hxxps://github[.]com/qPro420/TikTok-Report-Tool/blob/main/CSB%20TikTok%20Ban%20Tool[.]exe

Analysis

user interaction
yes
max time kernel
899s
max time network
743s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/qPro420/TikTok-Report-Tool/blob/main/CSB%20TikTok%20Ban%20Tool.exe
Sample261003-ste9ratsdw

Score

8^/10

discovery execution persistence pyinstaller ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
71	2308	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
3528	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
5300	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
932	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe

Loads dropped DLL 50 IoCs

pid	Process
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
2648	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
4660	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe
3572	CSB TikTok Ban Tool.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
70	raw.githubusercontent.com
71	raw.githubusercontent.com

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0003000000016b47-327.dat	pyinstaller

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe
4160	cmd.exe
5716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2308	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{82ADFEF2-6EC4-4B16-A34D-D31FE8901DCF}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{AA8FED8E-8061-4887-BAAF-FD52D80AC416}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1692	unregmp2.exe
Token: SeCreatePagefilePrivilege	1692	unregmp2.exe
Token: SeShutdownPrivilege	4780	wmplayer.exe
Token: SeCreatePagefilePrivilege	4780	wmplayer.exe
Token: SeShutdownPrivilege	4780	wmplayer.exe
Token: SeCreatePagefilePrivilege	4780	wmplayer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1968	4216	msedge.exe	89
PID 4216 wrote to memory of 4968	4216	msedge.exe	91
PID 4216 wrote to memory of 2308	4216	msedge.exe	92
PID 4216 wrote to memory of 2116	4216	msedge.exe	93
PID 4216 wrote to memory of 4968	4216	msedge.exe	91
PID 4216 wrote to memory of 4968	4216	msedge.exe	91
PID 4216 wrote to memory of 2116	4216	msedge.exe	93
PID 4216 wrote to memory of 572	4216	msedge.exe	94
PID 4216 wrote to memory of 572	4216	msedge.exe	94
PID 4216 wrote to memory of 572	4216	msedge.exe	94
PID 4216 wrote to memory of 2632	4216	msedge.exe	95
PID 4216 wrote to memory of 2632	4216	msedge.exe	95
PID 4216 wrote to memory of 2632	4216	msedge.exe	95
PID 4216 wrote to memory of 800	4216	msedge.exe	96
PID 4216 wrote to memory of 468	4216	msedge.exe	97
PID 4216 wrote to memory of 800	4216	msedge.exe	96
PID 4216 wrote to memory of 800	4216	msedge.exe	96
PID 4216 wrote to memory of 468	4216	msedge.exe	97
PID 4216 wrote to memory of 468	4216	msedge.exe	97
PID 4216 wrote to memory of 4976	4216	msedge.exe	99
PID 4216 wrote to memory of 1336	4216	msedge.exe	100
PID 4216 wrote to memory of 4976	4216	msedge.exe	99
PID 4216 wrote to memory of 1336	4216	msedge.exe	100
PID 4216 wrote to memory of 1512	4216	msedge.exe	102
PID 4216 wrote to memory of 5544	4216	msedge.exe	105
PID 4216 wrote to memory of 5544	4216	msedge.exe	105
PID 4216 wrote to memory of 5544	4216	msedge.exe	105
PID 4216 wrote to memory of 3848	4216	msedge.exe	106
PID 4216 wrote to memory of 1516	4216	msedge.exe	107
PID 4216 wrote to memory of 3848	4216	msedge.exe	106
PID 4216 wrote to memory of 1516	4216	msedge.exe	107
PID 4216 wrote to memory of 1516	4216	msedge.exe	107
PID 4216 wrote to memory of 1708	4216	msedge.exe	108
PID 4216 wrote to memory of 1132	4216	msedge.exe	109
PID 4216 wrote to memory of 1132	4216	msedge.exe	109
PID 4216 wrote to memory of 3528	4216	msedge.exe	110
PID 3528 wrote to memory of 2648	3528	CSB TikTok Ban Tool.exe	112
PID 2648 wrote to memory of 2660	2648	CSB TikTok Ban Tool.exe	113
PID 4216 wrote to memory of 5224	4216	msedge.exe	115
PID 4216 wrote to memory of 960	4216	msedge.exe	116
PID 4216 wrote to memory of 1328	4216	msedge.exe	117
PID 4216 wrote to memory of 2448	4216	msedge.exe	118
PID 4216 wrote to memory of 2448	4216	msedge.exe	118
PID 4216 wrote to memory of 4256	4216	msedge.exe	119
PID 4216 wrote to memory of 4256	4216	msedge.exe	119
PID 4216 wrote to memory of 4488	4216	msedge.exe	121
PID 4216 wrote to memory of 3936	4216	msedge.exe	122
PID 4216 wrote to memory of 3936	4216	msedge.exe	122
PID 4216 wrote to memory of 3936	4216	msedge.exe	122
PID 4216 wrote to memory of 5300	4216	msedge.exe	123
PID 5300 wrote to memory of 4660	5300	CSB TikTok Ban Tool.exe	125
PID 4660 wrote to memory of 4160	4660	CSB TikTok Ban Tool.exe	126
PID 4216 wrote to memory of 932	4216	msedge.exe	127
PID 932 wrote to memory of 3572	932	CSB TikTok Ban Tool.exe	129
PID 3572 wrote to memory of 5716	3572	CSB TikTok Ban Tool.exe	130
PID 4216 wrote to memory of 3592	4216	msedge.exe	131
PID 4216 wrote to memory of 6056	4216	msedge.exe	132
PID 4216 wrote to memory of 6056	4216	msedge.exe	132
PID 4216 wrote to memory of 6056	4216	msedge.exe	132
PID 4216 wrote to memory of 4108	4216	msedge.exe	133
PID 4216 wrote to memory of 5996	4216	msedge.exe	134
PID 4780 wrote to memory of 3844	4780	wmplayer.exe	136
PID 3844 wrote to memory of 1692	3844	unregmp2.exe	137
PID 4216 wrote to memory of 4048	4216	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/qPro420/TikTok-Report-Tool/blob/main/CSB%20TikTok%20Ban%20Tool.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8cef6c188,0x7ff8cef6c194,0x7ff8cef6c1a0
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,8016119644478796410,15393284843322634826,262144 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,15187128919631321483,8894561923154723934,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,8597400862844557987,16422590202341973653,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,8944426493149592830,13553836601962532045,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,2714801222257966734,17110358842450411481,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11898488109617202024,14882671444511855918,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,15658902691277442594,1439917947410092442,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,9032953904705696362,6584126596017790680,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,3813302136528398335,10313073952568005984,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,18333177984863915750,4795770010763747167,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,18333177984863915750,4795770010763747167,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6548,i,11166362289612702922,13087442807829387051,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,4391426609269413766,3797625154720925473,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6920,i,4027937038513791575,5966436295055158266,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,4108935823641486190,10281078576797212865,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,15634347080890623915,6817194984643876293,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:1132
- C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
  "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
    "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c
      4⤵
      Executes a command shell one-liner
      PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,1864262513195620860,8821528463555943389,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=1360 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,6091726254778345973,10494277387677901970,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=1352 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,8247204781755931306,2844895810762260911,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,15225172687279118209,2608166977774177825,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,10028880667538092669,10416516446250290508,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3625276112259316439,8400307486133204927,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6624,i,8067395242185865049,11001975013749744154,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3936
- C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
  "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
    "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c
      4⤵
      Executes a command shell one-liner
      PID:4160
- C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
  "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe
    "C:\Users\Admin\Downloads\CSB TikTok Ban Tool.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c
      4⤵
      Executes a command shell one-liner
      PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6964,i,1896463704124386274,12213864315007504954,262144 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6020,i,6570422188158960520,2381849047810362137,2097152 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14110540122088087986,2021739681763742448,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,4176975536801780458,4915824809732448152,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,4146622897958594482,7154933507091588066,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,7249833067996984391,16127797439798942160,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,5600322759025122832,9856044001091297021,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,12988126063823036207,5399640892112601328,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,15971359561805494167,1653926817174523825,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,10805561260757554832,13874621681659570469,524288 --field-trial-handle=3024,i,2479893642547440752,5040576107488132995,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:14
  2⤵
  PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2776

