3520dd9ebad9498685a28bd3ea52fcb61732b75f314fa501948b91e5bece39bb

Resubmissions

22/05/2023, 15:51

230522-tazdysca7s 5

22/05/2023, 15:46

230522-s73l7shd42 4

Analysis

max time kernel
275s
max time network
257s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

17KB
MD5

e0f60606773d0775b7195023bfced4d3
SHA1

19ab2c158865f67131d1c02d10df4653e1f1cba7
SHA256

3520dd9ebad9498685a28bd3ea52fcb61732b75f314fa501948b91e5bece39bb
SHA512

ed487512b89b3a64eea0351c0586f6844df72a18f474b7f914601b92064888dc8e435f335ff1d4b533450417e8ab4f6d5fd1211f1a8048101273ba73be98fb99
SSDEEP

384:rHMKIL8DpmRgVoOsKTElKeGM7U3Hhhb22p7X28B2XBJCBXQL:rHdIQfVoOsKgI1MeBhbx5nQJQQL

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4e51f915-b82f-4bef-8531-1d67076a307d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230522174710.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "241"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdoma = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\MuiCache	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
3836	msedge.exe
3836	msedge.exe
1684	msedge.exe
1684	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
3912	msedge.exe
3912	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2324	Process not Found
856	Process not Found
5276	Process not Found
464	Process not Found
2640	Process not Found
1316	Process not Found
4608	Process not Found
1764	Process not Found
6068	Process not Found
5160	Process not Found
2148	Process not Found
2552	Process not Found
5560	Process not Found
5676	Process not Found
5684	Process not Found
340	Process not Found
4904	Process not Found
1536	Process not Found
5336	Process not Found
3108	Process not Found
5592	Process not Found
5596	Process not Found
1592	Process not Found
5616	Process not Found
5564	Process not Found
5376	Process not Found
924	Process not Found
5576	Process not Found
3440	Process not Found
4868	Process not Found
4588	Process not Found
556	Process not Found
216	Process not Found
4640	Process not Found
3168	Process not Found
3836	Process not Found
4000	Process not Found
1992	Process not Found
4036	Process not Found
4128	Process not Found
4972	Process not Found
4216	Process not Found
3736	Process not Found
772	Process not Found
1460	Process not Found
5460	Process not Found
4920	Process not Found
1276	Process not Found
2288	Process not Found
1064	Process not Found
2904	Process not Found
4968	Process not Found
5244	Process not Found
2712	Process not Found
4352	Process not Found
3336	Process not Found
1940	Process not Found
2488	Process not Found
5952	Process not Found
5140	Process not Found
5784	Process not Found
6136	Process not Found
3816	Process not Found
2856	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeManageVolumePrivilege	4944	svchost.exe
Token: SeDebugPrivilege	4688	wwahost.exe
Token: SeDebugPrivilege	4688	wwahost.exe
Token: SeDebugPrivilege	4688	wwahost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4688	wwahost.exe
5388	SystemSettingsAdminFlows.exe
6040	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1156	1684	msedge.exe	86
PID 1684 wrote to memory of 1156	1684	msedge.exe	86
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 2264	1684	msedge.exe	87
PID 1684 wrote to memory of 3836	1684	msedge.exe	88
PID 1684 wrote to memory of 3836	1684	msedge.exe	88
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90
PID 1684 wrote to memory of 2624	1684	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc48a046f8,0x7ffc48a04708,0x7ffc48a04718
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7ec2e5460,0x7ff7ec2e5470,0x7ff7ec2e5480
    3⤵
    PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12889300325435861,6808813844018085488,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5694263ch3159h4926h938ah719dd8376e04
1⤵
PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc48a046f8,0x7ffc48a04708,0x7ffc48a04718
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,15266084634712544846,13837277021586232108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EditUser S-1-5-21-2805025096-2326403612-4231045514-1001
1⤵
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3916055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27cf7f40b1602952176a3c5a37f27152

