hxxps://malwarewatch[.]org

max time kernel
213s
max time network
224s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-01-2025 17:08

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://malwarewatch.org

Score

7^/10

bootkit discovery persistence phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
124	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250108170858.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\13d6e753-1c8e-4278-b97c-2f337af59071.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
5660	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
4580	msedge.exe
4580	msedge.exe
2384	identity_helper.exe
2384	identity_helper.exe
5564	msedge.exe
5564	msedge.exe
5160	[email protected]
5160	[email protected]
5160	[email protected]
2076	[email protected]
5160	[email protected]
2076	[email protected]
2076	[email protected]
5160	[email protected]
2076	[email protected]
5160	[email protected]
5212	[email protected]
5212	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
5232	[email protected]
5232	[email protected]
5212	[email protected]
5212	[email protected]
5160	[email protected]
5160	[email protected]
2076	[email protected]
2076	[email protected]
5212	[email protected]
5232	[email protected]
5212	[email protected]
5232	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
5212	[email protected]
5212	[email protected]
5232	[email protected]
5232	[email protected]
2076	[email protected]
2076	[email protected]
5160	[email protected]
5160	[email protected]
5160	[email protected]
5160	[email protected]
2076	[email protected]
5232	[email protected]
5232	[email protected]
2076	[email protected]
5212	[email protected]
5212	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
5208	[email protected]
2076	[email protected]
5212	[email protected]
5212	[email protected]
2076	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	3052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3052	AUDIODG.EXE
Token: SeDebugPrivilege	6032	taskmgr.exe
Token: SeSystemProfilePrivilege	6032	taskmgr.exe
Token: SeCreateGlobalPrivilege	6032	taskmgr.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe
6032	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1272	[email protected]
5160	[email protected]
2076	[email protected]
5208	[email protected]
5212	[email protected]
5232	[email protected]
5260	[email protected]
2076	[email protected]
5208	[email protected]
5212	[email protected]
5160	[email protected]
5160	[email protected]
5208	[email protected]
5212	[email protected]
2076	[email protected]
5208	[email protected]
2076	[email protected]
5160	[email protected]
5212	[email protected]
5208	[email protected]
5160	[email protected]
2076	[email protected]
5212	[email protected]
2076	[email protected]
5212	[email protected]
5160	[email protected]
5208	[email protected]
5160	[email protected]
5208	[email protected]
2076	[email protected]
5212	[email protected]
2076	[email protected]
5208	[email protected]
5212	[email protected]
5160	[email protected]
5160	[email protected]
5212	[email protected]
2076	[email protected]
5208	[email protected]
2076	[email protected]
5212	[email protected]
5208	[email protected]
5160	[email protected]
5208	[email protected]
5160	[email protected]
2076	[email protected]
5212	[email protected]
5212	[email protected]
2076	[email protected]
5208	[email protected]
5160	[email protected]
5212	[email protected]
5208	[email protected]
2076	[email protected]
5160	[email protected]
2076	[email protected]
5212	[email protected]
5208	[email protected]
5160	[email protected]
5208	[email protected]
2076	[email protected]
5160	[email protected]
5212	[email protected]
5160	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4128	4580	msedge.exe	81
PID 4580 wrote to memory of 4128	4580	msedge.exe	81
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 1528	4580	msedge.exe	82
PID 4580 wrote to memory of 880	4580	msedge.exe	83
PID 4580 wrote to memory of 880	4580	msedge.exe	83
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84
PID 4580 wrote to memory of 4644	4580	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://malwarewatch.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb329b46f8,0x7ffb329b4708,0x7ffb329b4718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6e37a5460,0x7ff6e37a5470,0x7ff6e37a5480
    3⤵
    PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1140 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13420777722402971074,13752089824884791681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
"C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1272
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2076
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5208
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5232
- C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\572ae245-bd4e-4c06-aa06-fbf0dc3a4f65_MEMZ.zip.f65\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5260
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5288
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
    3⤵
    PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb329b46f8,0x7ffb329b4708,0x7ffb329b4718
      4⤵
      PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
    3⤵
    PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb329b46f8,0x7ffb329b4708,0x7ffb329b4718
      4⤵
      PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb329b46f8,0x7ffb329b4708,0x7ffb329b4718
      4⤵
      PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x148,0x14c,0x150,0x144,0x120,0x7ffb329b46f8,0x7ffb329b4708,0x7ffb329b4718
      4⤵
      PID:5508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24dada8956438ead89d9727022bac03a