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37c5aa8f-6774-423d-8bb5-5491054479fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37c5aa8f-6774-423d-8bb5-5491054479fa.tmp
Size 33KB
SHA256 8c069eadbb8a1b4c5ac6b917a6b126bc55c378ff4bd03080d7078aa2bd066fc4
MD5 261b08b7238d4fb4b0e216b43e87ed0f
SHA1 a23f5b8821ab0526d69319d8e175f96c33c7992e
SHA512 fded5e907e84cc2a6b68fcf2c7cbcdfb5f0197f58bc7136f0e020a9f3bde681cc8cfd352c6401a4bdfce02d05e43d6fddb0fd3d0114fd0f5d3719d7527aec35e
SSDEEP 768:nf3fqqYeSFajLktjnqMwQi5BgK5/CwYcZu2sS6r:nf3fq+H8VmBg8/d82s9r
TLSH
T178F2AE31ECF189BB5CFA9244F2867646AFF49153D998095484EE9B0E0297DEE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d8e1932-b892-4c89-9dd4-761856adc5c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d8e1932-b892-4c89-9dd4-761856adc5c4.tmp
Size 41KB
SHA256 45257879d545db352bb126f103679681b422867d982b390e4d7454c856af480a
MD5 0fa0397bad74028e8e76866e06981683
SHA1 355c7ef0f785db8040f0a12cf07e355645b8d250
SHA512 f50730f59c59f37e2a8a60ad73646e27b6271b2e715ca0dceb61898c43da2e2b085525028237976df3a77d5ce06d0a0f99a712ad444be14b841da54cca2edb11
SSDEEP 768:GDFrI3LwgYqsYeSFajLktJnqMwQi5BgK5/CwYcZu2sS6r:GI3uqgHqVmBg8/d82s9r
TLSH
T1A4136BF298E385BBD8AE9747A77E2E019EBCC153B8944550B7C9490DCD974BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69ba0420-6aee-4f3a-91ab-7f59e8e3700b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69ba0420-6aee-4f3a-91ab-7f59e8e3700b.tmp
Size 392B
SHA256 13a44d0f717d5847de4fff3d1bf54fac6738a70bc43a976563d8c4895e01cfd8
MD5 16625d88f1e86c01a7645487af424864
SHA1 63de9491c97715ffff40b99d1c19b338e31b6f54
SHA512 8c7fa1cb570f32be619dc0d18ec4f5e15551749bc6f05fa041ae40e5a6d4ed1286fe69f3603c5d0848097c989db733c67c9b55259b7c5b219cdcb3618baefd16
TLSH
T131E00202970091AEC039133410C73F30BEB2C420339342060B32017D6C313003F21EC4
MD5 SHA1 SHA512 TLSH

Submit Download

6da15db5-bbf6-4873-8878-affe3f5cca15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6da15db5-bbf6-4873-8878-affe3f5cca15.tmp
Size 41KB
SHA256 dbce63f42ac504a33c99761d124f83f20bb885f289517690fef66fafb3a51f2b
MD5 a6cd095a3a0a9162f1b3f92af4293262
SHA1 2a974aabb27deeab8fbfe03f7bf095e9b1e0b61d
SHA512 d972bdccf7ee85701e02b719e4fcd7ecbcc62ac7b12cd827c7aef61a110c1240b9c8c854bb7562abd3aa3ef256cc2d13d0d1f9794468384c8eeba0c4ffbbd92c
SSDEEP 768:GDFG838wgYqcYeSFajLktdunqMwQi5BgK5/CwYcZu2sS6r:n83lqwH+uVmBg8/d82s9r
TLSH
T1F1136BF298E385BBD8AE9747A77E2E019EBCC153B8944550B7D9490DCD874BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70414a97-7cd2-4134-89d5-27e9b78303e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70414a97-7cd2-4134-89d5-27e9b78303e3.tmp
Size 33KB
SHA256 875347186b39e780061a9f1d3404ae6e1f3aca1fe358e2f04b7a2dea599f0c08
MD5 d3d063cc99a1d8e2eee86f0236d79479
SHA1 e9cd2a6e6d3fedcd3ea73b1861cf769e78af31e1
SHA512 643bbb537977e419df552319e8c3506df0289dd80969e91952d1d26cdf19fb9c72f7e58ad8f27dd0dade780bc770acc1f616d0ad361e4f5c54d5f049322e59f0
SSDEEP 768:hf36qqYeSFajLktjnqMwQi5BgK5/CwYcZu2sS6r:hf36q+H8VmBg8/d82s9r
TLSH
T185F2BE31ECF189BB5CFA9244F2867646AFF49153D998095484EE9B0E02D7DEE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79be3207-abc9-4daa-959f-ea9001648117.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79be3207-abc9-4daa-959f-ea9001648117.tmp
Size 41KB
SHA256 2048d5b645dbba7d26f8dc5af7d1be69777b743d839a89b877c70ed19e08babd
MD5 0924217489858ae169fbf132c403725f
SHA1 eba6fcd1af64d8024d2d9cfa6d6601d0e88c9c1a
SHA512 1334ab6b032eab2f8a281c461426931df2c4f9946e1bebb563a35d891b0d0fbd5744c0598eae73d2a207268d8624b7cfcdb66757f7d08be3c9bc4e49cf41daaa
SSDEEP 768:GDFH838wgYqdYeSFajLktnnqMwQi5BgK5/CwYcZu2sS6r:k83lqPHoVmBg8/d82s9r
TLSH
T127136BF298E385BBD8AE9747A77E2E019EBCC153B8944550B7C9490DCD874BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

4a0f597d-acd2-4ea7-a86c-e459d644b5a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a0f597d-acd2-4ea7-a86c-e459d644b5a3.tmp
Size 12KB
SHA256 de642320091bcd88a670440d6bc77f1186ac4d21e1106d8385830dee5f39bdfe
MD5 a8589240d4fb46124f9ed980cdd2bd1a
SHA1 69c63e38b4fb4ebdd10cc9e4715f2f22aa951b6e
SHA512 7ff78dec796587e5b03409f039312a2a8c1a2325e8965a7ee8c6e26ef4ca8484b162dd825e84d1cd81a994e5278200d32d62f257232ae8d2f94594c1e24a871d
SSDEEP 192:sxRxRGOu/fbsUQ7R7+XzoA8pyXAy/g6+WNSnk/YlacwsGPIgDuTJ:sxRxLu/fbsUy7++O3/51/7+
TLSH
T1A942C7556D28697B8CCBE21DFB657F53E2F95032A4D01F48AAFD861C04E7ADE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c51a9c2-42e3-4be5-a03b-93a2c0f0def8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c51a9c2-42e3-4be5-a03b-93a2c0f0def8.tmp
Size 12KB
SHA256 ca8b11dbf94feacfee181d05e9ecf51684a8b02143218d7d609e9011e7ffb3f0
MD5 db302baaf3920d952ae70ba0fe23cc71
SHA1 6203240973674f9d6a44ffde0475d9a48b255a10
SHA512 025cd3cdaf8929f30759b0bdaebb73ffa11f0fb03343376f8608695771965cd1c7aa187622694da14ff37d8c70c9024942857f103fafbc8600f11cccbb2c2f1b
SSDEEP 192:sxRxRGOu/fbstQ7R7+XzoA8pyXAy/g6+WNSnk/YlactsGPIgDwTJ:sxRxLu/fbsty7++O3/51/ws
TLSH
T11D42C7156D28A97B8CCBE21DFB657B53D2F95032A4D01F48E6FD861C04E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66ec6e1b-e150-4140-983c-34734a79e4db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66ec6e1b-e150-4140-983c-34734a79e4db.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

