62c4d93659077dfdf16e44d87219e2bfb081ee18f9d9b1c971bbed5cd01648cf

Analysis

max time kernel
1657s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.jpg
Size

13KB
MD5

d094be5963f0a4c57ed6c52780163b16
SHA1

a449ae86715bf7f0a6820f197f44df75d6c61b1b
SHA256

62c4d93659077dfdf16e44d87219e2bfb081ee18f9d9b1c971bbed5cd01648cf
SHA512

5baa87fffb290bf439a210f02adbb83cfc61383baf26c64956331100c656cb7eb68568e913ab3954093d88f6f0b66e6e20d492113a122991e69622302eefc2ae
SSDEEP

384:QEiBxS+jYYCNTLNKx0PjR5CBV5qsXc8XpjQpiF153MBn:Wb+L00mBvns8XpcMF73MV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3803511929-1339359695-2191195476-1000\{E4269BD9-25A9-48C4-9E2D-9DA0C6C52621}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1392	msedge.exe
1392	msedge.exe
3148	identity_helper.exe
3148	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1016	svchost.exe
Token: 33	3816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3816	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1768	1392	msedge.exe	137
PID 1392 wrote to memory of 1768	1392	msedge.exe	137
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1224	1392	msedge.exe	138
PID 1392 wrote to memory of 1424	1392	msedge.exe	139
PID 1392 wrote to memory of 1424	1392	msedge.exe	139
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140
PID 1392 wrote to memory of 1488	1392	msedge.exe	140

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
1⤵
PID:3368

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8c5f946f8,0x7ff8c5f94708,0x7ff8c5f94718
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7168752037103144836,15854325886823499188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
725a47144d09a60511f1e6e092c4f3ec

SHA1
1d33abca47326a1c38cac103c24037286c070caa

SHA256
3d50cd70dd62d7b1fc35c31e95190853426a2cece901bc184689fc4dfea9e55e

SHA512
496d0a786e4253a63b8531da2f601d08db361a16ada894469a303b5355076cddf93eecfabe02cf636400c0aaf354c9d6b0ee259dc8e04e052944fb7ae91cea53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
62KB

MD5
d5d3fbb93011170a574ff95ec53f3f02

SHA1
243a59b28667e36ee873ddbb958aea5fccdc2ab8

SHA256
1609e6f35cf9c6a7305aa1a8e4383895dccfa7e946ea83f67f35ec60eca3095e

SHA512
c7decb10ca2ddb580adbba295cf408ff4c2ec47491beebad4dae5dc88ad575881ef271b9183842821af8d1ee0bf66c70c0efd3a1acb1bed1955e1660222c49cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
2eb923e237d7e0ae1301bbf25bd18481

SHA1
ea76fc8f07790578c896496a6cedceadceb8fdc8

SHA256
feef5a6d383df1fd4517d6d184d01741270dd048c21f127bc1c7fe59fc081249

SHA512
314435450dacf3ac6fe5e1df58a6464c5865a644dc96abf26173d19d7a5aa29774ea2b732a23841804ca0f355100539b2077bd94c4afdb7b2bc68ad7e1c98d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
69KB

MD5
973bc068951a2b072b4f79af6a85f7fa

SHA1
dc14aea009d7c29dae76b3322021b645ea1c3129

SHA256
d64accf3809219dc673ea08567bd85d7bf4fd396c0f1c26c32266a38aa6f8780

SHA512
b3b00de83af57bff6c36bc390555155335c1e8ddc17c741b9814feafea3cf5a19596fc1889162fbeee10a5d29f87a8730ee3d890122de58001391a11ea4e955d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
72KB

MD5
2d39612c61647b9204862b97844592ef

SHA1
cb6f7a523ff4b1b417187d2577f81469120a2fd5

SHA256
8b67509dbabd6dde1ab1e655daeaae40b9eb156499006783b9b4e1bd92d69600

SHA512
5c3f2fee61ad4b9790bcc5034c5eeb6ae06bc4df05742bb6162381f9285f22210ff55dce6ef999726d45ea7901c268618c14eb37de9f5f8d842a82775ac030a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
29KB

MD5
f85e85276ba5f87111add53684ec3fcb

SHA1
ecaf9aa3c5dd50eca0b83f1fb9effad801336441

SHA256
4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432

SHA512
1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ff

Filesize
103KB

MD5
d8edc00bb889f4057a4a1571af9c00bc

SHA1
c4dad8d275664fb71d4e72f600724865cba10e5e

SHA256
8984c37f6ee0b7d3c0f5bbfbcd2ed00f513595dae5a478333c21d973c1d53d88

SHA512
dbd80d12e70aca3154d9e2e24bb56fa80282c129c1d2d38c705adcb1811c2016ea237f49743d7e290a3ab12f40c729499989fe0c45ca9f43e6e9b69fb417c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9fde5d893383720739c000e9e69dfb03

SHA1
396a0f25561f81a3756a97b664f2a49e6f7445e4

SHA256
da575ca427364de9110c14457318b114b6e0d3b364edf2b235869268e4b78a9c

SHA512
ab92770088ff3c06a683021d14c6787f8a7b2280f2639acae33635b6634f1ee4a22c6375b6efc4e14ee3d50b7b523d213b337f84d4eff4bc34f529a9f693eab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ec10b88454b010724e3876ce4a064582

SHA1
f3763d96e77c7f698e114b4d89aa24c323ce86c3

SHA256
73346de66a6c83edab94d28828e14205760fb46d67de453ac85e2862cd29d237

SHA512
dd41c41680a7b32966eaed080a48f0c85d4c3bf1d5fe89034f81aee6ddb332c5dda5ca3e49f36137e2ced3b6c4081affa61125e8fbfbb3a8a31aaad9f20ae98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
753e315c31d35eb807a9b2dd50027054

SHA1
0f29f4fc8d98f8f6b2d3fd88a28703883702a41f

SHA256
d2868a5836c07af2e7a2e27810489dba1b8a4329d3ee671c620f7d9367b3755e

SHA512
54e7ab9b684fe82abdce0fd98e031f4f552d83215d23204a084a6f671393a07b60a121406c8f8622764ff24df933cd1bdd604d94d13c0728270532134158c780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0284ac96b46e23c2c27fc540eaedca43

SHA1
8d8f5a58bf56605b7ee3666fcd447f328457a3c9

SHA256
c5ae01cd639c18df52453128a216acde9ac8098c54c1b0e6f3e53b8ef47055e6

SHA512
a42a7f54ef9d403aee62968797e48e026453163ab93011f27a92b65acfd747c2b9699bf4702abbf8862bc2a829e165a97a4355655e9b45c756a454cb76a78016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
99c4bdba8977fa327e4f93cafdf2e416

SHA1
d00924db9faded334b9623e08b464c85d029249b

SHA256
ab443909c6ee758497a4026e42214374670aa9f7ff094e7bae9c9d72ab47c6af

SHA512
0f51ae82803b4a3451ba6b03a33a609448c82f68b2b37904662ba7e47c23b353fb17bfdf6b7347faea38332cb399c54974ab2111214681017a29c7d56917a7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8c025f0d1a0578f3d46d88b5bb00e236

SHA1
e04b84e7983e1fe6ceb77ffc2670083f27d4a05d

SHA256
d1a8bee6d39ff54a49b5e55b3bd0af134357b74e428175fd3a7a73d317e963e7

SHA512
d57535d881597c82b342ab17d1c7fdcac6998e14bb5e08f4d82dd59555c6adeb02fe83bb9039ea39aa19e6961aca73c1bbeea6626b86df4593a5883b0b6f1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f64023f5ac0bd2d3623b7e3096b57cc7

SHA1
72f12dd80631c7754a997e232d0e7b4ddd531af6

SHA256
27d7a8ba9c7dae768591d5f637ae53da9a1319dd502876be0100e61520980e27

SHA512
76cf7ddb63131bf79efb254563c9e7baca33875581ddcef8b650f87a0e32d626891c33bc8bbb6aa68467995fe3322c9a5d4a2804042b6ffb60fe5d072e3fe445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2222e2cc8805a9f2c1a09f14e96c2f6

SHA1
5bbdcdc96c9ff81021f4119e446585e13ee0d6ba

SHA256
6ffc76bd97c8bdffa263b80f0997846f2814ad08ebf3ab69bad5bd7d218e42dd

SHA512
d43ae253cdd74f41ff0dd2321c0b25ea55829ec50dabd167e37eb25834002f14df0cb8873926678806998199eb72c18b8715d0e3c18f00a991efb981368753b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
287e7fb70a5ecaa4d3130d9814eb21e9

SHA1
4e43ef5f15e9ff2f5e38beb558f83fec003e71cd

SHA256
dd2317fd08cb66770c888dd1d73b50297045300a53a004d0de7e48fcfd9eef3f

SHA512
926b6384beafd9a2c811170f0554516b89824b4a9be5958deab0a156a61526881cd66e26bdf5b578ebb639b75e19b1ab7d2a7db1c6918c4aa99a251fd38f1417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
955feca73115ce9cfd9d868864016ecc