SHA1
194b35838088a22b462c10d3640b2eaac35f5fc5

SHA256
606dfa33084b3274b9f61725a05dbe29a4c68474aa07ffa9cb6e2562d5f27850

SHA512
f1c8aabab4669876d8e21090d9b326578793f6b49fda49c0d795173ba1a58c75c74c68d2ee7cd3024953a6708c7f3362fe51bc243eaacd2dfd3d2d1755a5a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba108266d24b6453b6ec1dd521795f83

SHA1
0e1d18336d389a06ebe41568ea472b19a0bbfa8c

SHA256
636953aa8fe933c52c8e0ab45da67eb31184ceb1381c8e06a7c94855562de80d

SHA512
869e40ef0b8c5adbe794c86a6b33a8ac84ec873634e3801e96d58b49eb704d228ea35a08fa5715b91983678c02b54b6bc6828568d166f2d9dc43af02bc3c2672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
32b0e3114288e45699836f3617ee8506

SHA1
7bbdc3fade42ee49e10966c6a68bcd3648c234f9

SHA256
83e0bde6e7aaf7708b939864d8697b32684c569be51eeec627bef2a6583adce0

SHA512
d4b294b919d17e1af23f340aadd462139680ed378c18baa4dc1908cc608ae70eac727935ce709e64a296d308f21868e9f8f8b14310d061fd250dd10feedcfc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
32b0e3114288e45699836f3617ee8506

SHA1
7bbdc3fade42ee49e10966c6a68bcd3648c234f9

SHA256
83e0bde6e7aaf7708b939864d8697b32684c569be51eeec627bef2a6583adce0

SHA512
d4b294b919d17e1af23f340aadd462139680ed378c18baa4dc1908cc608ae70eac727935ce709e64a296d308f21868e9f8f8b14310d061fd250dd10feedcfc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
bf174a471f30e7c3bcd73806582f71bc

SHA1
b80ce18ed1957373fca3efdfa492041b716a1fe0

SHA256
d88bcdba249bf12dfeaa15082e96d2960e263ab5c2ca3c8adb2fa384f25f0332

SHA512
6ca7d7050394039d368705368b9045f00ef8177c300b36c1fc1fc9925c8fc6fa05753392b9f86fb7f9a9398799f2a237b7bc0386bb2aa57bb8345fe30250ff67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a5007628eb6fce13f9118a18411f0c26

SHA1
4f43c1f7f793e38fb0270a39494e0281b5600a0d

SHA256
c0ba4abef64c453f0e1e34d1fb63d14b952aa90d89757e1478e0607524f25c73

SHA512
301f314f4e7cc6487705222b48ec1e218a1f4af70d20f4b4bbe17a2e37875445f26687a7a6ee2b9d0ffa856d49f5e1aff89f99a7b73064304ce9fa320012a8ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
feba4f93d5e44fc2a79304f1f2e89f56

SHA1
80a51b2b26af2981cb4097be01e95782e2bc3eac

SHA256
64db7efa88203c37d334a52f9ae00b7a68d46a580edeb63185e4ab088bc63049

SHA512
1eea48fb6982d5e64ad80de6b0217dcca9eadda64dce2b9fe2f1bc11c0d5014b98a9cd8c7cbd5395aec4012b832d90a5ece92e68bd9c232113be760052531236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1d47aea89849e5492d8b5f8375da7fe

SHA1
0c0e7e597f441ad1368eea294f2a3e53f8e50f53

SHA256
f03ab95eb151c0246f092c2cfb23b74d52e641aea3f306c4aa190f36b2ba2fb7

SHA512
73d3ebe04202453fc910b283b5f65c8887c054a7fcd7d02f5674b8a42796202ac9d0b91e5ac863e5f30c7327c152fdc88ecbe416ac461f3301747fa2c83fc367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a940db45-c83a-4925-859f-c5855b8d73b3.tmp