SHA1
09b4fb1dba48ec8e47350131ae6113edd0fdecf0

SHA256
bf1e5c7828e4672982b16451b5a201e65e812e98a97b87c9f2f7c22677cb4ec1

SHA512
03f092a4b20a4d8cc111220b35fbf5470878b7723faeddee65b1d9cf327167053792c77864103b4530b9b9f819e32a5721b44189291dfdb5832769835ea5dd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b712a4c83dfb3c522d032cf900e863a

SHA1
4f5bec4be6f4ebfa959e899ceafc62309bb1f141

SHA256
31da2a41a051db11559c47feb923d4baad32a384f530013a435fa884dad64493

SHA512
03b24d9307623b3a341230805f3ea662b0107c314650a51ae7e89d901cb3ad212d4219bab4d763d0aa8d50831aa0e6d4e3379573cc2f724873804578e8642898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f073249d4ef50b5bce7717df9540456f

SHA1
b2590ec97c263094e13591c8d6f13cd48cbcf1d6

SHA256
7d8768f953493198d4308e7e3024991fb46ed6ae6a9d1adb4a0ea511767ec802

SHA512
0e81f27050b7f4c9540c8252d90b624b413bb8ea61d0752a09f377237d76ddd5062c012a0b9e00b32b709098696948bbe9712b72ba0f53672ed6b1f2910b0609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
141d929eabd71e2b1dbe646d5b9a5949

SHA1
78eae5907ee81748f61140dc6d67a7481e36ba28

SHA256
bb71996a38539ee764201b4e186fb1a4ccd2d0bce4b79fb6fa8fcb7d61215de1

SHA512
bbe6ade554aa74a5eb58849dc1552c5e4d12c461fe9ae2755493782f558d14036e1034c64e870c8e17d676877cc1f4ec23b692cd9419c33308368a26c18354d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2dc0520a0b5846c3466bf43f7e94faf8

SHA1
db1c71b6a084d77c5d76d5a2c6f178ee63595acc

SHA256
aa7618c6a31fefa716c6abdf12d2efa3561a783dae626958621b56098426a53e

SHA512
3cf14943a3a653a2aa8ae985de2bab2a16013fc7335aff0603de9cb7053e16286947e589cc55596f49002910e101e5dce42e07edfefbe371e7a7b0902978ed7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
13c0088984af8c989be98c0aa0ab3ca2

SHA1
f8978d3618f115b07972f37bd05359a126e45973

SHA256
445de7d2910ec7ecb7c177c4fd626f40f582e76fe24d0fc0d3c612e2aa3bcbeb

SHA512
6adad81804f278c5820f3957a7d8b7bf83e7039a003a859e9843e3c73736fa75f57fa539097576a6d7226892784aee632560ff9da294ab43c6fc576f66e21362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d28c28874bde4231a8fa78407fded0f4

SHA1
0bc3ae99f1bfbc61e8fcc22c6a6980dcf4102124

SHA256
0502b12de441ad6c3445d396c45bb1816204f012299ea790c103b5c6acb5cb4c

SHA512
d592fa9fcfc37d191b7f757b20bda427b3e92bcfd616a68efe90f65a593fdaf4ad314395a6e1b73bbf87b01569f7477e1cb51fe77258b1f527198cad25a7af08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
139ad9a3a1b7c12c6adf04017e52a6cc

SHA1
fdc50a8373cddc366721993bafe1cd5e39c07f13

SHA256
116f64cb7e4d60133a81ab0de187c7120d5bba8f4a4ca90690345537f138e559

SHA512
3c8da1e421abe826ca7552af7cdc8d171a40455c02507cdbf054aedb76fce22f92ee7bd1ca36b7e3322ac3042db9efb6409bcf89af10a6fdf7ca265029722409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58bd21.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9987bc45ebcdccdffe2a87c70589578

