_297fe9841d6046ddf88ac37a03a0f20ab075a54eacd50d457469c2e89d6b2f0a.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "http://www.a88b88.com/--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------.asp?id=wii&md5=65d8e3b9b3facdcee8d9c707680abc33"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://www.a88b88.com/--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------.asp?id=wii&md5=65d8e3b9b3facdcee8d9c707680abc33"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffdc353c188,0x7ffdc353c194,0x7ffdc353c1a0
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,5671212694670225040,9352369503810675792,262144 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,3275587329082010407,14203674467215675862,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
      4⤵
      System Time Discovery
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,14837002893976832872,17249352713502408854,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16392898175292206969,9603357880860057962,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,8441046409524175189,290997949072077686,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,13684029024786804775,15267650490762781990,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,16589441804527651806,10660779929355328618,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,10942192120828896420,864498382745197430,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,2292283336553716137,1046348642190463500,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3720,i,1141227378520724728,12264685304543938044,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,477986973632428070,8004511553014650348,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,477986973632428070,8004511553014650348,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,10106267108097432748,12445546089948442791,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,1529103131061729161,8635377959959974612,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15884946649789274465,13108321101565970555,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,9468048929006315153,17065260482290801755,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5384,i,11057578318004848365,8649009074609980967,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,17595029728766882750,3128402591785191809,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,12006885899864057565,2253883322511325527,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,15380890094407780919,13112071011489260785,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1356,i,16148247508728690152,2684846801200347952,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=1360 /prefetch:1
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,8995330379747366996,1301190802841953685,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,18287257554330861022,9359995236116967852,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5680,i,5343049478021800562,1472049355661266524,2097152 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10859244220625991176,7174360130720135865,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6892,i,8306558956619624429,13307511657884698170,262144 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11535584509451191129,17249856083623817017,524288 --field-trial-handle=2616,i,9476647304873803141,1889525302793647849,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4668