Filesize
4KB

MD5
cb2b7ba0023491acc55f290aacc58ac0

SHA1
f86577a0b8153589d3391912e3c2ea50cb43ecdc

SHA256
37d4f0d45efb91d43b38d9ac4997da81b899f825c65ea3689d6ac124dd8377b7

SHA512
76e1ca79d5ee044823ffd0c2093564c352bf663b199973505aa55b9e88e857a61a80ce1a49de1f4b24e13c0d03a6b760de07118b1020677850a7cc3d93f47a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d829dcc839507b38b52b1f0a5329c26c

SHA1
c598759b3ac5d5852f5d4e62227f772ffa5f0519

SHA256
f3aee3601c5cba2c4a87b3b9f90378834fcb584dd8b48c18b113d5c555b16e87

SHA512
7412529285df2b4d9cdb5f1718d20b18efc719e8508a7dead83e2cb3534c766b82035ab0d9140abbb2c795485f54b15e0c32d4e5ab588b8ccafb561fdc7e1a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d829dcc839507b38b52b1f0a5329c26c

SHA1
c598759b3ac5d5852f5d4e62227f772ffa5f0519

SHA256
f3aee3601c5cba2c4a87b3b9f90378834fcb584dd8b48c18b113d5c555b16e87

SHA512
7412529285df2b4d9cdb5f1718d20b18efc719e8508a7dead83e2cb3534c766b82035ab0d9140abbb2c795485f54b15e0c32d4e5ab588b8ccafb561fdc7e1a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
c9f7d8bcdbcc48d7f700dc936e2a4708

SHA1
f5fd3553f894d5fcd1a7be80a4e35b43da1fe1ac

SHA256
a2cb345a71884e7b43772707cdd44846d603f2ce6ee5785cc401a616a145ea9f

SHA512
dfc56f811fe271f2368b4689b53151f474b77b5417b2f37569ac8f871aea28da7848b320f4f55b1f60bae400c44c3c1e44fe9853a54a5667706b056871dd48cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
71d9386b0c290a38df776d0643ff0525

SHA1
a2372aedf73d74afd07f6c7cc21e29fe33701252

SHA256
68bf31c221d924f9a9fa9938a88b3940df2f2f20fa33cda7b8b619136844663c

SHA512
9e3b6aace0ad7240957a1bb06ad7e3e5b5dbf3ab41a60b9faf0f010fe540c7e4eb84f2db99e560c732e3a80e4a3068e129906f6915ea480d2302cc8e5528e3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6b1569b85e2ea49712c68dd55e471ac0

SHA1
d5deb77b49858a79eab41b7950026426ec6716e3

SHA256
98f40403bfee2bf570926217169c034094f9cfbf185418417ef9e8eb25be6184

SHA512
8f5e6c9dca39fed5742e747c7c92edb1f46ed93997ce4968a1e385cb10903631b61b1a95e79153d12b92649ecd3320987bbda5a0fdb17de73f399534d8188765

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\NRAJ8KR7\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg

Filesize
3KB

MD5
ee5c8d9fb6248c938fd0dc19370e90bd

SHA1
d01a22720918b781338b5bbf9202b241a5f99ee4

SHA256
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

SHA512
c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\SQDA89R9\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg

Filesize
1KB

MD5
bc3d32a696895f78c19df6c717586a5d

SHA1
9191cb156a30a3ed79c44c0a16c95159e8ff689d

SHA256
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

SHA512
8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\W1T2SKI5\fpt.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jwuywgtl.1gg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1b37ab15c270aaa1ad2b5492a2cf843a

SHA1
0c71b840e6811e7c7163b59be3d81c1aa5829ea2

SHA256
d40fa7c2da997327092651b8c5a1cfb7bc1d1ef089908ab88b1edcb0a7783027

SHA512
4b0c1c718d334b69e11a64f990922c6d3dcc8ba2befe2c9354eafc86153fd2eeb0e158975c121af1e6e66d7eaab2bbf4409115c9c15c13a541e0f310adedc24c