SHA1
9567817c523c23b38eb5c320ea3303cdad7399c4

SHA256
555f05ba7384293998b7bee7299547209cf5a84c015bef7ff00e984a613c37c2

SHA512
7ab70a021e205f20447b89445f1786242e4c61f3b0513ee81bec836f5c47e5081bbcf05c7a143accad1edb3744dbefb0bdf1264820999dcef02ae6f6e1b021ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c48e31ccb006e43aec72e543bae0a966

SHA1
902a06a9c8118f61baba0b31efd0348b7dab1ff1

SHA256
63c84b24da64fdb03688f953b0a9697ca5a344a7785deb0b5181cdafea5f18a6

SHA512
e4f86c1f3156b0af25076cde9bcb1ad7838c1f92f5fa36705f38a53cd46fdd1c0e51d29ae41cec4b10d5b5b47dc266c336104be150e7b0ebfb20ba36ec212b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
440c79f67eae57480b1ff125b1f9938d

SHA1
e2a430685dc13060b908be36bf969c24049a98cf

SHA256
69abd8d8fc3b7a7ca386d63960ce09fa8738cf96145a5ce7eb2e6b1fa51b2356

SHA512
6f713f32674d8d13b69b589a3131789205aafe843454382908b887b29272e923f8180e326383e5af0da4ed9e577925cc89209e42157707c4e7db12574c6f8679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
4KB

MD5
e7bab14811193b7547ee8550171f8ffe

SHA1
b49e33fc2607ecac0236e4c49acd448885c5bd53

SHA256
52e1c8e1e051be187b7f684e1ff97b4874ae135085de15e682875ea6f049bf2f

SHA512
d9842de8e930ce1ac2d8cfcd4f472d6bfef9356ffbe77cd62d47fa41c967bb1776ab004c5129e46b62685f5f83315a3564630e4b8595a3acdc3c81185850a0fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
b3c419cb7ce186862fe71175507646b5

SHA1
59028fc329138a6fbb47199cac5fd43e33e3e41a

SHA256
cb38771e90a593dc2525b04b490cee6dd51f617b36c10980013109d1500b91b1

SHA512
c72741f9baae225f8e038998fc8ff1830118f361549609fd342093f9276540b97ef86eee9324421e59d2ec2cd68bb73e8291835545712e22974b2b51ffc8d496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
3KB

MD5
152e4d15c2be8f088dd9051e50395f29

SHA1
4a7a922aa76dd2286511259019848c180a1a4ffd

SHA256
8d6fc5b6922efa2d6b2c986d8820929b407282e078abd1b51b88703c521e66e0

SHA512
00f7e1330d81a264cf052dbc94cd823e20d13c465f5c756ff5b7171b258ee78217dad0ea1bd951afd7f5c53d67df80b8cbaed1a77bf5e9d9e82826df4388231c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
552153965bc9307113126c38766c690c

SHA1
5528d7e8e35ccc5700a81bb4821dbeefdc4ffa7e

SHA256
ffbe5aa7f1720c7c883d1335f11c92ce0d1cd549eadec112be76b61fdf8c79f3

SHA512
559ba1497f7034c132569714be582f490309537987736838bd1ec6ec0d7bc1b07c5c0573796ad889281733c5ca64c2a6644960feb02ec8243a3f077e24e5a74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6563a7.TMP

Filesize
48B

MD5
14d554e168589b8054b54c5d925a47ec

SHA1
b14c5623c08276799b33b0e4990a6647cb9ac1e3

SHA256
534329f163588899ceb54b31fda8c58b27c3a669e222ed0aff56a54022365118

SHA512
9dea4ac6d387a8e01ba097cc1dfc91bebc934c8df746040f44894ef429240a6f75ca113f5c0f2de73f3888fd21744d9fff6356a48486c3ca76d5c87cf5cea2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ceb8c79db3dc277279f91b6e4b84068

SHA1
5a7051ceec6df8f83819a6e2530ab8336ab96527

SHA256
407162097a746d65574ef05478e3aa9f3b385582d664ddd98b8cfbb67e3ca077

SHA512
b821493977e2e2fa7da4a0d50fde7dfab850d97c97601af5d598b2d91d362d4be382852ba9733cbb92026246fe7e67a3d9087c1136b62c13228ab07a57c8bb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
692766b4aec6445edb73cd1a19600c7e