831f7c2f-cd99-4cab-a9e3-0c1afded748a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\831f7c2f-cd99-4cab-a9e3-0c1afded748a.tmp
Size 12KB
SHA256 39f29aff52329c69d96666c929013e8c0bce964f79d9db7a4ac84ca25c42a2fc
MD5 ac03eb743d34f406a7c8727bca766194
SHA1 9c0e16750a852f1f2ce61a504fa3c54d9c81dc93
SHA512 e571e48586365fde1f3f8f4c4a02cdfdfd41ff3a3a9a6caf021c80f6e37fb0e08ec82ff70225cc37017cab6e4785462660b654512cd9c21cd6dd0d597bac6dd5
SSDEEP 192:sxRCRGOu/fbs3Q7R7+XzoA8pyXAy/g6+WNSnk/YlacbsGPIgxTJ:sxRCLu/fbs3y7++O3/51/+r
TLSH
T17142C7156D28A97B8CCBE21DFB657F53D2F95032A4D01F48EAFD851C04E66DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8330f3b9-89c0-488a-9531-08a58fa39449.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8330f3b9-89c0-488a-9531-08a58fa39449.tmp
Size 26KB
SHA256 e86f5e596043b5d0c0b7d59430bf4d404361fa1f2033fa0743b2c75fb2985f29
MD5 429f5f0ed75cf380a6af438557a7a2b6
SHA1 52036293804a3f89b5a1b0b4fd239aba92a85138
SHA512 eb815ac4cdaa93c31d01d8ee6ecd9801f8e6c81318f60b887fe0fcc5b6e5316ea5dba4bcaeb6385af1af30d1b6804d7fa1fe0503f72d9256bcde585cbc2c19fd
SSDEEP 384:sxRxLu/fbsY66s8qMpRiYnazAW8pZS15posJWeT+vy7P+c+/5d38+:sFLu/fz4Mnc7WeT+vyzA/5pN
TLSH
T124C20605A914C87B9EC36D18A53D7E33EAAC506222C5CEDE5AECCA1C019E1FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 bd8e86b0bf38f7537dd6a3be5b60cfe310a6acdf467751f597d56647cb2ace08
MD5 f1f100092ebb215cb81ad6d2592eb13d
SHA1 e5e57850567bb028acfad95f23a6d9c636a2ef30
SHA512 9ca6d18d9779c34490ca239d8a1a3a9ca800fea674610a84a8261439ee863a6c8f9a95f389124ebe5983dcac74ef96d0159b85d3e8466cf046f6414206e7f98f
TLSH
T1A6E020D424E7C22D620C64C7027C576CC7C0361AD2C06D5D7788C945B5455406AC3964
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 7d8aba7dc6eccb11433302176a1ebfff337843fcc16ef416d5e840fb70ed9b29
MD5 7cb219ef2a36b6e51cffc520978b8e21
SHA1 cb50756582fd5c5da7a88ffb05942017aae67ee8
SHA512 2b7687d7d9928995901f62e76bc8ac1f59d4cac5e541abface41116db1ca83d3ac0c545152d50d3cf092b9aaebce0fe4bd192a823425ac1edfee006bd63c2b73
TLSH
T127E026E436CAC63EB20C64CF016E6B0C83C0761AD3C06D9EA740DB84F406080E2C36A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cea7281c415a9da43c646a57a3dfb1e51cd485a04e7688db595622063e6606fc
MD5 988a160f1b617986cc51017efea6249e
SHA1 f4ef1ab4469f1ad59627dce1a5d634c976a6f542
SHA512 fb5e8292b884eea0c78176a5441e51c3d8173f9fbbf5b273d58910b98afaeb8c7ba4b31257fd1912da42436deecfdadb1ab5e9ac10a00900a7d089aee811b33a
TLSH
T1CBE026E4A4EECA6EA21C74C7427CD74CCBD03A1A93C86DAEE740C5847805950A3E3AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fee57f834c6136d5df48d6d1c10f3c5cf3b470d92dd5896c682738ec886c1b02
MD5 d3159e2de8d1d7823b0ce1f3bbf60fbb
SHA1 2c0118013187b8d37fa95e69462b13fcb738cf6c
SHA512 bb01bae64923a0aee3ff1df8cb9f12c921fd0e476ef64650137758dc3ab8fab4e4f7574eb4e22dafcd7cca95a7f30a2f8c3bd111effff8b5f979f67eedde50f9
TLSH
T17BE020D437C7C23EE10C6497015D6B4C93D0365E92C06D5D6F40C644B486940E697960
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 19KB
SHA256 9a6480c27f3d85ab0fe27c86ad90578b38485941eb445c371d45a24f374cc2f3
MD5 7cdfdd08588d80f67878780e83ce9a6a
SHA1 11f04afea49a5afcb00361c726835d93820625fb
SHA512 facf0c9ff946034fc3523abebfe60bf88b1f1f5516892c6faf736841d9716c0b02588c32d79defb7a7b36fe06aad72edda42447a0a1e42a947b5a5a6b0095082
SSDEEP 384:6N1N3tCFuEfK1YqelUtWHIM/OpRhJOI0AfNQDrDxJWQuL8ZxVMatcAAK2:6FqhfkdeitC/OyPrDx3ZxVjiAX2
TLSH
T17592E15D5AFDF9403424DDC70A443AD6ECFCB5A9A2C6D8051D50EAEAB4A4B403AB3D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 18KB
SHA256 73a800df6d5bd5c1e823a4cbc1e97b7e32404defa7463446bbb9aa7dc692b287
MD5 8919f94703a34033a1253f26b02ef207
SHA1 9616538db385f991b9424a71022c66205a012650
SHA512 d86234f05dd5ed6e80d192c21b7c9404f357fa56c41f770dfb4f38679dfe2b5d69f48dacd17d8f9d46a29cdaf70c9438eb8749627b56b582eb454d161b6cbf75
SSDEEP 384:dCerDt6EueZGpHCePUkOy4/HsOdxbFKG7Of1ti2CR5i9jhRdE:MeQEueZGpiePTCH7doqONtidu9tRdE
TLSH
T1ED82D059FAFF552C467C21DEC28DA14F32FF0D27E59C70F4886128E1055986C62938F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 39KB
SHA256 351740773d7f76fdcbc590e4877f82b43b6b302e055b4a212b5f0eeeb7d75c72
MD5 cc0a7c6e4d5d6be516c7a0e9bab02d67
SHA1 4aec30569325f3c30837d976910f17894fc7cb5f
SHA512 570ea83d4c122d9889baad2579f1653962e59ce778db8cdf94a98831dfeded91668c7d2e80fdfb8c3f702e902593d3df351300370c1c5e0d61bfe5617b755ef7
SSDEEP 768:Cob8upP5M7nN5mfoc6hHsJeDy+Itjui1hnh1R8FghRFH4uIylFW/0Qmp5k8R:Z5m6fZDeYnagDFYdyrV5rR
TLSH
T13B03F190E091176E363637A7BC65993F8C09EB737F94F1728A4A0EB690C4512363A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 16KB
SHA256 389e792f61dc58c32cc612285165ee8e8c79e138605259368f8affd44c51483b
MD5 c2a0c4c9993832b29257858c2e16931d
SHA1 843efc421933a9e3030164a06b2ac0b0496d92e1
SHA512 eaeb759b2fe4897216275c5322b12db5592ab241097d550c75edb6cfa3da4483e25ac899f9039f418a4b86c5375b4e8216a3509e0a1ad29d1cf0424b984faddb
SSDEEP 384:afbgCIaaHqiJS3jDaOReuCWPDnETudknLRqSaYM5bzDnp5q5sSyOop0N:UgtaapE3CORVnTalq1dH+5dN
TLSH
T1EB72D1CCEB71F1D29971ACA487F313FBB2D5E1A88D0BD8C0188396790C81EC939168D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 16KB
SHA256 9b2d404ca0e70ba1b5b5ca26bc805f8aae691a5f48495e86acfb9391f7b23498
MD5 c92efe212dab8d352f56ec2d26d20bd9
SHA1 58fbd2c8037459f84ac9ed9f4945816d5748148a
SHA512 f9e36abba94b30f616096ef00c2ea173c3c4746b6822362e77d514bde216ef9c4b22a3c8cc70b2c1fc8306d3a7c86bbe0aefafcb9051c3530a1ef22fa5338801
SSDEEP 384:Swgz5sn7+AnnWi3XNznUv6n5W+xUwML5H5NS6TZc5eQeE1DCDX/an:SwgyJWin1B5LUwc5ZNS6lcgQeEWSn
TLSH
T1CE72E04E8BC414D0DDAB71346061F26097398F11A6E9C66F6879BEC11F7B0FC5E00A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 17KB
SHA256 509afc34c25c6d1596a0c66cc68e6782ad010b0f1b2899cb1b6ed1a4967dc56d
MD5 7932d8247ba3c5cf9070cd2e975aa658
SHA1 e85b41874edaa8f0223680ecb59c1409d6810064
SHA512 2b63a7fe708a8ae384111abc00512cd088eba49d9ef96b020fc9bd52d29387121b88b3d9941c2bae809450b82354f7e98112f845c5960ad1c2f3f6d61b673c05
SSDEEP 384:c7oKauBDf6yee0oXJmgCYAffsS11PpO5qakjaAwD:0kuBDftDXJdC1MydpO5qnjahD
TLSH
T1B082D17B0E444077798DFBA9C9D5644F246839F2738EAC2B96A38651F21804F367A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 34KB
SHA256 623f1012da8b736eb6afb0753cae473f8e8545b126564bda9973b5b37c90e905
MD5 abbbec37b72261e91a5811dd781148fb
SHA1 0dc434d56e7dcae6a1d6acc4415562402f7fd306
SHA512 43cd04831f12b2858c117e46efa0829d05f044eba6d37c04a3b142152eebeedb9c46a309c4cdcf1047a487162de59709129e58f55fe0bd5cd3004cd688b11347
SSDEEP 768:Lh3Tk9PrAYLHZpCXCJ6t8+mgvNaHOckx4h6dmHNGymHteITF:F3Tk9P0mZc1mg1aH24h2mTmNe+
TLSH
T188F202255F578854E0BDCB60F95D3C2A80BC432A09169949FF06302C9FA8947B2DF7B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 81295dfb34411cc09a71712770899df5099d5f6e1454daaa0d362e740ebd2f0c
MD5 9eed402584785103b9962b73318192d3
SHA1 a6099c41deb76838fd38aabf0749259a394e1336
SHA512 5fa5630f5f1cb0aa3b99ad693cce719cd6e26adda33deb5737e3f6abebb92469d0899bd64ffe7b970b721d3374ef1089821ef78328bff7a40abda81a742c1df0
SSDEEP 192:lmOHznlqacDMntDKNNCe6K3jVbxoIpCwuMAKN2TJ5It5qENPkvkUXYd:QOT0acDMntDo76K3jxxoIpCw1J2TJ5It
TLSH
T1EEE1C6E3608890AAF77C87385AD44E4EF77EDE8011071E815407D6B97E2A39A4D5B33C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 48c2af274b6851f5194122cbdb8426b980e07e4ca28378f37169e3825dd41ed9
MD5 68a1e3884306624cf1834e3792f86e6e
SHA1 67e1a34d4b2bf59dcd574249aff8296fba6bb068
SHA512 a280c81dd6b196c83f637008fdf71c294bef91579d06ba8e303d1ee88eecd8d84ca7df766fa0f6d021e71d170a29065298bb974b5fcd3b990f129a4a51fe2397
SSDEEP 96:oWbF2jzn/jb/02LdintLpoTKx03Z9cGDCs70G/SIDMd0NL5q5I+i5Kl9iLI50Po3:Xp2jzn7bMSMntloTKe3Z6iCsIG/SIDMv
TLSH
T1BBC1C2E76008902EF76C4B3857D4184AFBBDE98056071E920456E6FD7E2A3DE429B37C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b55bdd421d31af2d8ba15a1c72d082a4ae84331d98883ad68810a758f6945c6
MD5 358067744d5c592e88e18b9e60418366
SHA1 23320f047e46466b4e9d7a18a97e099830e621ea
SHA512 a724e3b39ece7bec1dbc95a976b42b3794ee2ea51ebf74350817056cacaac166568c4a628c37f8be854fcecc3e11b9973b3d6e2bd0601b5b6bfee4f50b0e2713
TLSH
T1BC61A8B3754DC077F7BC8B3C85D9588F7BB8A5D05A431DD2049BEBB454063274289718
MD5 SHA1 SHA512 TLSH