Download Submit
C:\Users\Admin\Desktop\BlockRestart.cab

Filesize
712KB

MD5
430036bd3fb92fa12a17f144cdfe86a7

SHA1
a7b7a682e0fc512fda3e58f9ca03ff1a008f4572

SHA256
e572754679f3c90bed62173cbbaaf291bd8570a1eba873fdb396bf13c67a01c5

SHA512
25e9da23502d6793fb3c066741679f3f1172ef02eac721a16760ca38e0fae7aa8554c196ecb5fe75ab7bd7eb9374039b8ddbf5bd5423286268f71b9b9eab4a07

Download Submit
C:\Users\Admin\Desktop\CheckpointApprove.ocx

Filesize
449KB

MD5
b8347dc0b5a5cae2e5b05b61005542f7

SHA1
ed9dfb6d2264a21249f571dcdfc775ffcb8c7cc7

SHA256
c098631af4060309cd94e1b6cba316ec46927f70494301e9e6d528e97048f4b8

SHA512
b482515af32407631a9a4f4e2f39c900f3ac489d850ba0d8b317f4d9be6ea434daf33bea4c08056af0e55d53c1d396fa6d6959d1029af754c979718a7d0290cd

Download Submit
C:\Users\Admin\Desktop\ClearApprove.ps1

Filesize
383KB

MD5
7fd481683896a6a2d41f11674b02687b

SHA1
b1af79a6dd3bd33e6b4656952886ec47fed9b724

SHA256
eea696430a1b106031f81d087238c0de8e2a7df81ccc73ca5c5b9d8acd430cc4

SHA512
63d629891839de441442e29f22506507871798c7dbf876264241bee7caa8dd451f191aa1db8fecb7992f748d95bc7eb84c741cc62c388784bbb6a1ce4a1f290d

Download Submit
C:\Users\Admin\Desktop\CompareSend.DVR

Filesize
756KB

MD5
37a3f1bf07aa616dba8850c2de845015

SHA1
5d38c0e6d4d5d451e9680909bde119abe0fd3993

SHA256
3e0144879b83d411e984d5408fe7dad2fd83a2ef420689ae213aa8b321bd6ab6

SHA512
47a00e6891619259f22b127ff4708abdd93f39be3e807e7137e83f7ac2fce63c166c3ef225d0139e36ab8317b9fb42858f4925da4f21ac3feabf73cff84413b3

Download Submit
C:\Users\Admin\Desktop\CompleteConvertFrom.nfo

Filesize
602KB

MD5
720824a7944ebd207ea88ac8b765c46e

SHA1
f7ae4c6440d94c2221884645da93174a40a936f1

SHA256
664d5c19d652fd06634191fded6954897c67702f438278df3465ce26d30b931c

SHA512
3c36a893b24c4fa4078cd67d913020ea2c647e8a5dd472994ddde4b9bbe534fd863e4807c47c1ffc12c11b3ad1ea7b5e408c95ce53a49e8ab1837f322be4b6af

Download Submit
C:\Users\Admin\Desktop\ConvertFromUse.rtf

Filesize
734KB

MD5
e0dffe005336208ec346fefa04c379b3

SHA1
e90b31461f92c40ae066b92d9e7533192767cbe1

SHA256
fe3e0aadc0b6e3852b7111dece19c7fff27d602adac963573abf3eae165aaf19

SHA512
32860ce6d3c5d72678c6b66aedd2b0ea557e94d6d95fb8529bf733f2f0046a0aef474e5e1742065691afbca3ec2ef595b576302fb3946d36441f2d453657257a

Download Submit
C:\Users\Admin\Desktop\ConvertToTrace.mp4

Filesize
361KB

MD5
834441271ff0a926c88726e512f4f69b

SHA1
ccd2dc089c0630025874bad6db7b77dd759aa78b

SHA256
41af3146f5989ea234f5731eccf451b4076ffe3dfcd2cf76e0582fab95251782

SHA512
259131cae89f924c83454aff80513b9a5bc00d11a785ca58a131bb4caf7c7be7561f022f258d9b36b95abae1d1c48c3bd8e984862e3b1a3e1f61fda7a149a2d4