SHA1
e76d7f988ed359b1aa88d0b1582edb3c0a2a3d3b

SHA256
afedd9ef18161d9302063e5ab9e6767f727a508ba62c73c3f7efe8dd3fc39135

SHA512
e74ffda8a51951d209226305c23a1270277b307841004a7fd916183a0765b7c5d7feaf1fed1327f6d1aedbdc1690d908c5fe9e7f6b3d0a630c629c8408f0c6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b76dfea5550936ed8a726d54fb52158

SHA1
b99d5830cee0f805cc19551aabc468429e14c4cf

SHA256
ab53c91c7040d0401fe95bb146d08809e58bdd52179d52e39dc5d9a0b825dd9b

SHA512
eb427d86286a978f6dfafba00f1e5e583f57dd4245698bb4620224b326149a2056cbba652a529d70f78f98de8548de54595583d020b2f0622d6aad3e8f342abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4b333058a348c9310f9027af5d3458fc

SHA1
a9ca77309a67d1469e79a3a3735d6a627f9af483

SHA256
1679c7990ded02a23be52d098c2b43135eba7542e93bc558225235b6a066b903

SHA512
802220e6671451fc9109ddcedcfcbf18fee55f906b595d04e30c838795e8805afd727266aaa236aed766c0b3c7f223e19707b6a726e9abd8afe5a78b931bc460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6efef822e0e861a044821ac7e48919c0

SHA1
87a44ef28b19a7053144420cc1afbdd7588f08a8

SHA256
4e0ee0d94e10800342cc37dfc78411cc88551bc3b55c1d2a7f63a2478afb6e94

SHA512
d0fa5b7833d93f4671f483ac9fea3a4595906ebc5182dfb7942712ca5837b22a18aafe44eff5e7dddba7aa49afd1043abbe76512b8dae17e13cf7d0553dd81d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed75376f41dc6895ea6c4d49ccbf2cad

SHA1
2ff475d7c7f4577045502e5a745bb9eedcb648a7

SHA256
75b42f4fe9e8e5e9ca50a023c584c0f6a1b321380e4ba38c065e60429f7740e6

SHA512
5afc9d11add5759f198ab3bc3e2c31e86ffe0f423ee14b02fe4a0a83ddaebbc5125e80d6fd60b5a741b2ca6e81948e59f9b9873fde6dd44780a86040d1d80bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
69d8afade003010d59ed8ca1484f52a2

SHA1
daeed2ab5fc45f70198bf216304459ed857a52c8

SHA256
4b97320509f8bc49a7997db80c826186e4d5eb4df588000cc5fcf61887a8283d

SHA512
f769c4cdfd2b426b04bceb5793e6a003de12234bfbe74d7b436e9093b8ecc41b6bfd77b36d63bfd16cf36f52b003dd1e0c395de95478ff7d96f6924668fe3ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9e0337c093a22447483723cf281e7fe

SHA1
8d58fe64a5fa6a7804caa448c13d6f1a5e44fa36

SHA256
749ba13518d5addf7020bde339732470629b58367e1ccb6f8af039041a0b24df

SHA512
7c8cd71473dcdec4163262a74043fe9d32b7a3b8a869da52ac6a1fed3d18a2fe396bfb05fdfd5b58833cd5249931708246addb9fb3b558e5db6fa5d60e76d016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
811b52ecef2e33793b12896e242a27ad

SHA1
b4e5f2a1abe5e8d42e08a16649e50076fbb82616

SHA256
e25c43f1d1472d00db3bfe9e6c847afe4e42e318b18e50b36c0aea2fcf53a6fd

SHA512
4bd79330dd5a47aa06ff85b3ceae2137aad75a247b4e7b8eb73315c3194c2400a1225c9d2263756c0be9460b57ada89754eb8d5e4e89c16f56c7cffa2b10fa04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1016-34-0x00000157E93D0000-0x00000157E93D1000-memory.dmp

Filesize
4KB

Download
memory/1016-32-0x00000157E93A0000-0x00000157E93A1000-memory.dmp

Filesize
4KB

Download
memory/1016-35-0x00000157E93D0000-0x00000157E93D1000-memory.dmp

Filesize
4KB

Download
memory/1016-36-0x00000157E94E0000-0x00000157E94E1000-memory.dmp

Filesize
4KB

Download
memory/1016-16-0x00000157E1040000-0x00000157E1050000-memory.dmp

Filesize
64KB

Download
memory/1016-0-0x00000157E0F40000-0x00000157E0F50000-memory.dmp

Filesize
64KB

Download