SHA1
b408909008704d1fad6a16383ee94bf99f425ca8

SHA256
44b244fa1b940e99745be022f9d62623e78bd8daf45332e43e8934725a642665

SHA512
73c6b1aee402c98c94a0a0c0b2ef6c85ca74108f9863c87c16a01011f2dd704c930d131a18db71f283a499607117d326f974acd8b0ba2d3198b0f9ccd245c3bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1d98076cb526cd5c62b43a6fd479e892

SHA1
8fd518eac23314668996947740215f9e37db4573

SHA256
5c297461db9766dcf88e7166d3865649d052827ed401fd214c35528f2a182dfa

SHA512
40ecd013b943f02aabfc99e4e878e9ce187dce181e365e2df66e3fac014e4b6615e42eb4dfb30f56bc3ae48a38cbd57d88d4bf603fce973db97e160157c487f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
efac7b969734a1d4f993978678e8df1f

SHA1
84da0aaa2bf54e1d9a4d16a019b3ef8731bd4af7

SHA256
ebdf57d99813af49de99c13c1e16d2c621ef108ba831f61f2bf1a49d099b27cd

SHA512
50ae5ff18b3b11b5dc3fd4825e7c48077133b248192baab39eaef795f23480b0b20dc78821c0cf95a2a6e70527dbb8d726de2172fee0fe4f58c2f7ea21c810c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
868e02787b1a606f7cc52c768b05730d

SHA1
80e7de9482685430ef5eb20ddc2528a1e4d87ad3

SHA256
4eb69724feaa67edf5a331ecec32e1b904338acc37adff0c7894acd559c4d09f

SHA512
5f3a129dcc5efe18582118e9dab6e7a7992d58f1951ea456a1793479271ad9232880846d06e02ba01fc9fc1932d368a0c9039aef4e8774a438b99280ab954d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f6acf4e1d5edca566bf02cd7bb3666b

SHA1
31257799eea0fdb40ecdfc10a69af85be8aa660e

SHA256
c34d6818b794ccb7df0cdea895256bb821f972ba53e19473af0164d1074aa5ff

SHA512
9046cb5731ceee45cfe6017389b100149c616fb494a084fb89b933df1f5d24f4e506a67bf3933a4ecb18216a53a66121343f6fef051e8bf36cf585424969b9d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e29550793301f1f340f91e75df5c038a

SHA1
425ac180e533de1e9de14ad1c8e0f0bf19a92229

SHA256
a0e2f95f29a4fd7225d6a415566a2327b2eb17ae224ddf4c2944302808b09e71

SHA512
81221451de3ed1976a696e78621861a4d5f6188dbef119c58053d310338c745855781ee2ef336b1b588a40269211d4c5793338ab483b5d7da58e2880b6c67e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f69c0a67dd06b984b3d07df86016e488

SHA1
4568e87ffc3f3fb495d5b4988c88bf38c71093b1

SHA256
b98002d2045659fea591307a6e75e93b4641fb9756831bb1813465a56233b089

SHA512
31d3e968f74acfbf46661de5f86c0959ad4e3596880a591e45a20ae90dc4c092888ab0469d7879194a94677cfb6d2366bae3897cf4ad63608693f14e734cb721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
29b47cca17baa04da59b4d18b747ef50

SHA1
e7e82d8ce9c8ef320f0d9fbd24c503bbfa60b701

SHA256
35ac96f61d0131cd4ca30a636b7fc58bb8d60827ba7b249eda149e4cd0c117b4

SHA512
459dfee24b4571e8fabb30e1714ceb0dd8b9755850303114b526bca016727733b4fa45f39f55e9da05f98ae8948654eaa64996b69d3a2ce193adf7269df08e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
99a7edf9124dba808b6d025b14aea278