Download Submit
C:\Users\Admin\Desktop\CopyClear.mpp

Filesize
909KB

MD5
ca3e6dd31d6a01411b334faebf7fb00e

SHA1
718eeb77f8bbce694ba4837cab66731eac6a11c8

SHA256
7896e424b647c3a5795a8562d153052b6eab07032ac93c3f075af55f62b56070

SHA512
16b8736719c48d500cb0a0641ca69249889a721aaddecdb6a75ab4058baf2876cc1caf378576285f4227e33d5e737451a285b94997dff5ba09458b2582cd291d

Download Submit
C:\Users\Admin\Desktop\EditDebug.mpeg

Filesize
799KB

MD5
01bf3163fb690e2eb0329c382a2e4736

SHA1
0df09b5700291cdbdacfbd7d88991b42ef3cec3b

SHA256
414620a4dad4cbd052b9f8a548e156ae782cd556bd5f8ea58c9413aca77f7bf6

SHA512
c209c581238992da77c694c2853752bf806b581cbd09c667afb2061902dd92034175202c60e85a1e43f8533bfd29a59791b3e92c450bb8a1cd8b1196959a5978

Download Submit
C:\Users\Admin\Desktop\EnterImport.reg

Filesize
778KB

MD5
20305982dcce13588b2e9a25f904ad8e

SHA1
cedf7406dc49cb57d8a680eed962a8fb50617bec

SHA256
d06dfd6c535de07208ba33ba198f614396458688f54eb1a78429fc5a316549a8

SHA512
fd875f5f188456f02c0b961c46f3a8bfee79c51a30c69b923a6556c4a469b24145ac58eedfb8be5538b4dafadab28633db42756cc012da13c3cf371d992ff898

Download Submit
C:\Users\Admin\Desktop\EnterPop.emz

Filesize
339KB

MD5
01b8cc5dfd8064dc662baef7644963bb

SHA1
32b4619eb45331235778c6c7f52d16e91ce1ed14

SHA256
e6399c93675cc8dd6128d2cd5a33a0888930ee57e21de885bad308c2325ec9e3

SHA512
e9c67471b385538df1be60541f61e556fed8bcc29fc158e40156471a8a56a54c2f7ab5a08cfade07b23feff3cfcb0f3651692810f66436c7a139b173add98eac

Download Submit
C:\Users\Admin\Desktop\GetSwitch.sql

Filesize
536KB

MD5
1e409c44808a4382e487c9c7628cbf1c

SHA1
4d1883e5eb232d590dc796efa75bd05c085be2b7

SHA256
f5b2af79c6e35460ac00d3f12949011c9c9a6dba734eb21553c88a505d2dbc2d

SHA512
1fe0827495b341bdbf15226df4c6006aa3e5cfc12cea28d4b9897ac7b6d9ffcd0fe3cbf0def49cf46e797bdc892e8eaf055682df5f0f7c45edcfe4b455cb2adb

Download Submit
C:\Users\Admin\Desktop\GetTrace.wvx

Filesize
887KB

MD5
24b53a3987ce3bbd6f2f24b558111bce

SHA1
bbbfcada2e892a0241a354d99f1e5d9862545e17

SHA256
9a08f5b6d79724093c6ab1a7ccb3966c498c491642244ce886fdd29e73da1d48

SHA512
9d37e29d4cba102d39f0ba132fc794b10571edda28c6b5376b6e390a5511a28e47675567ec8ff340e8e1c526d396a8ad912b988a706466adeae04c8ec4a5eff9

