hxxps://rigexpert[.]com/files/software/Antscope/antscope2forwindows/

Analysis

user interaction
yes
max time kernel
218s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rigexpert.com/files/software/Antscope/antscope2forwindows/
Sample260924-sjs3vsfh26

Score

3^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6fae02743942dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{765E20B1-B82A-11F1-9982-CEB19BEEF4E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{E0A15B16-A6FC-4680-AFA7-E70EE3B6BFC8}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347362828602964"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{22D3D365-1CF4-40E0-97FC-5B8A3798286E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4004	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
960	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3620	OpenWith.exe
3112	OpenWith.exe
960	vlc.exe
3864	OpenWith.exe
1880	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
960	vlc.exe
960	vlc.exe
960	vlc.exe
960	vlc.exe
2484	iexplore.exe
2484	iexplore.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
960	vlc.exe
960	vlc.exe
960	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4704	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe
3620	OpenWith.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2364	3616	msedge.exe	86
PID 3616 wrote to memory of 4352	3616	msedge.exe	87
PID 3616 wrote to memory of 4320	3616	msedge.exe	88
PID 3616 wrote to memory of 4936	3616	msedge.exe	89
PID 3616 wrote to memory of 4936	3616	msedge.exe	89
PID 3616 wrote to memory of 4936	3616	msedge.exe	89
PID 3616 wrote to memory of 4320	3616	msedge.exe	88
PID 3616 wrote to memory of 1808	3616	msedge.exe	90
PID 3616 wrote to memory of 1808	3616	msedge.exe	90
PID 3616 wrote to memory of 1808	3616	msedge.exe	90
PID 3616 wrote to memory of 2708	3616	msedge.exe	91
PID 3616 wrote to memory of 2708	3616	msedge.exe	91
PID 3616 wrote to memory of 2708	3616	msedge.exe	91
PID 3616 wrote to memory of 696	3616	msedge.exe	93
PID 3616 wrote to memory of 696	3616	msedge.exe	93
PID 3616 wrote to memory of 696	3616	msedge.exe	93
PID 3616 wrote to memory of 5036	3616	msedge.exe	94
PID 3616 wrote to memory of 5036	3616	msedge.exe	94
PID 3616 wrote to memory of 5036	3616	msedge.exe	94
PID 3616 wrote to memory of 924	3616	msedge.exe	98
PID 3616 wrote to memory of 924	3616	msedge.exe	98
PID 3616 wrote to memory of 4976	3616	msedge.exe	99
PID 3616 wrote to memory of 4976	3616	msedge.exe	99
PID 3616 wrote to memory of 1808	3616	msedge.exe	103
PID 3616 wrote to memory of 5040	3616	msedge.exe	116
PID 3616 wrote to memory of 2660	3616	msedge.exe	117
PID 3616 wrote to memory of 3208	3616	msedge.exe	118
PID 3616 wrote to memory of 4016	3616	msedge.exe	119
PID 3616 wrote to memory of 220	3616	msedge.exe	120
PID 3616 wrote to memory of 4016	3616	msedge.exe	119
PID 3616 wrote to memory of 220	3616	msedge.exe	120
PID 3616 wrote to memory of 220	3616	msedge.exe	120
PID 3616 wrote to memory of 4580	3616	msedge.exe	122
PID 3616 wrote to memory of 3548	3616	msedge.exe	127
PID 3616 wrote to memory of 3548	3616	msedge.exe	127
PID 3616 wrote to memory of 3548	3616	msedge.exe	127
PID 3616 wrote to memory of 4492	3616	msedge.exe	128
PID 3616 wrote to memory of 3532	3616	msedge.exe	134
PID 3616 wrote to memory of 3532	3616	msedge.exe	134
PID 3620 wrote to memory of 4004	3620	OpenWith.exe	136
PID 3112 wrote to memory of 960	3112	OpenWith.exe	140
PID 3864 wrote to memory of 2484	3864	OpenWith.exe	144
PID 2484 wrote to memory of 2264	2484	iexplore.exe	146