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 99c222e4dc80cf5b58b0ff68d404fdfa5e7363054af5e85668de1398b4a3f890
MD5 4508623a53eb49bc51ada94eab64978b
SHA1 7a664d834264f83f98c734991578847f0d94b7ef
SHA512 c7311a353cc511f552a3e5e0ca6e4f7fe0f8274c8c8fc80b7232b56cac8b71da39e242458d0af6ed2637f7d5479bfb1bf3027c1425102e52cd4f79823ddadfda
TLSH
T1A7619342D172428CF7EA447E8DC16CD73B30E68098830E71B5E8C97AEE86365D9D606C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59259f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59259f.TMP
Size 3KB
SHA256 5e374d9029d0a5fa948fd7d16b2d1723a677bde93675817549304414862a228d
MD5 b42d7f37186ff4288463995f781dbe3a
SHA1 89b483d14527b905ba5aec8bd3482706b715ec11
SHA512 f1e85ee46aa6839f99d1b2b9c4aaa86322f1db3d2f0c4eda136e32b2c74041518cd8a7c5463e09c138003c0623c9fb70f2111b735093f5368016dfa613a41499
TLSH
T123619442D172429CF7EA447E8DC06CD73B30E68098830E71B5E8C97AEE82325D9D606C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 efefec2e70bb55b14a67dcbb87cd17bd0d1d426aadea178bd662ea50d24c0c47
MD5 f6e8c683f0b82451a2b819f99d7d2b0c
SHA1 95c97f4f7aa74bee2c80a1ff18427f55a75407b8
SHA512 48ebb14cff3fee65b34457be94bb2ae26923821f64352ad02b2b82ba3e141546e857118817ff011acc630a5f4eb9bd99644c7e1495b76de8e66a7c8afb79d14b
TLSH
T1A2519FF3C3E8866D890156F4AB186E2BCE1D0914832C3D5AC9E4EF6B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b463ddc4c088d3031d020123c0e5b56258894014371fd8aa9a090eb62f858f38
MD5 b8e2028806e3355d9b2f680fe0f40afe
SHA1 904de0491d7bc33dadaf2091d630521ce6013f72
SHA512 f1548a1fdf17b1791bc77ed7783b8d6f691ae90b16ef472d52f15975b351f464887376291d860eebd3ae940ff5e907bfea58a1281be2e21f92e8f0c661859997
SSDEEP 192:sxRlRoCv/f1sj1ZPSTM32/zoA8p7R/Ze6+WNIYtfLGvIgVVLJ:sxRlBv/f1sj7PsM3Tl/9IDN
TLSH
T19B32C929AD68A97B4CC7D21DFB55BF13E2F91032A0951E48AAFC861C14E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aa7c6475e1afe9ef993112f259723ca7a555ec25807d84e1e4544614957d0a7c
MD5 ff6c0e3ec699ac4cbb586717b6e1480e
SHA1 005ce45897710c2797be825def6f2758bda29013
SHA512 c6c3259426df7716d70ab0c23b1e5218d1b9535156f3c743841da8d412de799747131507d8f840270ffce2080db9cd20199509a330b32d89743e1e3d87689d44
SSDEEP 192:sxRaRoCv/f1sg1ZPSTM32/zoA8p7R/Zz6+WNIYtILGvIgDWVLJ:sxRaBv/f1sg7PsM3Tl/aIwg
TLSH
T14542C929AD68A97B5CC7D61DFB55BF13E2F91032A0911E48AAFC871C14E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c1fcaf51fc9ef880078189a76761c44b790fb52b56ce9aee7868604e32f75bd0
MD5 d1d536130ade512fe11f7f33ec531e83
SHA1 b179f1514d7a9841dbbe81c49703c047f3a140e9
SHA512 1d428a0c5c9d88e864bbfbfba766f26f087d03daf7571383a54c2be1d4d128ff5db4169bf869d208a776d2bcfe20fdc4e79a50158dc9fe748e3e38b0154643ca
SSDEEP 192:sxRaRoCv/f1sn1ZPSTM32/zoA8p7R/Ze6+WNIYtfLGvIgD0VLJ:sxRaBv/f1sn7PsM3Tl/9IDm
TLSH
T19232B829AD68A97B4CC7D61DFB55BF13E2F91032A0951E48AAFC871C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 83fc413bc20bd91a67bb521f2ff1835df467c88a5001f20ef82347436645b18c
MD5 c4ecef36d9cf308401475b944c530157
SHA1 f74bb6219775cf72b8a21e43a47133b80d1b05e3
SHA512 d7f7f3768a864f357e392f0780e90d98e0ba6703e57c7357af5495df7942b10da4ccf4eb63222861806f7a4e78c8f8aab6dc6423a4a277660bc8edc9f5a57520
SSDEEP 768:dmGxTF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVjcIUGeFromLBOP:dmGxTTEb1sWgmMfk6u1jagcIVe+7
TLSH
T13ED2DA7B780CCB7F4FC04ADDAD197A9B6DA802CB9598CD8047F9941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 763c722ef2f6bc70a833868e098c639ee47db135ceaf14af61a479fe5f51dd8b
MD5 2aa89ba208f927a4409dd344a457ced2
SHA1 3818493ca99b9378a077d7f2d6ce976018bf430e
SHA512 e977216686335aa09a944807659e994786788af1382b956a221ce348bca2bc432c0a30c390555a926f8fd49c033ebdbe61d1ba0c4353f85f670f3645af00b604
SSDEEP 48:KMyN4syo4ZTcr0Ia0ZKVw9CZRKJozE4qyDmhEAucc9TYvwIao9KV89O9RWtoX4cO:KIJmKqUqGdSK2YBmz6KQQPz
TLSH
T157914820717B4310387D3408B1E1ABAE5382B7A37174E62B7BDA50978E66E484DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16f33b06-567d-4b98-9f7f-04f1a18558ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\16f33b06-567d-4b98-9f7f-04f1a18558ac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fba2fb32ca7e9e9db5bbf23ddd496cd04362b463ee5e950bc2f339949c5f7911
MD5 43236e5466e6e836c48016538735ba71
SHA1 dcd0e0ff39c177f1131ebd6fc680aee063735fed
SHA512 dfc03c8cdf78dc3ee5a41dfef765e1a215c96621ae74d5b0f146842ecdb3ac6522d102839c7022a01f828fe90501c30213ca70ae05791b95dd88a2258e901894
SSDEEP 768:ox3ljAKnJOtHxDc9bsMSJz/Fn/YPSa7dLKkUhC:ox3LGVQbs7JTmPYC
TLSH
T1DFF2B0B19CA18DB38CEAA7807947BA477FF44553C8C91E88D9DEAF0D05836DD2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c31321b9f381687198664c9f1433d2070097fab352fe31c0d886408d36aaa7fb
MD5 30e9d0811031a1093053b7781507268f
SHA1 a9dcb116480484157f9a502474e99a4d77cfbc60
SHA512 182c4d7b95ca0234c611efee0cfbe024154b2c315e6dab97ccca56b1ec8d70536ac435ce304d23602ba20965bb3f16fa9ce3a961dd47370a74adeb3e0742330a
SSDEEP 768:mx34jAKnJOtHxDc9bsMSJz/Fn/YPSa7dLKkUhC:mx3WGVQbs7JTmPYC
TLSH
T15FF2B0B19CA18DB38CEAA7807947BA477FF44553C8C91E88D9DEAF0D05836DD2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c99ce4b03f34b1a7757a426811e8adbdd364ea3f1f628def478e4006bea01a0b
MD5 b8f406d2c44b6149c3563eff60eb63cb
SHA1 83c264bf535e2cf15f70bf495ea1e61e6b02ebcf
SHA512 1eb2d01be481a47d7d80731639bb23d2dd8599e98892dbb9fddedc4bf18addde415084b15a453d242f7645d91332a21e06c2aefd7750a082142761fdcfe7e4f2
SSDEEP 768:4/UxvxjgC+U3oJAKnJOtaxDc9bsMSJz/Fn/Y/iE:FZj3+U3+lVQbs7JTm/iE
TLSH
T17603D035AC915C638CE7A6803A8B7BD7FFF41963C8C51D989ADA9E0D06C739D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9fa456150f1c69919dd0e6a96db541ccfd7dcd8610250441fc619c477d7781e8
MD5 fe22f00943b6efb3f2a3c338383f2876
SHA1 cbf9bb37769a9c8fe1b99900ae31a3519b684134
SHA512 dc2734995e03a18403df9670a23ee5ef1d2b255a7897b9f6c837aafc56a39d0d76e174bc200a1cffc9f18e7ceae989a41367fc6cd7400d465c9fc99a5dd6913e
SSDEEP 768:z/UxvxjgC+U389KnJFxDc9bsMSJz/FnnGSHXPyK/:GZj3+U3fDVQbs7JT4Sb/
TLSH
T17B03D03AEC9058A3CDF767803A8AB657BFF44953C9C529A449DD6E0C07CB3AC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f03b76f315f311ef9cddaca03644f8ea4db66cf63aa5b8fff986740829817fb8
MD5 dbca6c6c74e91835ebd4d699d3fc979d
SHA1 ae037a3422747f4fe23f5c9e2436028aed33c995
SHA512 40f26a68c4ec6ae8d7ab3fbe2039feff2c6480250442f3261bb939ee3a08a8a773b956afa3c1ed73fc9b2a67992dc05717f72ad37af1d65f634eb35a83b89eb4
SSDEEP 768:fFQ93GwgJjn0nJOt1xDc9bsMSJz/Fn/YPSa7dLKkUhC:i93HUVQbs7JTmPYC
TLSH
T187039E76DCA1CAB79CEB5BC1AA46BA47AEF44193C9CD59C4EAC95E0D00C32DE130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7aa18b2b-be8a-42b8-9b62-a3d4f63b5248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7aa18b2b-be8a-42b8-9b62-a3d4f63b5248.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 206c7731c5751d33778b605d771c5902e0a3bad4ffb2f4da49634270f07f449c
MD5 20595bbe4b6fb0451d14263132f8a0a8
SHA1 716ad76d996476d5332659cd16b42606d408a093
SHA512 ec60c6145e23aaba8413a84626d581420908976dcf2bc8f36d8a0389be8d2525b8142bad88d50a0010f7b445e91456781e97b41a9039c7bf50cd71116e00cd8d
SSDEEP 768:Ff0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:F69tQeoVYo
TLSH
T161843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406425FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 d68ad4f896c86fb7ad759705467048267e8036ff8e7dc165a0f5d6fcbf8c58a4
MD5 7fcbf0006bb4b01831c0e4a890e2816f
SHA1 538d00372f4ca49eba94cd6a28ef1135eb3e20d6
SHA512 db984ceb339cc5e23ba604024fc5e53b0a921122d537ecfb3638f94dd1e93b9bf4e1b9d48b25d9b9750b0a4c6500109e0dd85f1e82984927683b9d8fb7e08c9c
SSDEEP 768:P0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba+:BZP2tFP3vqY8LqEMxTaBacg5
TLSH
T16C257437D190B0C5CE2C7171E9ED8F09BA33A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 2c803b3dfad12d8c9a52760e453ea628c05df064c2387d421ee2693c254dbfdc
MD5 09b0d8a84f05f2cc9719fc7ee39fe14a
SHA1 b0a81df5511e1b95ca26773154f2d87373985ab0
SHA512 840d60175064efefd04c1c085ae9434e1910b4aa0d7b6ec2d4c4469546408299359f534bf4d6d0a0660b3f0c7c69848ad2aa75adb39700d472b015b9785f6c98
SSDEEP 96:xuV1ltlNXt2UMUstU7XtNUMbst6UMlst/OXtcL2tNLXtnteAt+t:xSunqn/nS
TLSH
T1CC63A11066E55649F3FB2E7269FA56167E3A78916E3AD00C1210424E2871F2DEF36F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb118_toWMV_1_to_WMV_clip0a.wmv

