71159411480a522b2b82a3dbd72f7e3335ee557a5e08d9fdec4ebfcc8028a530

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roblox_CE/ce_build.exe
Size

17.1MB
MD5

b472206ec5e5e4b959d0f18998a37d44
SHA1

4e01afcea4134aca4f13baa5752f61b56c435a16
SHA256

9c19964264cfcf7e38da598d9536df0bdec90b29ac1ea4300f5804b1102bf9b7
SHA512

13ad92ef10b77c9b768f73d44b3d4d20da68bcc3820210923a972997f43bd3d2588002511a60af321d8ce139ec7aa82aec030c5790b7c2174f3c9df082a0a773
SSDEEP

393216:2EGbM6UZbcjyu6LMvkEJ+NqwfnTqCJrsMZgTdeN4+Rs/:25bdUZoj5BJwVfTqC9sMqT0hs/

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ce_build.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools ce_build.exe
Executes dropped EXE 1 IoCs

Processes:

ce_build.exe

pid process

836 ce_build.exe
Loads dropped DLL 1 IoCs

Processes:

ce_build.exe

pid process

836 ce_build.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.myip.com
2 api.myip.com

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ce_build.exe

flow	ioc
1	api.myip.com
2	api.myip.com

Drops file in System32 directory 43 IoCs

Processes:

ce_build.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	ce_build.exe
File opened for modification	C:\Windows\System32\oLe32.dlL	ce_build.exe
File opened for modification	C:\Windows\System32\OLeAUT32.dLl	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	ce_build.exe
File opened for modification	C:\Windows\system32\shfolder.dll	ce_build.exe
File opened for modification	C:\Windows\System32\cOmdLg32.DLL	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\vERsiOn.DlL	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\wintypes.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\profapi.dll	ce_build.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	ce_build.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	ce_build.exe
File opened for modification	C:\Windows\System32\SHELL32.dll	ce_build.exe
File opened for modification	C:\Windows\System32\psapi.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	ce_build.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	ce_build.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	ce_build.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	ce_build.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	ce_build.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	ce_build.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	ce_build.exe
File opened for modification	C:\Windows\System32\sechost.dll	ce_build.exe
File opened for modification	C:\Windows\System32\combase.dll	ce_build.exe
File opened for modification	C:\Windows\System32\imagehlp.dll	ce_build.exe
File opened for modification	C:\Windows\System32\imm32.dll	ce_build.exe
File opened for modification	C:\Windows\System32\Ws2_32.dLl	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	ce_build.exe
File opened for modification	C:\Windows\System32\AdVapi32.dll	ce_build.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	ce_build.exe
File opened for modification	C:\Windows\System32\shcore.dll	ce_build.exe
File opened for modification	C:\Windows\System32\USER32.dll	ce_build.exe
File opened for modification	C:\Windows\System32\win32u.dll	ce_build.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	ce_build.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	ce_build.exe
File opened for modification	C:\Windows\System32\GDI32.dll	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	ce_build.exe
File opened for modification	C:\Windows\SYSTEM32\OpEnGL32.dLL	ce_build.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	ce_build.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

ce_build.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN ce_build.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	ce_build.exe

Drops file in Windows directory 1 IoCs

Processes:

ce_build.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\ComCtl32.DlL	ce_build.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-834482027-582050234-2368284635-1000\{1FDFDB0A-420C-4372-A718-6B03E31F52C3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

ce_build.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
1740	ce_build.exe
4688	msedge.exe
4688	msedge.exe
2436	msedge.exe
2436	msedge.exe
3280	identity_helper.exe
3280	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3964	msedge.exe
3592	msedge.exe
3592	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

ce_build.exe

description	pid	process
Token: SeDebugPrivilege	836	ce_build.exe
Token: SeTcbPrivilege	836	ce_build.exe
Token: SeTcbPrivilege	836	ce_build.exe
Token: SeLoadDriverPrivilege	836	ce_build.exe
Token: SeCreateGlobalPrivilege	836	ce_build.exe
Token: SeLockMemoryPrivilege	836	ce_build.exe
Token: 33	836	ce_build.exe
Token: SeSecurityPrivilege	836	ce_build.exe
Token: SeTakeOwnershipPrivilege	836	ce_build.exe
Token: SeManageVolumePrivilege	836	ce_build.exe
Token: SeBackupPrivilege	836	ce_build.exe
Token: SeCreatePagefilePrivilege	836	ce_build.exe
Token: SeShutdownPrivilege	836	ce_build.exe
Token: SeRestorePrivilege	836	ce_build.exe
Token: 33	836	ce_build.exe
Token: SeIncBasePriorityPrivilege	836	ce_build.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