Submit Download

93c7a28a-94b6-4d55-9cb1-7a293dc14ea0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\93c7a28a-94b6-4d55-9cb1-7a293dc14ea0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
Size 341B
SHA256 a4a4b35fdbc3726ad5c97887d22bca54951655ebc5ecc07a16588abe87cf92ce
MD5 6df00104c338e06943342786ce2682cd
SHA1 26d8e10f43fbeed1fc5649d022b80df6cf63a1f5
SHA512 22b28822c86713937b4745e3cd552bd1468ef7e01c74ea96ceb6b50476b210d032c1874c95f7fe66fd4def83934de7207506043f4b475d3fec13e362044f8647
TLSH
T1D2E068F8C0C9C61F522864D744387F0987A3210AD7C87D8D8F82C810B486044D1EE251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

23e25e4e-2e65-42ad-b86d-4d01ad2d1efe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23e25e4e-2e65-42ad-b86d-4d01ad2d1efe.tmp
Size 3KB
SHA256 0693026d7f1700db32bd9864c4081c52548babd1afbdf5e3a5c599228394d71a
MD5 c87a6ceca06817157f292ef7e022677f
SHA1 fcee5d46ef25bb7119f832b7a9c9f8c9acd55fdc
SHA512 93ffe380f8d9db12d098fd28fbf49b79695d44f7688d914c73f7e2a8112786ca5a67b5e44578ce835252f0711e20f29b5543d532e4f65e2cd8956416113416d3
TLSH
T1D161ABF787F5966D8A0255F0AA18AE2BCF2C0510831C7C6AC5E4BE1BD3E3872E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

59eee339-36db-4cf5-a81e-a673b974e077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59eee339-36db-4cf5-a81e-a673b974e077.tmp
Size 3KB
SHA256 660357f39612cc3782ff981d35e7f7b569458148343ed6b7cd0ba899d7c9a1da
MD5 03e955ac5e8f6ffe36d63bd15307e869
SHA1 930616b6444d58d2cb304b86803dd85020241448
SHA512 adeea86cee75bba6b6ef760a1cee715fdd32032c1c63eda9e40aeb95b42676b0bcf65a2d3bfa01e374bd3c4734275d0c4ea9d2b6575f989f8d05328d24762180
TLSH
T14B617AF787F5966D9A1295F0EA08AE1BCE2C0510831C786A85E0BE57D3E3872E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

8d36195a-48ec-499b-8feb-0855a6de7f70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8d36195a-48ec-499b-8feb-0855a6de7f70.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c371e70c-18f4-4663-b8e2-7fba1c594f2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c371e70c-18f4-4663-b8e2-7fba1c594f2b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e38a005a-8012-4702-be81-8583d9a723d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e38a005a-8012-4702-be81-8583d9a723d7.tmp
Size 1KB
SHA256 1a3724056a5dfbb199bc571f9fd771f9fe6bffc05b32c3331aa418aaf9be8aaf
MD5 dcd04aa42ae9b0c5942f25b0adbae78d
SHA1 106c44ec075d028361d2c022194fe5b1e19523e0
SHA512 550989a89e26c0931cb47f26b7e83595df0d523f1a8cadc8569ee75dc9677c55df0b7e587b02a703bb6ba807179a8d7c1c359ffe2d77378a4c8800168591e897
TLSH
T15B21DCF7C3E8567D890192F86B282E1BCE2D0915932C3D5BC8D49B5F93E18B1E29095E
MD5 SHA1 SHA512 TLSH