PID 3616 wrote to memory of 1640	3616	msedge.exe	147
PID 3616 wrote to memory of 4232	3616	msedge.exe	150
PID 3616 wrote to memory of 4232	3616	msedge.exe	150
PID 3616 wrote to memory of 4388	3616	msedge.exe	151
PID 3616 wrote to memory of 4388	3616	msedge.exe	151
PID 3616 wrote to memory of 312	3616	msedge.exe	152
PID 3616 wrote to memory of 312	3616	msedge.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rigexpert.com/files/software/Antscope/antscope2forwindows/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd1540c188,0x7ffd1540c194,0x7ffd1540c1a0
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,8843151602148212558,289711968182461111,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,6023231145183659025,12193369730012422086,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,832402956408008411,5568092231735961205,262144 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5102850282251434554,12480134015024527473,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16014598506365557606,13661313573821726476,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,13971933011071745079,14966981956447431941,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,18363353533555965485,18328789425388993596,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2466486599861870394,15055422657387376005,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,712860729834209455,14207576387223993263,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,7450545315475360429,1610753181649814126,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,7450545315475360429,1610753181649814126,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7473835216865839527,13308883996960660164,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,9240369419647535379,6166926593974848808,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,2020526234156415556,1901090925912128607,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17133511305231632661,5752016873087973885,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6404,i,12031193647179731800,11187640955184726671,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,13976588851860141511,4088252161581245089,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4120,i,3386601148013949580,8173854781433668780,2097152 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,17971778602004577709,18405982599556992610,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,5011769218737432432,3280138015514261584,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3448,i,13802810054565132909,14675325640441758241,262144 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6570985543742415167,13426812260769292961,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,8315958119229925597,2448012738697965033,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,15741132909189625156,14304441898567466439,524288 --field-trial-handle=2832,i,15342110489573101235,11739067798730159328,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\AntScope2_1.4.12_mac.dmg
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\AntScope2_1.4.11_mac.dmg"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\AntScope2_1.4.12_mac.dmg
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba96e7e86cdf0e899cde8d85da6c176047bbfd5c096f72c497b5dda7b5522dcd
MD5 fab50d878a6d5b0376aa45d2ef6931bd
SHA1 3b14c7de172e69a8976b6a386e2592a2b4e421d0
SHA512 334a02ae4e24b29d70c6a853da76a7aa8bc87678f8e5b8c0af9df47d9b241deaf15eb9835bb6b3d0477c8a0815d0f95b905613a0111ae1c9fa26a47b4ac9d021
TLSH
T18961C68255440E69FFA8D97899FE27833A35A58424872EC2505DECFA580EFD5E33137C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bfff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bfff.TMP
Size 3KB
SHA256 0f8c7383635bcd3c1b8b023d7546696efb2b36b6aa79aa79efbdf07e549992d5
MD5 fab406cfd4c23c0cb8a60993888b0f98
SHA1 55b3804adb23eb9dd6397b12321a807d1056256c
SHA512 d4f026296d753df466975fa952a85f6e6e850a0d75ce7c4154ba6b775bbe5b510d14269a51a1257a621dbddbcb8fa1e5aa099635b6e8488f2ebb1dc4617efed7
TLSH
T13B61C68215440E69FFA8D97889FE27873635A98564872EC2505DECFA580EFD5E33037C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 372cfe65514eb2802dc252387b0c4e012a87f1ef7282710cee198c92df89174e
MD5 4302931b69b458f401aef30552459969
SHA1 76ebd3de283a9ca1b892b3264fe05bce32642408
SHA512 5e3149f11dd8ec0be6c74b14f63a00d5aff14aa304287fb437db24de110fcc2eedac8629cc92c9f8cbbcd4473f1a70265b1833d10bc39d3b2e75f22890e2551b
TLSH
T15B21ACF7C3D98A6E891116F06A24BE2BCE5D0905821C7C2989D4EF1B93E3476E11295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c0b39b5afead9352787c07ec358ae575a84ba40fc61d38513c7480db29a07770
MD5 36f9483d24701ee4fb8e2feb8be4af2f
SHA1 27d666c712b3c26ee05c636fec13770bc9638fa8
SHA512 b36651f404874b4bf19eff78e2773e805583f4847b6ecbb7304ee17ac93869b3e86d222bfa3b56224294755bc438de77cc630c994f5e538b3f14bec39cc809e6
SSDEEP 192:sxZqRIWj/fwsccXIdp+FHW6+WNNA//YRPrcxIgrJ:sxZqVj/fwscc4SHbW/mK9
TLSH
T1DE22C756AE28A97B8CD7D20DBB25BF53D6F9503291D01E48AAFC861C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ab1fc5c485622a0a772296a2cbd45317183c6253462d4f652ccfefe123a2857f
MD5 904d28cc3e2a3e4a88e43cedcf4f3aa1
SHA1 e1c6c0d4c3e7f7c43921c12359d3fd476cdd66fb
SHA512 a080363a0e439ccea4ed22df39e5fc26d198aa7851a270f7bba5320cd408cc545cad33ca0894e3c7a5bcbed4d1c26845ffd00f85afac3beff7d67eb83702d00a
SSDEEP 192:sxZqRInj/fwsYddIdp+SHW6+WNN6oXYRPecxIg5iJ:sxZqYj/fwsYdehHbrXmbk
TLSH
T18422D7566E28A97B8CDBE20DBB15BF53E6F9503291941E48AAFC861C05E76CD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 841ad52af37ba623882681179ba828706589c0a5a9b85c443e3a5d904182a6b4
MD5 11aa030d3b11ccf3fe88a979f183d1a6
SHA1 793060fed6218be607a693e88b98577657f94248
SHA512 7f6201da0d6ca71bb89d1f245a617b8cd91a21f7d6dec3a61df03989599a955fa7c4ef88bab82727c8b9280831ce7921fadcc2c71542aa35f19c1aff987a2096
SSDEEP 192:sxZqRInj/fwsYdsIdp+zHW6+WNN6oXYRPecxIg5iJ:sxZqYj/fwsYd1QHbrXmbk
TLSH
T16F22D7566E28A97B8CDBE20DBB15BF53E6F9503291941E48AAFC861C05E76CD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d46a8bdafa9cb75d40de0c6854a5b655db2120c95a1a7bb3727b180558c5d2f
MD5 9953299ae894e55874094bb56b561780
SHA1 5c2be1e1840e54637a9e77af9481271808da30c3
SHA512 f27dd0ada87c55a363af48cf6355aa92c3024596c9bfc01f3fc97503eed9869ec470ac849946a62836772860dc47c66456ef0d5f23f18efc57263205e5551365
SSDEEP 192:sxZqRInj/fwsYdsIdpMzHW6+WNN6oXYRPXcxIg5iJ:sxZqYj/fwsYd1OHbrXmmk
TLSH
T1DF22D856AE28A97B8CDBE20DBB15BF53E6F9503291901E48AAFC861C05E76DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 602d9017cddc79b3ed8649b7f9f552b74babd9cb710b65caa7ed1af095b84e43
MD5 ebcb808f7ebff1bfd25d7a4f515c1836
SHA1 99a7e1f2161f6bff44135311f2b3f7c1c772cd72
SHA512 bb433898738e7518875bafe7ef280f3b8251855f9a2156f393ca168f11a8e7f70a43a0e9f4bc793a9801304e0ee884fea3b4ee037998e0e6a3c448024392a03d
SSDEEP 192:sxZqRIWj/fwsYcXIdp+1YHW6+WNN6oXYRPVcxIg5wJ:sxZqVj/fwsYc4SYHbrXmMm
TLSH
T11722D7566E28A97B8CDBD20DBB59BF53D6F9103291D42E48AAFC861C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 653079e213ff737f1701efe0cae5a3bc57e233183bef95b70e1b5da4d7f497a4