ce_build.exemsedge.exe

pid	process
836	ce_build.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ce_build.exemsedge.exe

description	pid	process	target process
PID 1740 wrote to memory of 836	1740	ce_build.exe	ce_build.exe
PID 1740 wrote to memory of 836	1740	ce_build.exe	ce_build.exe
PID 4688 wrote to memory of 4636	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4636	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2368	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2436	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 2436	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 728	4688	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\roblox_CE\ce_build.exe
"C:\Users\Admin\AppData\Local\Temp\roblox_CE\ce_build.exe"
1⤵
- Looks for VMWare Tools registry key
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\ce_build.exe
"C:\Users\Admin\AppData\Local\Temp\ce_build.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7e883cb8,0x7ffe7e883cc8,0x7ffe7e883cd8
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
2⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
2⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1944 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4572556335670092222,10753699842813732159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6644 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
21986fa2280bae3957498a58adf62fc2

SHA1
d01ad69975b7dc46eba6806783450f987fa2b48d

SHA256
c91d76b0f27ccea28c4f5f872dee6a98f2d37424ef0b5f188af8c6757090cbb5

SHA512
ae9ba1abe7def7f6924d486a58427f04a02af7dd82aa3a36c1ed527a23ec7897f00b0e30f22529e9599ae2db88e8abc7ba8013b426885aa3c961ee74678455f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0fcda4fac8ec713700f95299a89bc126

SHA1
576a818957f882dc0b892a29da15c4bb71b93455

SHA256
f7a257742d3a6e6edd16ac8c4c4696d4bdf653041868329461444a0973e71430

SHA512
ab350ca508c412ff860f82d25ac7492afb3baf4a2827249ebc7ec9632ee444f8f0716389f0623afc0756f395cf00d7a90a0f89b360acdf72b1befe34eecb5986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
fee0a4eda8b637daebdefcec956fcd24

SHA1
b7a2b19d3c7dd30a7aefb3f160709d965e4c6edd

SHA256
616a915dd7aefe1f40b4b7617f1f42e6626501b003dc111611fe014165c1a792

SHA512
e8116e9ae6f42af82e646b6c07fa69ef698599822171155ba0be294064a27dfe6277321d04f7963e9b85bc7ce7b8f371ad0f184afa326091efb994c023dc1df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9aeb69773412b9cdaabed273f5d2b88b

SHA1
fd64b4d4e290e3edeed3c9dd5de4e15f5141d598

SHA256
3d299494e3f65396e021decc961fccf15a96423f1157433595db6ea5feec4482

SHA512
9d002adfe98eafabb3b90d610bd8902e601996079e2b0f0c9c978ae994ee46d13885e1f6c6dd8ce9c807d12964a7d5a7b6d6c691c0d96ec4ae3903522ba69dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
899e114d4a7fe9f6b4ac465bd7a1ea11

SHA1
55dabb91295eb461ca5bc5789afd516b843ea972

SHA256
c8b05c9006f1d1e67189fa9b4d9568d14943a8e2d8f9c1b7ef8fd5207ce64eec

SHA512
aa7d4ff59a1f542e0e4d3200b945e4716a53b403a7e972d6d7cde8589f7cb4f03a1ede88f6e8359b2aece513c2e7703b876f2bca4e1e7518507b451634f5d506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b086507cc91ef0ecae3e5fd2519ce7a4

SHA1
b145847ddf71b1bc6e79227c40551b6be2f95e1d

SHA256
05bc724653c14279dc6c01d29c96238d5cbeef764bf259886f1680ddba5b5d66

SHA512
e95b27f8a6ba4494a1a17aa7ea7ba13110cdab0320398689a8f5382ef962385e9041a65c4a109ccf9037888cc03492b94dcf053c6e600893f663aa93ff67126f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea5078edeea7bf23ec2ce045b2f78a1a

SHA1
36a3e541ff38b8a912b810577b89c51f8a804c9c

SHA256
adacdedd3a9056a0a9987fe928aff3e3075a12e300418a1640bad84d5a5b89e1

SHA512
6f57ad6464d27905863f121550d6d0906096b4c06abbf55dd3dd648b3f0beef7ca033ccff29a6f5dd5f83d1600f5abeeb9205a679bd891f42b884cf11745b004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f226bb2af08a9a1095928da4936d7709