Submit Download

f34089ba-9979-4466-aa46-a815d20b6333.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f34089ba-9979-4466-aa46-a815d20b6333.tmp
Size 3KB
SHA256 837f9b682b5e4f419d8808e1eb3e4ba3371d567b40b0e50f6be15917da9df941
MD5 cf4bdea12092076789429fce924b7433
SHA1 6a458f0bafecf14d71aa8d8224046e6898dc0e55
SHA512 33b6e370675c41fb1ec3da1f390bb80c999734c6f8fadacdc8d3d0c024fa69e5fba05dab576116c20582f939a838d0bbb8f4de63a33ec0a6ffba275eba238769
TLSH
T14561ABF787F5966D8A0255F0AA18AE2BCF2C0510831C7C6AC5E4BE1BD3E3872E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\temp-index
Size 432B
SHA256 e3f074463ef54a4af9ae45fd3defa73fc5bc4ae39b42925acae67672cc1b3169
MD5 bcfc3d83054c79dce3e0843a209db980
SHA1 e83cc222ed512c54ca8e34eb7107892e0400d1fb
SHA512 e3b4a3e08b50a82a2ed89a35c48a90237d37635d6b0574bbac6e7c7777dbf268b425321b033bb999e9df01d9c08a79accd5c30b4f4af36a621783277b81676ff
TLSH
T11DE07DCD1D13431AF8588074303D64629AF139EC53BC7E0F60FD900A8C893D0AE46A28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\the-real-index
Size 432B
SHA256 1f68c0e90d802f529cbf73ffd822cfb0213c9b20ccb24f8d333332472f45c6f4
MD5 22aba848b847ffe7f4517e97b206104c
SHA1 2a6b7ab899b13093f3c7ff08b980781f3ebbafa9
SHA512 ff48f4cff4a7782fc773fda5dabac615c080acf6f87d002a94d6cc7ba64cdc8d377094534b3d53627ad941531ac80dd69b7dc887ccc2a6fbe41ead1db5aff8be
TLSH
T120E07D9941138345F8488130755E6026A2A15458D3B43A0F65EA5049C846B845D82F61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 8c0b14524c43a3f408e991e829f16fcd8754060d7f1189840615da07fca071c5
MD5 068bb54914cb828e175123556f616fcd
SHA1 c5710676b726584535ecbb584b4fd0ad6902b1fc
SHA512 e25eca654b4ecebae8e90eed2bbd4fcfe4dbe0803f1503948071d22c6fccaa3dddcab91e8a424812c8b52db695e1d563a790cd57caaa771e6151b0cc62f1eaa9
TLSH
T14FE0C0772EE72D24FCFF83E76871809041017914C5C1BD8E943F818750B23152822CD3
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b4b82309-3b45-4968-8f30-919ddd7ccac2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4b82309-3b45-4968-8f30-919ddd7ccac2.tmp
Size 23KB
SHA256 a5a7d1334181babbff2f6d32091b095daff539e0c2805c1a030627871b93662a
MD5 efb409722db5b9499485d7f198817239
SHA1 51040a88d1ed0ef85bd3b04e74b50c111b14047d
SHA512 2848ded8a3ce0df4846cf450e522ee3b73ca1a09fdc5c3640e8ef76aa2ed055168fc947fdc099055172f56e45650758eaee9dba5b3ea2db34b51f9f667b89788
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRf+roe2k:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0V3
TLSH
T1E5B2E92B640CCB7E4F814AEDDC196F976E9C02C79A588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\3efd6442-ad77-4316-8d37-a1b42d0c4c16\1
Size 4.6MB
SHA256 eac410a8d88dd83f9613603fb12dd65153080682ee187a48789a72ddd24eee34
MD5 7518fff9ac7f5b8ecd4c1080d9f78198
SHA1 d354157471fb4f0faa6384dea7768ec6cbb12d92
SHA512 6986ea46e07b92f840b9b14dc66bd79b19aeb9f30cfc67049baa022fcdd9a1bb7d535aaee2a8bd9ccc4d86e0e7977380e0cf7c76097e57bc5c451d470d602818
SSDEEP 98304:8N3yjwQOF/lvlXAWCwFb8M7kIglppeyG127n+IkI/kwoD0hCk5AoJE0Mzj:8NgwQ+dtLZ7kIgJevQFr/RCeAov
TLSH
T1D8263391B19D99CE61E04431480FE631CE8A21DFB0A9149F1F9D67E875C87B071FE8AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\3efd6442-ad77-4316-8d37-a1b42d0c4c16\3
Size 19.6MB
SHA256 9bb5856a055817c8c5ffe70acc79d7ccc2175c8b811073997c4213edfc566202
MD5 96cb6a1a8907a0c62cc3d03d1a8b2931
SHA1 26fa618dcd59f828ce0b55aeeadc477ca0c3f97e
SHA512 74869462c357a36b1e34dbd39bbd5392b7c9657c7580790f3456a53ebecf673d87aca24105f6439552c966158795b2c0f116c3526f25f3b993ce7211459a3a9e
SSDEEP 393216:XaJb0VTZrEld++oL7F4v4WS5R4yjcBeekGQQ1:Kl0VT6d++oLh42R4y4Beek5Q1
TLSH
T15F27330748C6357FEDB668359542273464F52E65B6089FCB7A80B731B9B93F4EE32A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd923d8e-4854-4594-a5e8-19a14a93ae14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dd923d8e-4854-4594-a5e8-19a14a93ae14.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 28270a199dd7fed5995a062b8385f946c42695b4e1824f4bd9407f4860a7d3b5
MD5 8e868b1e314163da2326bbda093a6704
SHA1 03c4d3ddd2c28a29260678caf7e8c54e605f0cb7
SHA512 8828676b2296b237d7fd48ca15dc025a7c9ee63cc1867753ef61742724731d0a99d8eb01a37bcb36f40068bc41d201fd000f679a8ea70bcc8d814b4f274f85da
SSDEEP 768:pA36qVYeSFajLktunqMwQi5BgK5/CwYcZu2sS6r:pA36qHHDVmBg8/d82s9r
TLSH
T191F2AE31ECF18ABB1CFA9244F6867646AFF49153D998095488EE5B0E0297DFE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8985d7f1289823c14afd891f48ff5fd535c65c2eeab845939fd5e2e2ebd7a111
MD5 728ffb366f0ff40edae5375f8458a928
SHA1 1347410c7e9a17af27f18ecd8887547a106ef7f4
SHA512 937a3842fba336a367149828900bc4d5df57134a71bf71bcbd28484e93e854d619f69406da26b6d75d36e7db3fc8b6b88b52c7b00cc9385511449a4118aabe58
MD5 SHA1 SHA512