MD5 7dfad83dc9df025016cd30fc77b8fdae
SHA1 6475f0541c968c7b73b472056bdd5f6f97805263
SHA512 5cfa82b1e7627e41243d3d85fa44d7d68c43ecfe3091e5e8304acd579c1496e2126afcfc5d002af2306c53b5222f0b2499f079f2f0ad91a37bd0a1f00d50e11b
SSDEEP 768:9dK9uzYWvcQus8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3yroi+A0:9dK9uzYWvcQusu1ja0HL7Q3pi+A0
TLSH
T1A6C20A3F640DCB7E4FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2150f5b-0729-4dbd-b9f3-5152169e42b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e2150f5b-0729-4dbd-b9f3-5152169e42b3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 290f1e3db85c606b534f8e5a1c19479847e0276b3bf80e406ba2f6641c56b84c
MD5 988c254c1c32097a03996e5e84511641
SHA1 64751069c060d6d4ace1d1ee519998add16f7d73
SHA512 74eee3f4ba7f0323c46e9d92a46adc147451bb8f695225a35ff92ace0ffb659594af70ed07d7c50c4ab60f33db3f98af55e39fdf5c8e3f7cf5f4782c63c30373
SSDEEP 384:bZcIhsNokw9ClQLOjTVSpOsG5bjkHzwTeUCWvoo:DhrjanAOrjkHzweWvf
TLSH
T141827D3669785C776DF6E545F84A36038FF88063DA843E80D5ED6B1C01DB6E8230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f495f9af0647f373b5ed68c835fa4ec150a07340217c46fb63bb49eaa60281b2
MD5 6f957a353050acdef1eda954725d0a86
SHA1 5acc9bde5e618bbb6946129fa4769b2dea0ad7fa
SHA512 33bf64fa5606739c3a9f0f111fa35db399a10c7e5bfac00bdeb44d1164ed1f684ae1ce84e20e9e6416bb63f111a5afd52ff96be79b91e25628d05dc50c2319dd
SSDEEP 384:miFkZcIF2sNV8TUNTUlIltw9CevLOjTVSpOsG5bjkVzwTeUCWvoo:NFC8ywgILanAOrjkVzweWvf
TLSH
T101C219F658EB4876E8BE9747AB7D2D038EBCC053B5446A40B3985A0CCD961BFD306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c19ee64c72fb257c4e0edcf08a72180ef5d66caa92c32f31f40913c6bd11bbf8
MD5 1a33410c403473bce73bda6b16e68783
SHA1 5a5e54cbb323558799c57fab71c706d09d47fb3c
SHA512 d9a9f0af605fa59b424400ff08e10cf43408d44cb8e7227d6dea5f3d9ff9f1caa39bf61382a865c6e907d0ba8942a2ba9cc06ba34af8df7940de8a5bd8464d58
SSDEEP 384:jZcIAsNitw9CKQLOjTVSpOsG5bjkHzwTeUCWvoo:7AY0anAOrjkHzweWvf
TLSH
T19B827C7669785C776CF6E545F84A36038FF88067D6882F80D5ED5B1C01DB6E8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41f772fe02d50a90166767ae96247b0e9a09cc3d882809ed906410b1ab69be49
MD5 fa15713e7d3326c90ad1a33044e67301
SHA1 8de4b6a8bec08eed306537d7a4a726ce40afdc45
SHA512 143e93724ce6242641cf8aeff0ec2e0bd4d3ae7431718a1174288208becf440f37edd34b6c2315175098b689d4dfb0e53a3b362afc7b7aa37f145c2977b942dd
SSDEEP 384:2ZcIhsN0Jw9ClQLOjTVSpOsG5bjkHzwTeUCWvoo:kh6janAOrjkHzweWvf
TLSH
T1D1827C7669785C776CF6E545F84A36039FF88063DA883E80D5ED6B1C01DB6E8230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 841ae86563bc5b68e4ce9362739cb2248feffc5f35d42e2a9b9d22ca86cdc3c2
MD5 eb81b54389d8e5a4fff7315e9319740d
SHA1 5361d03cdb50750128087360ab4a632b0dc6f7a8
SHA512 c91bef095e694db1c8089b302bed0042d2fa4208dec90ad914a988d5dfbaf7039bf5abc5081b820382c58db03107e90afea800d3c061b1637ab1a8e92c633d24
SSDEEP 384:miFwZcIFZsNV8TUNTUlIltw9CWvLOjTVSpOsG5bjk6zwTeUCWvoo:NFOnywgIranAOrjk6zweWvf
TLSH
T1D8C219F658EB487AE8BE9747AB7D2D038EBCC053B5446A40B3985A0CCD961BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 763881f79c2c898bf6d6567786c72b4683d34d30153ca91c072251dabaa962a8
MD5 808021b9a2609100f5fc12f402249ffa
SHA1 6023c54f1616bba79b50e4e76a2836701d677e13
SHA512 98be224b2cc81d185fb9ee823820f4247ed2ce636baa60f9abc060f9aa7eeb5bb701ce82716cc8cbc493d90aff1bb78850305add3d5a8c25b418428a992ccb7b
SSDEEP 384:miFPZcIFzsN68TUNTUlIltw9CuvLOjTVSpOsG5bjkozwTeUCWvoo:NFHhPwgI/anAOrjkozweWvf
TLSH
T153C208F658EB487AD8BE9747A77D2D038EBCC053B5446A40B3985A0CCD961BFD306C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ffeae1dd9b902763b0fa6dffff46ec9e1672f78cf7b2e48f4fe59d2565ac6b5c