SHA1
fec396c60402eed6f68bedddb4cd5243b17c6719

SHA256
f6a4483d26f20104fae96ba347b3b9187f7ab24f6d97f4706ecfe7002c248eb0

SHA512
d35b02f0bb38b5408ec4161d14917fb3103bbbbd9a4b8e31de0162ac68c96c8cd4826059a7866ad314aee8b7dac5f242ceef1c0f348bc66a0254325749b205eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72f3dfa4ab455ff68931905645cd2fd7

SHA1
bc7ee46018cc5ff2444c284d2cc65d5587f73f50

SHA256
7d8ad3c9706edd386397f08570e4fda66bcb9eec4d736a74cc32dc5fd141fa44

SHA512
dc6e7b6ee303354e5f18d048e8b3a8746cfc12198ae108839bae0fb2af65fa1cd09a8a582fe54db574d3e00aa16cda48f085b9cfa75d8106804a941864bd89cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a7880ad3e7de820462bce27885516f27

SHA1
4527c62bf7fa31e8229fa9482a929c3a842c626f

SHA256
134641d8ae75db4838b50497ffbc8610e2e89eedeff57e40b4588adcbe307087

SHA512
049248e024851600b21daea5c339411abe2d0478d90afe28ac0e715bc9d405f927c13282c5f3f6417e2902ee5ecbd79bf878ef9c54bd9ce11345f6615b298cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6d0e4dd862c03319d3ef7e17462c68e7

SHA1
eb9723ee2f7e3a36ec013a4a3f9a2024f441b7fa

SHA256
1909841bc8f48878938d2b791f69968a29e1062386c0a049b544b6a2e05d99de

SHA512
338b45ba4443baaa3613e53dc1b24c6957d2a1887c05004e45d1d470600ad8e4d91492fc1b96d34f991136135fe4d5ee60aa7fcdedc0f19291c6421b38be7e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71f170e60b3fa71439a7fbb2b12a8165

SHA1
5dceac5715b20bd97d21ede4717d23c8e176ab32

SHA256
ae6a52b8e7c7fa5640698fab98be915153b80dd40dec55a8df1674eff699feb9

SHA512
fb2b9c91810c31ede8dc28428f4b91ec45d4d015a9a47202bd4d0f7251665e85a5e62636e1f005ada452bb0a0cdd7a4728de9c7f1a4cc2eb846eeeb1f19d1055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64bedbfa703af4837616d478104571f5

SHA1
6aca0b21313c29f6473084e34988b51410306267

SHA256
5b7a24546fda96f4e9bbb839f16b3def8c15bac850b27dfaa326a9af8d0a33b5

SHA512
18c49d183518974a7ff346edab335d63d4880153fd1be2af50f252f42ea821c81e6e6a906f45a268baaa06436019237ef0a37d0f7ce8eb3ea1ac69aee62f9c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d365e56136284885496557831ff16e5

SHA1
f4f8fcfb79541f0a2b70506190b053c6895c5b72

SHA256
17801b10da4e2b81268fda747970b78561839bf699f514b2f56fb8f1c5f68148

SHA512
fc24e5b21a10c01be00946d476eae4ba9d341bf2ddb15bfb8864fcfa52ebc3c29134b90b4f873c173b418c1afd7a9b32117a9e5c7d05ae6c5e04c25b7d7d3e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3851438bb95492a4dccf4df75375301f

SHA1
6c12c02f4b1be0d7b6ee7c4a6af834334b93a13f

SHA256
89cf5bb3aa29c54a887cb4622acfd21987dfb3610b7e6ad604446f4a99aa7cb1

SHA512
4dfe044e73d25a74bbbdc343736fe09289c349e7bf3c4bfe329907949fa4293525532613eec903dab0df05b17499189868fa993715fbcc933ae034c0901befa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582016.TMP

Filesize
1KB

MD5
d080165791737f222f8ee3280a053ba2

SHA1
884d7d53ba29dcb6d02ddd361aadaced9bda3da6

SHA256
d8b08ec7a85433481a1b426fcf5f48e2a15ddd98e2f5b282440a0b7e062b4e53

SHA512
47201ccb24ac0e9743ebddb95415a4b55a642cc3acb8f4fc1592e91ff2dc6d2941b82fee09c7ece8e6de9a0d8041043310d0fafdeb727f5f4cffd05c48ef7efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a975cd50c3414421a3b0d9de4a491923