SHA1
f1de2fdd81ea87ee78e8afdc1a7cdffcf62a92ef

SHA256
9d38a8d193a503b9be7b39be5d150bcf22038c84fbf3d53979e2f075a35b9089

SHA512
fc371b7ad5606a9948ba4a315e40a0a93592f57103be4a3712020977b43e4277d95d74ff35e490239dbce1cc475fe1d1746764f5970d2e9f04483c985268f5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3fa9b95bc32d0c03d0bdbec9c8f730a3

SHA1
680b1383dde64ddc4c48613934c66d54f702191a

SHA256
cea28e2534930baa82606b830bd3779b79971c9f58bbd069c2e522f22cf1eec6

SHA512
57b44c2fa07602aaa197d73875148adcf2f65c9cf5bee02345483e398d404cfc39c0159effe6cc7e1601553650737173603b78aaf1797dbddf635060b7a56579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a40c3.TMP

Filesize
48B

MD5
beff5d87d9eb6415e6e85d459fb80640

SHA1
0b7c8cb37ed85b5d2271409776b89f31fc53d70c

SHA256
3307555587d66dd2491a6d105ffc510e51e4673d959834167c0082809fa65de3

SHA512
f7ca1341c58255940fb603ebe68ad89593b141291f0402e572a057da5c6016bbb692530d7438910251e4423118b0ed4e9f4fcd654d81470c71024302f7f372ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f0ce1d97c8625004aa1f3984bcf6a1d0

SHA1
43610362f3fe6da72100223228a2ae87dfa8f2ba

SHA256
b9caa85f13fc1ac4a88486d6be7a795665fdb39a320ae2f8a8f1a7314763ad4a

SHA512
065576533f2b89fc4e133e3cd568afa47900e34916422386443d0cf9eb0af415bf09e1e923165e89796eb8e7b8a37b8d9ae67d76960c2400332bcc1a127bb4ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e557c42a38fdaf44c4c97f840c3bf0cf

SHA1
d98a17f31f5fed97000961c30f8ad0edba86bede

SHA256
c1760611d1ec59d9d6e6d2536f43701cc243c4f3da23776223c6edd27e401ed4

SHA512
67bff1f328a092e68a8c167df283a1dc6c4ef66d827916e49af81fd282c77997b2a6625379e63c38eb47ce1ea185c1e61fcaccdd93b62cca18752bf59121b39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
414fc9633877d3cfaeb31524868296c7

SHA1
6de6ecd8836b66a790df5a77ccc91523e9ad5355

SHA256
dd0dcbd6b64ff48c65fbe7e90dce7cf30c133cc19b32064c01b48f154e06026a

SHA512
4fba5613316d2ae44efaa6771ee74b5306f91e4e8a4f9c3a71549f2da52dc7500c563453a9469a26fa7229e48bc3caa6390beb294c24eda026ba3c25bbe99405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
75b931cdaf413e4e3f0b068ca4743623

SHA1
5cabbadc8b7a8112de1c363dc8814bca4a3f6ec9

SHA256
06dfa4f119a8fb6e0f003ef2087eacc67b161b08ce1c388e5496d07aa1f12235

SHA512
7b801d36aa97fcbc7b7471dadca3acb78c05f77ba3b68505489cbcb0f2fe0fb165134f9042a94865b8f34e4f3dbf5c85529118d8763457e7c49ae341d975d7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc42.TMP

Filesize
1KB

MD5
39ebd46fa0236360158dd141b49c3b57

SHA1
e898ebac0a6deac5cfa13e03fc46a283c30e5b34

SHA256
e5d61c9d79a46c9f6d0c5a6cd0b9b7b4aa00b6d1294627c4d8dee14348559509

SHA512
77affa893ac958288a466b39232a35beeb5f2d4b9e16f3c0446573ad83fa341cb9aae0a703f69a967aa30151115dfe608737152fed54528007120d524be38384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9a19e72-7fc1-4f05-8cc3-e4c601fe8834.tmp