MD5 068a384002991125b8316c8796424535
SHA1 d940335f46bb01f7c292d220d7d37eda88c0479e
SHA512 4af7577f4d7be4d7226b9f3685c7103620c9902e6a2717750568496ed1183831fff12ed628aa876141333625065d7150d38d4ace71df8a3ceaf6db9c5b545201
SSDEEP 384:miFHZcIFqsN68TUNTUlIltw9CKvLOjTVSpOsG5bjkbzwTeUCWvoo:NFvMPwgIranAOrjkbzweWvf
TLSH
T1DBC209F658EB487AE8BE9747A77D2D038EBCC053B5446A40B3985A0CCD961BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f995b3ee8c92d8ec9625833970ef1e907988d14cf590b50dbfb924d5c7f27bb2
MD5 876c55a2c44aa60f78b83a3ed62634f8
SHA1 145cbc5f328d75eb3b5fa75c699760a20beb76be
SHA512 4cba81e3ad69f105050b1fe9c79e13fc096ccf2573bfeeb3a5f004399f9e5d3f02c301a633508441272ff43ef248a4f032c01d5b679bfe32960252678468851a
SSDEEP 192:SONR6yKQmiUytiJOCTVgFpOsR05bjHEb3Ue/UU6:SONR6VfJOCTVSpOsG5bjkozU6
TLSH
T1E412083578786C775DE2A545F48B36138FA84167DA453F81D5EC2F1C02EB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6876db30b0a5757be7a47d8f0cc85c3472f40f0225cd88a2eb6aa89d83b102ca
MD5 7ce23741d60247e6a747691121827663
SHA1 727efd4f9d930a58c68a8ae31b557fa54ad6900e
SHA512 a910b2030fa025c503049424770b855eeedb690a59b086f223b39cc2083d75465089e41ffa291d25e12d385ebef0708a5bc8456bdf4f033997b51cb7cf3c2582
SSDEEP 192:SOND6ygpQmiUycitOCTVgFpOsR0XzPgBSU6:SOND6lHMtOCTVSpOsGzrU6
TLSH
T18802B735B8682CBB8DF3AE45F48B37179FD4116BD9552B84DAE81A1C01D766C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e6341705cb61116c90c4a6dfa89757688dd2b6d2c23ccf0c6a3ac77b5b2fc243
MD5 1d36d8fc4c16a9b4eb7eca46ae8d821a
SHA1 f81f853fbc62c25db10cc6f353578165726620b0
SHA512 66a8245e771b1ae9502f43c6524290a0875939fe1f8d392f0f9afa4e225927f96803c6e6b7a1f0d5d2595f3ff9757ddd4608510b787ae943b8808275cd196cc8
SSDEEP 384:miF9ZcIFzsNV8TUNTUlIltw9CuvLOjTVSpOsG5bjkozwTeUCWvoo:NFlhywgI/anAOrjkozweWvf
TLSH
T12DC208F658EB487AE8AE9747A77D2D038EBCC053B5446A40B3985A0CCD961BFD306C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0794e0e501684b7f3837420890916051dc3959ae6a5d5632ad9626790877116c
MD5 959c32663039d144e5917e4fd9245701
SHA1 4095f645f6670893faadf43becbb0c6829deaccf
SHA512 ad6e2a8ceba91d598b1e23d990a2567c62c80e45eee9a7012d16016283e9be32f23146fde84472e341f141b0e4444e9203fd902cf1fdfdfe250420481070f272
TLSH
T160E00242570054F3D50C033101C31B193BF2C06113E3164B5A7005781C363046CB2F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2d7ce3b3f87637a5e3dc7ec99b8f63b54987e99538f6552673b71547d93c3f6f
MD5 13cf2b2346fb0b2cdf711459a47fd443
SHA1 805a60681b6e76fea9eefc62236a8bb6b8acdd38
SHA512 1428b477f4691b4be782d0599b3311876ee70958d76e060702bae1444da97223cac865fd53b29c892674b0bb7de5eff863e7eb7a68b636c0bbf230eec625998c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58dbf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58dbf4.TMP
Size 392B
SHA256 0a2a737a9b095b9a9a22eb287fa26a899333d606c2adb5a87f55601281f57549
MD5 0e479219f395038bc9700fb4dad3ae24
SHA1 1058b9f8dbc5806dd88a6938a3784bc70acef97e
SHA512 3191941c5d76f52fd221807e77ef163620f7d500485f9c34ea7c0bd36509324895051ac1a098699f6f9903f9e4702c093fa2a097ec35b6b7ef7bb876c06023bc
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c8cf02aa5a031bc082f05b35193eda380c9ec5400dd65bebf3ac9d85eec048b
MD5 5802390a6631748bca7268814da8046a
SHA1 fabb582c3e19995c1c88682174a62c532aed258a
SHA512 c9310cc3dae6eaed4ae5422aa4a16a602e63a1d11a9b90b3fe1cd6387bc853a209f76e445edbf07e2c24921364889a3ae1795249b8d476cc8aa88dcdc09853c2
TLSH
T1D8411F587AF91148B3B76E5A9BF6A96D847FB8772E06C45E10110E4F0927F40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