SHA1
71ce7ddeffa42d8d9e1f00da16ed1ac52e941c13

SHA256
fe3898818fede8b601d2851c78f1207a672500af1456237656fb6eadc2324e7c

SHA512
730530e3ea8c8effff777c745bc005bc81ab814a429258c3a86b5827596d71b5392a3599b06f528e23d32ec030d2d8e3f24c4072eed9ece375cbaea8ac63aa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e67119c959059f620274a4ab638a57d9

SHA1
1f833bf6e7cc94f96e6ed560d5a400dbd5a25294

SHA256
ae63531f6153eca54bc879e932dc1f7e8a3b19393766f210579a8704c3314735

SHA512
17bb52d36e2cc5a9ab8413f4a06e0a224cb3bc8d68dc66ee02833d90c939a28a147cb3c04742c9c23c72639216894f33d42ed55ef287e6c9d87b1169a30f4879

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce_build.exe

Filesize
4.4MB

MD5
f9de5ba4c4c5ffafcfc211cebe2dd253

SHA1
dbfdca155375249ef9f7e42c528ed4b0efba555f

SHA256
28eae0aaee3763626f6f0f5783aeb2b0b39861a4066d66d9a161b930d81f2f68

SHA512
7f582188ebc97fd7856342cdf478c5a0b980123a83b8c493afe7dc1fe614644ae11943c01e14ea8f163cf4cb89c5f9d8fc7d40960e3969a31d7a0f520f20c559

Download Submit
C:\Users\Admin\AppData\Local\Temp\lua53-64.dll

Filesize
528KB

MD5
b7c9f1e7e640f1a034be84af86970d45

SHA1
f795dc3d781b9578a96c92658b9f95806fc9bdde

SHA256
6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff

SHA512
da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1cc.3.dat

Filesize
100KB

MD5
20426967476b7c571dd38d0a19cb006b

SHA1
ab49ce1133607486c07a73309530ef4ecac928eb

SHA256
6cbbe9efe40e3755eb20de584e4f079f2a1cc17f4ba9b0c9c1032bd70dca1660

SHA512
edfe21ccd73ebc6aa9c3f1ce3e64d5c06bc0c39867b73fc89276fefb92bc70dae1626bbc71edec39460cab0a0040e059a19241968c74001bab9e59ec749cad8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1cc.6.dat

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1cc.a.dat

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1cc.c.dat

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_4688_GXKEVDQUXCKEKWUO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/836-165-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-778-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-824-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-578-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-804-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-146-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-116-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-617-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-802-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-791-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-642-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-9-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-658-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-377-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-729-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/836-749-0x0000000000400000-0x000000000167E000-memory.dmp

Filesize
18.5MB

Download
memory/1740-13-0x0000019BE75D0000-0x0000019BE8D28000-memory.dmp

Filesize
23.3MB

Download
memory/1740-12-0x0000019BE3BC0000-0x0000019BE3BC1000-memory.dmp

Filesize
4KB

Download
memory/1740-11-0x0000019BE75D0000-0x0000019BE8D28000-memory.dmp

Filesize
23.3MB

Download
memory/1740-17-0x00007FFE9EE30000-0x00007FFE9EE32000-memory.dmp

Filesize
8KB

Download
memory/1740-20-0x0000019BE75D0000-0x0000019BE8D28000-memory.dmp

Filesize
23.3MB

Download
memory/1740-23-0x0000019BE75D0000-0x0000019BE8D28000-memory.dmp

Filesize
23.3MB

Download
memory/1740-8-0x00007FF6F02B0000-0x00007FF6F1D04000-memory.dmp

Filesize
26.3MB

Download
memory/1740-115-0x00007FF6F02B0000-0x00007FF6F1D04000-memory.dmp

Filesize
26.3MB

Download
memory/1740-0-0x00007FF6F02B0000-0x00007FF6F1D04000-memory.dmp

Filesize
26.3MB

Download
memory/1740-1-0x00007FF6F02B0000-0x00007FF6F1D04000-memory.dmp

Filesize
26.3MB

Download
memory/1740-166-0x0000019BE75D0000-0x0000019BE8D28000-memory.dmp

Filesize
23.3MB

Download