Submit Download

b05430ff-332d-463c-88ca-ce297e104de8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b05430ff-332d-463c-88ca-ce297e104de8.tmp
Size 41KB
SHA256 2c542605bfd8fb3043f42cf50132f31a1c27ecec8d5cdd2b8ce3a6ab07fc1682
MD5 294017c664807360cb4a0e8f72ca6cf7
SHA1 61c3c734fa638561637e16c93ab54255e4b79325
SHA512 3131b5d62a0796607e39b2511f39c3780f17e93cf81db2632f80ff832b081eadb1851cb418390ed06d86145a39111d36ba68a8b686d2c0536a93926601d99600
SSDEEP 768:GDFgW3LwgYqXYeSFajLkt/nqMwQi5BgK5/CwYcZu2sS6r:9W3uq5HgVmBg8/d82s9r
TLSH
T17E136BF298E385BBD8AE9747A77E2E019EBCC153B8944554B7C9490DCD874BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b34f6cd6-9306-4cb7-82ab-311de120e2e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b34f6cd6-9306-4cb7-82ab-311de120e2e6.tmp
Size 37KB
SHA256 e17321dc38794ed1f5c5596623cba585a197575e1a60956286575b8417115418
MD5 3f746d88988120eb33f81fc8b87ea751
SHA1 dcae51ab666c5d6c54f8651b05bea1e53979a4f4
SHA512 53c2f44c26a28884bf26b919d959de8829ea4c2ffbcc190654bf0ae0fd90d557b89c8736d7733f7bb43975c67c2a4990b47ee400dfa74c14ee2fe42a1699d28f
SSDEEP 768:O/UxvxjgC+Ft36NLESFajLTnqMwQi5BgK5/CwYclCA8Dea:DZj3+Ft36+HTVmBg8/dAA8Sa
TLSH
T18C03C036ECB59D778CF69240764A638BEFF441A3C584099849ED1E0E06D7AEC530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa1752ab-b51e-4e13-a59f-34f07d7b9748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa1752ab-b51e-4e13-a59f-34f07d7b9748.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fd603de5-aecd-44e9-8e6e-d66f8f7c0522.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd603de5-aecd-44e9-8e6e-d66f8f7c0522.tmp
Size 392B
SHA256 68ec3519674fb5cda152765bc08d3c5542f08445d83f47a443a492ee53ca26ab
MD5 939fa76e0ffeade29bf8e2b90bbac808
SHA1 20a662fd639d9a43822eaaa7c013ec84bcb8e729
SHA512 b68483eda7ce0f270b839c8a2c85112cc7e6258a36d8a095bcccad351ae563452fcdcc31ae31eaa03e4d661e117f7139a9749fde3c270955eec1de8d17a8a4e1
TLSH
T104E002029700919DC035113410473F305E92C420214142060B31016D5C303003F115C4
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 8558eca33b41503780909d68fdf38216e4eca450c9290e619be7cd4d1bfe0895
MD5 95a8d382e0195fa06865372372140e5f
SHA1 fc16015dfb646338238501548cabcd6a5d8d9b02
SHA512 95b721c976ba12cd323deb25f9f4dd86efd59b05dac5c801f724e6a74332d6d847df6ecde56872a64da6608b8bce6d508571ba071d911fb26799ebb597b4e8ca
SSDEEP 768:j0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdbaE:UZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1EB154137D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_bz2.pyd
Size 77KB
SHA256 0897e209676f5835f62e5985d7793c884fd91b0cfdfaff893fc05176f2f82095
MD5 a1fbcfbd82de566a6c99d1a7ab2d8a69
SHA1 3e8ba4c925c07f17c7dffab8fbb7b8b8863cad76
SHA512 55679427c041b2311cff4e97672102962f9d831e84f06f05600ecdc3826f6be5046aa541955f57f06e82ee72a4ee36f086da1f664f493fbe4cc0806e925afa04
SSDEEP 1536:szXz7Bgrj7FUHfuwttm8ebvwyBIMtVk7SyNU:oXzVMFOfuIRebvwyBIMtVk8
TLSH
T1B2738C92B3A455B5F45BB27995B10357E371BD0D03A0D3AFB754822F2F03B826C6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_ctypes.pyd
Size 116KB
SHA256 9ab1f8cbb50db3d9a00f74447a2275a89ec52d1139fc0a93010e59c412c2c850
MD5 92276f41ff9c856f4dbfa6508614e96c
SHA1 5bc8c3555e3407a3c78385ff2657de3dec55988e
SHA512 9df63ef04ea890dd0d38a26ac64a92392cf0a8d0ad77929727238e9e456450518404c1b6bb40844522fca27761c4e864550aacb96e825c4e4b367a59892a09e7
SSDEEP 3072:zW66GKh4hqyIVQoavMSut/SfrS34ep9x3FIMQPwnJC:C6QKtkSuZSfrSlFLJC
TLSH
T1F7C35B1B2354009AEB67507CC5B35E47DB71B84A572083CF12A4C69E2F63BA36E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_hashlib.pyd
Size 59KB
SHA256 2e30544d07f1c55d741b03992ea57d1aa519edaaa121e889f301a5b8b6557fe4
MD5 ad6e31dba413be7e082fab3dbafb3ecc
SHA1 f26886c841d1c61fb0da14e20e57e7202eefbacc
SHA512 6401664e5c942d98c6fa955cc2424dfa0c973bd0ac1e515f7640c975bba366af1b3e403ea50e753f837dcd82a04af2ce043e22b15fa9976af7cbb30b3ac80452
SSDEEP 768:8nvx+iVPY7S+NbM2S2uoU1lyZjWv4so5IM5IkzrYiSyvchym:FWPYW+Nbs2uP1UZjWv1o5IM5I4r7Syrm
TLSH
T150536C46E64440A1D57383B8D9930EABE671F5409352A7EF4364C18E2F23BC367BB7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_lzma.pyd
Size 150KB
SHA256 ce72d59a0e96077c9ea3f1fd7b011287248dc8d80fd3c16916a1d9040a9a941f
MD5 a6bee109071bbcf24e4d82498d376f82
SHA1 1babacdfaa60e39e21602908047219d111ed8657
SHA512 8cb2dafd19f212e71fa32cb74dad303af68eaa77a63ccf6d3a6ae82e09ac988f71fe82f8f2858a9c616b06dc42023203fa9f7511fac32023be0bc8392272c336
SSDEEP 3072:rD6xBrqs+vs0H0q8bnpbVZbXsAI0znfo9mNoJ5vSpxpBIMe19cc:rD63rcRLCV+qwYOJ50Pk
TLSH
T142E33A96A394F0E6F7228C78D6624F57D7F578090310929A02CC876D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_queue.pyd
Size 26KB
SHA256 8e7e758150ea066299a956f268c3eb04bc800e9f3395402cd407c486844a9595
MD5 8dd33fe76645636520c5d976b8a2b6fc
SHA1 12988ddd52cbb0ce0f3b96ce19a1827b237ed5f7
SHA512 e7b4b5662ebd8efb2e4b6f47eb2021afacd52b100db2df66331ca79a4fb2149cac621d5f18ab8ab9cfadbd677274db798ebad9b1d3e46e29f4c92828fd88c187
SSDEEP 384:vfqkQfdUCUFYS9F6Xg6rEGSSVYptTDbFIM7UoIYiSy1pCQW3hL8:sdUC+F6rEGSSVYTFIM7UxYiSyvQho
TLSH
T1A4C27EC2EB681896D073C53054E25E15FE71FA929711C3DF3229C26E2F23782367D66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_socket.pyd
Size 73KB
SHA256 130de3506471878031aecc4c9d38355a4719edd3786f27262a724efc287a47b9
MD5 c5378bac8c03d7ef46305ee8394560f5
SHA1 2aa7bc90c0ec4d21113b8aa6709569d59fadd329
SHA512 1ecb88c62a9daad93ec85f137440e782dcc40d7f1598b5809ab41bf86a5c97224e2361c0e738c1387c6376f2f24d284583fd001c4e1324d72d6989d0b84bf856
SSDEEP 1536:0mtvsZWgzruIAl9/s+S+pByXc/+lvFIMQwY7Sy3:z5IJzrAl9/sT+pB8c/SvFIMQwYJ
TLSH
T1C0734A12A69051BAE2738079C1635F23FB70F491179593CF1264DA6E1F237829E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\_ssl.pyd
Size 152KB
SHA256 5a4c78adedf0bcb5fc422faac619b4c7b57e3d7ba4f2d47a98c1fb81a503b6b7
MD5 9d810454bc451ff440ec95de36088909
SHA1 8c890b934a2d84c548a09461ca1e783810f075be
SHA512 0800666f848faec976366dbfd2c65e7b7e1d8375d5d9e7d019bf364a1f480216c271c3bcf994dbab19290d336cf691cd8235e636f3dbc4d2a77f4760871c19ed
SSDEEP 3072:l9Y1GpXg28PqCBWZxVkc85nu9ekFc8j8V+AOXLkdWXxZIIkjIIBIMt7LU:l9Y0BgdqCETavu9L6V+RrIo
TLSH
T1E4E37C47F24419A7E813E4BDC6630A02EBB5F045231197CE49D6C68A4F13B46AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\base_library.zip
Size 812KB
SHA256 8d62379941335d3b87f9eb3d8d9a83e7e84630c305dee477aed9b3a78ca444e9
MD5 a928becdfac91f1d4407812a6057e55d
SHA1 c0fe8327b62290dae4d26e7c9a68c92790337616
SHA512 600210e0bd4162e2122bc2499d803d7972582504578ea6d7b9abfbd8d8b377563f3f7b3b73701acf6e411cc4d838726a0c4805415d192b7eff6365d39a468d4c
SSDEEP 12288:4EHYKPY+WygVqFcIWrA4a2YCddVw9lfJEawKxSRMNwj:4EHYMVgDLa2XVw9lfJEawKIMNwj
TLSH
T17205288069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\python3.dll
Size 60KB
SHA256 84a29c369560c5175d22ee764fe8ada882ab6b37b6b10c005404153518a344ec
MD5 0812ee5d8abc0072957e9415ba6e62f2
SHA1 ea05c427e46c5d9470ba81d6b7cbca6838ee0dd5
SHA512 18ca5631f2ae957b9ec8eaa7aa87094d3a296548790ced970752625a0f271511e0ce0042a0ea5469a9c362a0d811c530ef6fe41b84c61b25c838466acc37f22b
SSDEEP 768:Ba8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq5:Bawewnvtjnsfw1FIMQ0Q7Syn
TLSH
T164535D529B64FCA2DAFAA5FC38D1998D582B12CC932584DCB47993D30E1A310A127F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\python310.dll
Size 4.2MB
SHA256 8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e
MD5 a1185bef38fdba5e3fe6a71f93a9d142
SHA1 e2b40f5e518ad000002b239a84c153fdc35df4eb
SHA512 cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4
SSDEEP 49152:kAz5zjppNAQdRnpoFPN7RhvPSUrRBthux243ahuxZplZTJycg7gpP7Bz5AIu35H8:9NPNE1NJpGgk7J3uJHsMraSSFP+4j
TLSH
T17C267B26A36401A4D9B79477C527864BCBF1BC402F24D34E41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\select.pyd
Size 25KB
SHA256 cb643556c2dcdb957137b25c8a33855067e0d07547e547587c9886238253bfe5
MD5 63ede3c60ee921074647ec0278e6aa45
SHA1 a02c42d3849ad8c03ce60f2fd1797b1901441f26
SHA512 d0babc48b0e470abdafad6205cc0824eec66dbb5bff771cee6d99a0577373a2de2ffab93e86c42c7642e49999a03546f94e7630d3c58db2cff8f26debc67fcad
SSDEEP 384:dPjk/7e12hwheCnHqJYBsVRXFIM7Gh+IYiSy1pCQyvUhD:NUC2hwhjHqWYVFIM7GdYiSyvdhD
TLSH
T1ECC28F86AB505C82E4338571A5E28F06FD35B6A18720C2DF7369C26D2F12782337F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35282\unicodedata.pyd
Size 1.1MB
SHA256 09e1d1e9190160959696aeddb0324667fef39f338edc28f49b5f518b92f27f5f
MD5 d67ac58da9e60e5b7ef3745fdda74f7d
SHA1 092faa0a13f99fd05c63395ee8ee9aa2bb1ca478
SHA512 9d510135e4106fef0640565e73d438b4398f7aa65a36e3ea21d8241f07fec7a23e721e8696b3605147e5ce5365684e84e8145001201a19d7537e8f61b20cf32c
SSDEEP 12288:ZrlBMmuZ63N5QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOK4:JlBueZV0m81MMREtV6Vo4uYOK4
TLSH
T15A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f5e2eb0-2dbf-4e99-818d-47047537f195.tmp

Path C:\Users\Admin\Downloads\7f5e2eb0-2dbf-4e99-818d-47047537f195.tmp
Size 9.6MB
SHA256 0300dac75dd8113e3aa6f4087d0a981956707ae8fd14e2ae87fe70e0dd14f25d
MD5 f5e77e311f9027a79c682006cab70a09
SHA1 812cb9dfef4db6eee9e542638a76c9cda9bf0f62
SHA512 dad2c41eaf46eae81f457c65ad63527d9562c6a406d7b8f37b15ff20d06d10533064aca06efc2e3e099d19b6352c17ddb1291293d07b391c09104967076c294f
SSDEEP 196608:flcA1vW0bF7FoRE2nOL2Vmd6+DMnNgwQ+dtLZ7kIgJevQFr/RCeAov:tf1FeREWOL2Vmd6m8Njd78JevMYeAo
TLSH
T1D5A6334132A019F9E4B38471C84ADA22C6A2795F6355868F4BB0CBB23F075F15DBB7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba182084-01f6-48be-bb30-82aa373bf48a.tmp

Path C:\Users\Admin\Downloads\ba182084-01f6-48be-bb30-82aa373bf48a.tmp
Size 24.6MB
SHA256 572fd4c118486b78caea6f3a7f6d0b48c948c1dfb2edaf4b3727f5d75ea82f30
MD5 ab447cc214870e233d98728baf05645f
SHA1 e4b26c7b6b62e20758cc229d43f932d5baada1f5
SHA512 5f009a2398bdec7d022ef1ba08939fa916eb495d29f803fc080834bbc6c5b8fd12b02efa59441e34cc5e20a4e259386cad23469d03104440132d159915adfe9e
SSDEEP 393216:mgKRPHv4aJb0VTZrEld++oL7F4v4WS5R4yjcBeekGQQ1:m3Nl0VT6d++oLh42R4y4Beek5Q1
TLSH
T1F747330749C6757FECB265358246273460F52E62B6089FCB7A80B731B9B97F4EE36600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4780-1006-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1049-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1050-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1052-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1053-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1054-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1055-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1056-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1057-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1058-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1059-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1060-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1061-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1063-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1062-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1064-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1065-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1066-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1068-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1067-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1070-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1072-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1071-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1074-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1073-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1075-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1077-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1076-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1079-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1078-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1080-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1082-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1081-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1085-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1084-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1086-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1088-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1087-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1089-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1090-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1091-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1093-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1092-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1095-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1094-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1096-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1099-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1098-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1100-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1101-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1102-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1103-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1104-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1106-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1105-0x000000000BA80000-0x000000000BA90000-memory.dmp

Download

memory/4780-1107-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1048-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/4780-1005-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1004-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1003-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1002-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1001-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-1000-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download

memory/4780-999-0x00000000080C0000-0x00000000080D0000-memory.dmp

Download