Download Submit
C:\Users\Admin\Desktop\GrantDisable.xsl

Filesize
1.2MB

MD5
8f0da0d165b939f86e113f0e4d486b66

SHA1
7c5513adce7f95fea6231b8bba5f7d58164b8bc5

SHA256
ff6f130df5e29ae5c0ed6692972784040c331dcd548f2398e50738316d9014df

SHA512
b93229d6b40a61dc961d30feed3c79b8336930b81f0af7bdf63f52a2320bf74f6b8d7b819e90c608ad4bdf1318f28e8a87a16cbd0a4e07d34f03e1d86a2b7604

Download Submit
C:\Users\Admin\Desktop\HideOpen.mov

Filesize
624KB

MD5
df1327d9819fa95f1a0203d70180951a

SHA1
0c7dcbfb87af8b2119601a629f254fcf36412693

SHA256
e1cdb64cc4b767ba273e042c8c0b48b080ef4af013ca8f5f5a71bc56f94ce5d7

SHA512
f2f1e0293188ebe54e3372506a005bfe3a58ea14bac38798d014b4e81e945880535b38c6846ed8943299ed3c29a1dd0f75e25b4086ca958abd50ce615f9b3f37

Download Submit
C:\Users\Admin\Desktop\InstallDisable.au

Filesize
668KB

MD5
bec9983261f0fe9cf8e9381023c018d7

SHA1
dbdb72c627cdaf439c78ef466cc2d7c0cda5a0f2

SHA256
df8edddb449a326d2d752559cd41dca476acf046eba45cc4e91378b927dab643

SHA512
3e4c6828754db6a44ea52ab5d3c3630f158d7813168f88e7f7d5ac5a6a248d5f0bba2cb9a204c48d989a3aaf74fc578d156b29be4f78fe371f0760f33b800406

Download Submit
C:\Users\Admin\Desktop\InstallStop.ps1xml

Filesize
843KB

MD5
849701c664acb260d77e4d164542612f

SHA1
03ebbc1121b19dd37b23d8e2bfc57078f634a2e3

SHA256
5f6b679424d91f18cdbbec77064756a67d27acffdbe7aad5d1b2d9727cbd2b14

SHA512
004e9eb293207dddec20a6abba03d11645872fb84018392f73e2d8d2cafcfe36be37a51591b662772f7b9008ad7e32b4ff51736fd0fab15b2fb228c17ad92dd8

Download Submit
C:\Users\Admin\Desktop\LockSplit.mov

Filesize
471KB

MD5
e036396b0bfeabaa29246f05c24f7747

SHA1
da034a49fc7c32ee6997d0e3f72c49fc5bb43605

SHA256
60cb421917504e070c4ad3cb4e0108347c4dcf348a38133d53d448b467331779

SHA512
bba64f41e83c7b32c1198568e6513a7d517b4e5e76a548de89a48b3d93e9872566737c704866a538dcd3b8d9890f67cfb4530a83ea39754ed3f6bfac0c0d87e5

Download Submit
C:\Users\Admin\Desktop\MeasureSync.3g2

Filesize
821KB

MD5
8f6e05debae81d8b7742aa7ff92aae18

SHA1
f6997fa1497b39ff35720f413b8bf9567ec05c5c

SHA256
7869b1cda685db11949fc411df376ac4bc790f4ba4882159a5c5abc7b3eb92d8

SHA512
711becec386567710db8f187f4ba0641667549409ae7e7214dc6108438cfbd67e12a3cf7ad94afdc311405a32e651a51810c20b01010a06a55799acd1b0e7968

Download Submit
C:\Users\Admin\Desktop\NewResume.html

Filesize
515KB

MD5
0f209aec577183e4ffb0ccb82d4465b2

SHA1
9cd6c7512d37fff69b89d42e117a675cd2295555

SHA256
799413c3ad16772f9c5c9113f7353680de116e8ad982fc4b82ca869fdede232e

SHA512
ecb8247049985b472afe9f750cc4a5ba045d2d3a6a3cbd1928caddd97f367b46459dba2f7988c9d84c5ab25d18f449e765d8f269aedcd321ba5df4b5cd0a0337