AntScope2_1.4.11_mac.dmg

Path C:\Users\Admin\Downloads\AntScope2_1.4.11_mac.dmg
Size 38.9MB
SHA256 60e360d463ee062c2186ed0324bec2bd95ff706420d89c9b56719de0e36cc0dc
MD5 c5adeeeaf7c2f632f3a81abf0efc9d60
SHA1 0b5b91590f3b92d6f63fea1c89d3b2a4b20c432c
SHA512 0602866e44de804e332dd3b16db9f2f886eae0c1026582c91f693a6e324b113a619afbacbfabd3e97662cc4ab26d2d3e3afb3d45720815917aec948cf592d343
SSDEEP 786432:yV/PjOikXyT5WMI8GooygjcKrMCsxZDM0KTiHUDfawPttdUW:M/PjrkXaWxlZHKMugnz/
TLSH
T15A9733256E2CC877F9C351BEC94978A51A27EF9B00BCC9E63946344ADC60F40D736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AntScope2_1.4.12_mac.dmg

Path C:\Users\Admin\Downloads\AntScope2_1.4.12_mac.dmg
Size 38.9MB
SHA256 52911cbbe55e0ca1ee45a7fad5faa2b71bd32240983f70ac9c8232073b7780c9
MD5 d4a88ffe87e4fcf110ff1025c53b566c
SHA1 6055ae97035db21b13e84f7115239f23dd29ae68
SHA512 c8ca153725b46b00352a4574afc8f074c908e17190098901350b5e8b03a4b37353edeb09a55a37c4a17531a3efd429a56232a92a5cca5dfa0c13db4af6b838aa
SSDEEP 786432:vPC88VpOikXcUT5yMI8GsNMqjO1rMCsxZDBN7HUDeawkbRs:HC88HrkX5FyGboHKB9g6kbRs
TLSH
T1FD9733296E2CDC73F9C351BDC90978651A27AF9B00BC89E67847358ADC64F01C736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-350-0x00007FFD12DE0000-0x00007FFD13096000-memory.dmp

Download

memory/960-370-0x00007FFD11DA0000-0x00007FFD11FAB000-memory.dmp

Download

memory/960-353-0x00007FFD2A2F0000-0x00007FFD2A312000-memory.dmp

Download

memory/960-358-0x00007FFD133F0000-0x00007FFD134C2000-memory.dmp

Download

memory/960-357-0x00007FFD2A270000-0x00007FFD2A281000-memory.dmp

Download

memory/960-368-0x00007FFD22B10000-0x00007FFD22B21000-memory.dmp

Download

memory/960-369-0x00007FFD1FCB0000-0x00007FFD1FCC1000-memory.dmp

Download

memory/960-379-0x0000019CDEB60000-0x0000019CDEB72000-memory.dmp

Download

memory/960-378-0x0000019CDEB40000-0x0000019CDEB5A000-memory.dmp

Download

memory/960-380-0x00007FFD07F40000-0x00007FFD08185000-memory.dmp

Download

memory/960-377-0x0000019CDEB20000-0x0000019CDEB32000-memory.dmp

Download

memory/960-376-0x00007FFD1C940000-0x00007FFD1C952000-memory.dmp

Download

memory/960-375-0x00007FFD1FC90000-0x00007FFD1FCAB000-memory.dmp

Download

memory/960-374-0x00007FFD119A0000-0x00007FFD11A4B000-memory.dmp

Download

memory/960-373-0x00007FFD11CD0000-0x00007FFD11CF5000-memory.dmp

Download

memory/960-372-0x00007FFD134F0000-0x00007FFD1353F000-memory.dmp

Download

memory/960-371-0x00007FFD11D00000-0x00007FFD11D98000-memory.dmp

Download

memory/960-354-0x00007FFD2A2C0000-0x00007FFD2A2EB000-memory.dmp

Download

memory/960-367-0x00007FFD22F30000-0x00007FFD22F4A000-memory.dmp

Download

memory/960-366-0x00007FFD22C50000-0x00007FFD22C7D000-memory.dmp

Download

memory/960-365-0x00007FFD22EC0000-0x00007FFD22EE6000-memory.dmp

Download

memory/960-364-0x00007FFD2A250000-0x00007FFD2A268000-memory.dmp

Download

memory/960-362-0x00007FFD13540000-0x00007FFD13581000-memory.dmp

Download

memory/960-361-0x00007FFD11FB0000-0x00007FFD12093000-memory.dmp

Download

memory/960-360-0x00007FFD13300000-0x00007FFD133E8000-memory.dmp

Download

memory/960-359-0x00007FFD12B40000-0x00007FFD12DD6000-memory.dmp

Download

memory/960-363-0x00007FFD28CB0000-0x00007FFD28CDF000-memory.dmp

Download

memory/960-356-0x00007FFD2A290000-0x00007FFD2A2A4000-memory.dmp

Download

memory/960-355-0x00007FFD120A0000-0x00007FFD12430000-memory.dmp

Download

memory/960-351-0x00007FFD2A340000-0x00007FFD2A351000-memory.dmp

Download

memory/960-352-0x00007FFD2A320000-0x00007FFD2A339000-memory.dmp

Download

memory/960-387-0x00007FF7193E0000-0x00007FF7194D8000-memory.dmp

Download

memory/960-389-0x00007FFD12DE0000-0x00007FFD13096000-memory.dmp

Download

memory/960-388-0x00007FFD2A210000-0x00007FFD2A244000-memory.dmp

Download

memory/960-349-0x00007FFD2A210000-0x00007FFD2A244000-memory.dmp

Download

memory/960-348-0x00007FF7193E0000-0x00007FF7194D8000-memory.dmp

Download