Path C:\Users\Admin\AppData\Local\Temp\cb118_toWMV_1_to_WMV_clip0a.wmv
Size 19KB
SHA256 227c7a9a0d513f7273b4383d09703cdd422cae91a899656c750766ec0f7b79a5
MD5 4b3b56467a115a1c05a06f21ab928cc6
SHA1 5dc7007913517bb091464f873de05388a1479dc7
SHA512 10fc84bc34d8285387a441c2a243dda39a5fb39435217dbe3f00c906ecb3d5bd79287e78037da8e8a441273f4a8211c303830f1bbf59bae906da70f7144bf1ea
SSDEEP 384:7m1E3w0zAJuJqu6bG1qZ3AnPATdOQcSrt:OE3w0sJij2G1C6AEQcy
TLSH
T19292D0388FD68EC9CB594AB650F015B099BBDD80D708B3B356ADB16C542B00D8A5B7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5092_2100842923\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 9745c697ff8f47e3d35be87dabebfa865074f343baaa6d06964e4b0ea76b1005
MD5 97545e7ef34ffc5c362390eca1ca14bf
SHA1 a95e75a9b2dbe0fca337bdf66b1bbdd1c06fce07
SHA512 7bb6f6814bece829cceab2555355cebf3d1b13ef74dba23ff893fc9510668bf23a5e21492562b51b5b6111a18add3b024b9ef9a4c4804bd12294346c7a6a6c3e
TLSH
T198215A574A09E4B5CD6247B358CC8A2673B6A7CB5754D026B38EA01A880213E173D17E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-0-0x0000000000C90000-0x0000000000C91000-memory.dmp

Download

memory/1408-107-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1408-1-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/2204-250-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-271-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-237-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-236-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-241-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-240-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-244-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-243-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-242-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-246-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-245-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-249-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-248-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-235-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-251-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-252-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-254-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-253-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-255-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-258-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-257-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-261-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-260-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-259-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-263-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-262-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-265-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-264-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-266-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-268-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-267-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-238-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-270-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-272-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-274-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-273-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-277-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-276-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-275-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-279-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-278-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-281-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-282-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-283-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-284-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-285-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-287-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-286-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-234-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-233-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-231-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-232-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-229-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-228-0x0000000007570000-0x0000000007580000-memory.dmp

Download

memory/2204-226-0x0000000006C90000-0x0000000006CA0000-memory.dmp

Download

memory/2204-105-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-106-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-102-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-103-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-45-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-44-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-43-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2204-42-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download