Download Submit
C:\Users\Admin\Desktop\PublishInvoke.gif

Filesize
580KB

MD5
b82a890d81aef5a5561b2db28d5e73d5

SHA1
ca5041fa69e4879b09f0d6b550f010ec6c9ec6ea

SHA256
66360ef1e9ca5cb4bf46b67cc084b91616b841458f4bd8e3c8feefd7e6425304

SHA512
8d2edaf5b4580ab01b0ffc9dd20196124b3e90b03ae5ffd4721d8a1462d6a6f1b06426d319dd095f6c633f21e315dd73b26b7eb3b8dcf944e011608c93990260

Download Submit
C:\Users\Admin\Desktop\RestoreInstall.mht

Filesize
558KB

MD5
7084021947a5ab2ce47e3fb77a5bf595

SHA1
9fa2cdbf7e3e79134914428736e1a2fe8b3652c1

SHA256
4c63d9236099e4b879e3973594885087cca346e5f53db618495e2c1643eacb3b

SHA512
1f605b5f799182089417a0587656e6e2e961db87366d6ad92b35bbc98101a9cca7888dbd0019ddfaa0217448ddc31c98ee88d4ebaaabe4d42a650cd6f7d9defd

Download Submit
C:\Users\Admin\Desktop\SearchSend.vssx

Filesize
493KB

MD5
5f73bfd69cdc458193cb69c89726e13e

SHA1
fd8ac872034ae4c50e44e9ac6faaafe9843a39d8

SHA256
61135d75ee86687e2ea8a8799688f817633136ac1588250c908dc098979022a9

SHA512
c02fef40e04a73f927d2172136d05ac883bd248de0fdc145e874f3a78fb1f78e754e11b6fd6d60ffb1f67acd7006ac64ae004401c036f4e5c572416b8a96cfec

Download Submit
C:\Users\Admin\Desktop\SearchUpdate.MTS

Filesize
646KB

MD5
9e212d0bc402cbe2f93c08027e688cd7

SHA1
be80f66e935d2c9555d57620d73eb714e0a82a1f

SHA256
6c594e9cf91c66748606a6b18aa20741725c6438871c5bd4a88cec8eb3b4e23f

SHA512
d6b7d30a3cce6e9216b8a8a03ddef7e513bbd6b4d03db6982bdcea163e606c48420b235a2d2b822795ab753fb96993d462bb06bc1efeaa15bc4f072efbc2f18a

Download Submit
C:\Users\Admin\Desktop\SendPing.aif

Filesize
427KB

MD5
eac67ee462a4e239fb856c0615de50d8

SHA1
b2f3d6857df1de7c447a376ed0f117a43f5ecca5

SHA256
e2fedfff081d17422ebf0663ec48630c828d55b459508ec27d43f69580c160b9

SHA512
0abcbbd1c524901553358a37a5c10c5d733d989a8e7e086531b5bf9f0b259881d615d966e4fe9228ab467e9c30dc47840a080bb143644ec3bc5740c7ac856ab8

Download Submit
C:\Users\Admin\Desktop\SwitchSend.txt

Filesize
690KB

MD5
3680baa0e17e8e595d4d34644e161e8b

SHA1
82302464914d20b6d781a1eb5efb7f76f7b36bf2

SHA256
06f4ab1b5cc2fd0ec182c1e97976efb315a46642c2549c16156997b2d8914021

SHA512
e30cb553664613309a7f16aff6d9b3410617b02783fe8bf768b6bb7eb51354d83632ce27b39c1e778fbb5ab05e6dbbaf6e55f1913da8e261bdae93197d3ef59a

Download Submit
C:\Users\Admin\Desktop\UndoWait.odp

Filesize
317KB

MD5
87449028d853194238bb2f7703ceb257

SHA1
78f3686f81a5412546a7c0d85b5856fa894d568b

SHA256
a5e624dea03a1cd005a190eb2917c4bbf414612303d4a1fcbfb5f683b7f83b5f

SHA512
3a87cfa473bec55ff980cbd849340aea6e4180822fdeddd1cb00aebbf85eb022e6132efcbf9ac1e2ff6c8d22ca3a78db08f3a6cd1cb19d5d8580892f2c159c5e

Download Submit
C:\Users\Admin\Desktop\UninstallGrant.midi

Filesize
865KB

MD5
6a290ae9d2bb8ba2d3f81eb883c930ba

SHA1
d23e6492d1637dcb91f508883037bc6502c3a9ed

SHA256
b68e5c728b2525327e8cfd03f3b6d7ba484202e3a7dc8bb862d573713de3a27f

SHA512
600d8165755b8c219de8d1afff90f89c5aebd586cbed3321aa4b806e2e83ed9d70addc5b90f502b4fca5116710de5d769224d927ea30e890ab0bb23db4e6d574

Download Submit
C:\Users\Admin\Desktop\WatchCompress.eprtx

Filesize
405KB

MD5
d7d29498fb00153f8d34a9b0a82b3d41

SHA1
f6fa5c01bf8dd1322464beda4d4edf100976f707

SHA256
ee9594c8cb4838647020c519a516af5bd189bf2a6a21ac91314b77c02f00305b

SHA512
a6996888235762bd55c7cb30c9127b2e1c146fa11a37786b2810341a9e2a3654a93f0eeeb6ad7e5a0016983ed1880fce487f9437a245ca94500a4dd1bf3f06f7

Download Submit
memory/2752-143-0x00000281B39B0000-0x00000281B39C0000-memory.dmp

Filesize
64KB

Download
memory/2752-144-0x00000281B39B0000-0x00000281B39C0000-memory.dmp

Filesize
64KB

Download
memory/2752-145-0x00000281B39B0000-0x00000281B39C0000-memory.dmp

Filesize
64KB

Download
memory/2752-133-0x00000281B3950000-0x00000281B3972000-memory.dmp

Filesize
136KB

Download
memory/4688-741-0x000001F427CD0000-0x000001F427DD0000-memory.dmp

Filesize
1024KB

Download
memory/4688-907-0x000001F415790000-0x000001F415890000-memory.dmp

Filesize
1024KB

Download
memory/4688-1461-0x000001F4358E0000-0x000001F435900000-memory.dmp

Filesize
128KB

Download
memory/4688-672-0x000001F413B20000-0x000001F413B40000-memory.dmp

Filesize
128KB

Download
memory/4688-734-0x000001F4177A0000-0x000001F4177C0000-memory.dmp

Filesize
128KB

Download
memory/4688-736-0x000001F415C00000-0x000001F415D00000-memory.dmp

Filesize
1024KB

Download
memory/4688-738-0x000001F427AA0000-0x000001F427BA0000-memory.dmp

Filesize
1024KB

Download
memory/4688-920-0x000001F427C90000-0x000001F427CB0000-memory.dmp

Filesize
128KB

Download
memory/4688-903-0x000001F415C00000-0x000001F415D00000-memory.dmp

Filesize
1024KB

Download
memory/4688-906-0x000001F415790000-0x000001F415890000-memory.dmp

Filesize
1024KB

Download
memory/4944-507-0x0000015D345A0000-0x0000015D345B0000-memory.dmp

Filesize
64KB

Download
memory/4944-526-0x0000015D3C940000-0x0000015D3C941000-memory.dmp

Filesize
4KB

Download
memory/4944-525-0x0000015D3C940000-0x0000015D3C941000-memory.dmp

Filesize
4KB

Download
memory/4944-491-0x0000015D344A0000-0x0000015D344B0000-memory.dmp

Filesize
64KB

Download
memory/4944-527-0x0000015D3CA50000-0x0000015D3CA51000-memory.dmp

Filesize
4KB

Download
memory/4944-523-0x0000015D3C910000-0x0000015D3C911000-memory.dmp

Filesize
4KB

Download