Filesize
24KB

MD5
85eca930a791cbcb1373f5fdaf17857b

SHA1
ffea7d54e9803374a484f1e4c124766e80024efc

SHA256
fbc990061790350f00dc28f2dda277aac81bb8385a6e92e90a20101436c3312c

SHA512
2ffe0de3f80ac60f2ffa55f334026979e6be328b7c69f4603aa3c5d1bfa6c3b3744d86ac2a34ecf904d0a41b36bc485392ece58f6cc89d7ffca293d02efe5bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0777493eabe02c780271079936e477cd

SHA1
4d817685ba4f3719eb27375726407f141234ed07

SHA256
12072d55ca4eaf7bf565f877032216fb016d402e62a0b9c2dad7b61392bd1d2a

SHA512
ad732af06fa2949b1fbb53b163c1823ef7588a5403a2d34a7277688fda1127e9c2a262f682d00be4264fa02b75df9eca48624eeefdfd0ef5ded7acf4a6b09eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
822e17dc2f8688c376842145b8498a6b

SHA1
1b0d73c00aa803bdd7dd93e3679750d8a05925c1

SHA256
df28889003b6cf25c2409fc3ed9ac0c916bb008e9e5132339abde3f74e34ae10

SHA512
83860a7e03af3cace6794b1ef35e5564f8f2fe83c186722cdf5c1cffc21693b4db45fbb22d5f2234aa1a4f891c6c322cf9544eb5e4854c480c5af4dc415ca2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ddfa53764a13c17366cbe4ce9e8e5948

SHA1
5eccdaf6d83d750dda4ebd2bbdef6a4e7b0e519b

SHA256
c21694c4c463f6cdd8a5c95f088cc8ef5b61f50bc5bc9295a9578ab6ae2d003b

SHA512
eeaade6e3af6e67ba20c6cfe5c2b1a7bdea0f00591fea9b5290196ef0f76b3e0886d9cd2bd1cd25a1bc9bce11df7228c38dac0fdbf007933b9d83fd34e19a77b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2174e49b8313df8ef799c91888e7a5ff

SHA1
5553ec36e20eedf531f8c9b20988cfca1e207ef4

SHA256
2e49f3f53f3eb3030d5722aa6085b35b40b097fe35bd2acbac0b702b2d550168

SHA512
07fdba8090cb0d7dce9a457646abbd89aa4858bc540f3d8b5d644daf6870a3ed6c6a437a5482b92e43791947942636685572ecce9795645af5e1994c5b483a3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e09f2276ff13f2e5140678131d1a517c

SHA1
c606b2357b08306889672cfdc4f1ca1816b5e50f

SHA256
798ff780fe885ad03d380d99c96092c57a50aa3dd9570d08b594b5c3ca877ddd

SHA512
209b300823cdcae27002fcb9550f8c1b0cb07f940b9c56536082eead4076c3ae1ee2f79d6fdeeab56c676cc54a91d70db759212d450556005b25c21b66fcf7ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
eee09367fc86a45ac90a025d6474d7e9

SHA1
3d1caa1e92cdd6241b46b8d4392303ba57ba9337

SHA256
8ee611e6a9112006e18135221b8808040beb2258687cd44d21075e8ea660749d

SHA512
e1a7c10319db3a7d4a0e0f394d9fd1b4cbe9ca697ea095b2dd962c486e4121e96750e5328bdaa4a04bbb53baead0101c10f561a48a5983295b56a6b0c9038968

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
8KB

MD5
9b50609f94d5a9b0fb029e4a7a841a26

SHA1
1d3b0c0480900cd6a5073d29f81f9ab3831597d1

SHA256
988ae1b80d22247d58a914ac501d4f512ab32961a936343a9d4bb7823f50405e

SHA512
e44827560cec6d9e85680507b3503f0031ccdfa98d7e4b3426793a66e3253d2bb5f2a004925b77939be1f13a2de370158c1c709e85ed7b3fae9624437556ffe0

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/6032-875-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-864-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-863-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-865-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-874-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-873-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-872-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-871-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-870-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download
memory/6032-869-0x000001E034E40000-0x000001E034E41000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads