lumma | hxxps://www[.]doorsplus[.]com[.]au/just-a-moment/

Resubmissions

30/03/2025, 02:54

250330-dd4j3s1ky7 10

30/03/2025, 02:21

250330-ctgjtax1at 10

Analysis

max time kernel
228s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.doorsplus.com.au/just-a-moment/

Score

10^/10

lumma discovery phishing spyware stealer

Malware Config

Extracted

Family

lumma

https://7devloopt.live/GiaOzp

https://oreheatq.live/gsopp

https://castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://smeltingt.run/giiaus

https://ferromny.digital/gwpd

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 1 IoCs

flow	pid	Process
208	4844	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
208	4844	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	daff2f8.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	daff2f8.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	daff2f8.tmp

Executes dropped EXE 15 IoCs

pid	Process
1016	daff2f8.exe
944	daff2f8.tmp
3724	daff2f8.exe
5648	daff2f8.tmp
2360	MInfoNT.exe
5860	daff2f8.exe
5188	daff2f8.tmp
4952	daff2f8.exe
4584	daff2f8.tmp
2416	daff2f8.exe
1316	daff2f8.tmp
5456	daff2f8.exe
664	daff2f8.tmp
4684	MInfoNT.exe
3424	MInfoNT.exe

Loads dropped DLL 18 IoCs

pid	Process
944	daff2f8.tmp
944	daff2f8.tmp
944	daff2f8.tmp
5648	daff2f8.tmp
5648	daff2f8.tmp
5648	daff2f8.tmp
5188	daff2f8.tmp
5188	daff2f8.tmp
5188	daff2f8.tmp
4584	daff2f8.tmp
4584	daff2f8.tmp
4584	daff2f8.tmp
1316	daff2f8.tmp
1316	daff2f8.tmp
1316	daff2f8.tmp
664	daff2f8.tmp
664	daff2f8.tmp
664	daff2f8.tmp

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Detected phishing page 1 IoCs

phishing

flow	pid	Process
92	3220	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_43412278\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_1685849416\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_1685849416\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_752_381852233\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_1565614250\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_1565614250\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_1685849416\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2117521697\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2117521697\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping752_2025831560\_locales\hy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MInfoNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daff2f8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MInfoNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MInfoNT.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877769051726601"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920955164-3782810283-1225622749-1000\{6F301DF9-39E5-4F2A-B833-4267C5D675EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
5648	daff2f8.tmp
5648	daff2f8.tmp
2360	MInfoNT.exe
2360	MInfoNT.exe
2360	MInfoNT.exe
2360	MInfoNT.exe
2360	MInfoNT.exe
2360	MInfoNT.exe
5352	msedge.exe
5352	msedge.exe
4584	daff2f8.tmp
4584	daff2f8.tmp
664	daff2f8.tmp
664	daff2f8.tmp
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
4684	MInfoNT.exe
4684	MInfoNT.exe
3720	taskmgr.exe
4684	MInfoNT.exe
4684	MInfoNT.exe
4684	MInfoNT.exe
4684	MInfoNT.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3424	MInfoNT.exe
3424	MInfoNT.exe
3720	taskmgr.exe
3720	taskmgr.exe
3424	MInfoNT.exe
3424	MInfoNT.exe
3424	MInfoNT.exe
3424	MInfoNT.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeBackupPrivilege	116	svchost.exe
Token: SeRestorePrivilege	116	svchost.exe
Token: SeSecurityPrivilege	116	svchost.exe
Token: SeTakeOwnershipPrivilege	116	svchost.exe
Token: 35	116	svchost.exe
Token: SeDebugPrivilege	3720	taskmgr.exe
Token: SeSystemProfilePrivilege	3720	taskmgr.exe
Token: SeCreateGlobalPrivilege	3720	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
5648	daff2f8.tmp
4584	daff2f8.tmp
664	daff2f8.tmp
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe
3720	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2488	752	msedge.exe	86
PID 752 wrote to memory of 2488	752	msedge.exe	86
PID 752 wrote to memory of 3220	752	msedge.exe	87
PID 752 wrote to memory of 3220	752	msedge.exe	87
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 4656	752	msedge.exe	88
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89
PID 752 wrote to memory of 1036	752	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.doorsplus.com.au/just-a-moment/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa93c4f208,0x7ffa93c4f214,0x7ffa93c4f220
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Detected phishing page
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3544,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5220,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5968,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5968,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6180,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5076,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5068,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=116,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6132,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6296,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6528,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6532,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6840,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2872,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5344,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6936,i,10054482144508736429,12647766829451356023,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
- C:\ProgramData\daff2f8.exe
  "C:\ProgramData\daff2f8.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\is-Q87QT.tmp\daff2f8.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-Q87QT.tmp\daff2f8.tmp" /SL5="$17027A,6573080,119296,C:\ProgramData\daff2f8.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:944
  - - C:\ProgramData\daff2f8.exe
      "C:\ProgramData\daff2f8.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\is-PQF98.tmp\daff2f8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PQF98.tmp\daff2f8.tmp" /SL5="$F0214,6573080,119296,C:\ProgramData\daff2f8.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5648
      - C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe
        
        "C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5472

C:\ProgramData\daff2f8.exe
"C:\ProgramData\daff2f8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860
- C:\Users\Admin\AppData\Local\Temp\is-BRGDQ.tmp\daff2f8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BRGDQ.tmp\daff2f8.tmp" /SL5="$802E8,6573080,119296,C:\ProgramData\daff2f8.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\ProgramData\daff2f8.exe
    "C:\ProgramData\daff2f8.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\is-A9NTB.tmp\daff2f8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-A9NTB.tmp\daff2f8.tmp" /SL5="$702B8,6573080,119296,C:\ProgramData\daff2f8.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:4584
    - - C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe
        
        "C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4684

C:\ProgramData\daff2f8.exe
"C:\ProgramData\daff2f8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416
- C:\Users\Admin\AppData\Local\Temp\is-275I2.tmp\daff2f8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-275I2.tmp\daff2f8.tmp" /SL5="$30306,6573080,119296,C:\ProgramData\daff2f8.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1316
- - C:\ProgramData\daff2f8.exe
    "C:\ProgramData\daff2f8.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\is-GG3AE.tmp\daff2f8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GG3AE.tmp\daff2f8.tmp" /SL5="$3016A,6573080,119296,C:\ProgramData\daff2f8.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:664
    - - C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe
        
        "C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\MInfoNT.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping752_2117521697\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping752_43412278\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping752_43412278\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping752_73738778\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\ProgramData\daff2f8.exe

Filesize
9.5MB

MD5
1ced791e1db0ae0739e323e40cd038d3

SHA1
04b7690fd41f96ce3c8997bb19fca28d7fbcf7de

SHA256
4211303404be55eb03c15691c92ba77af0b1662727572026801355fb50392980

SHA512
4d47b4c10fa4789d066156e507a8ad1ec5181f01416a26eb4d7baba76740eb3ad8501e863a9c68a4109f00fe68731d68839098989f215f28213065457ca467a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79134b24-be1e-4fe1-8968-37741b73b535.tmp

Filesize
40KB

MD5
12fffbcd85f6a6f76cbb35607ff126bd

SHA1
874d3c025697d7525c00d63b5460178ec5228e53

SHA256
67056d001191ff5b6006c66554e0ef8297f53da8ec969b686f2a00e7dcc039bc

SHA512
3c377a6de5aa89731cb7f9c6b229b7b40b8b995292012ee098512f1795f5c8dcbb95c61ac35360ca94f8c10209907c4c71a45fb85cfd544cfa7cdd3c7e60d582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c37f9d2c357647fca20f2eaa89c18edd

SHA1
cfd1035ed2d057c317b48546f467209cbbe15f2e

SHA256
2ea3a0b7e6145fd110653b1a77cb827ad7e4a145c29378344bd3d28f595b2072

SHA512
3563f4aca9e47f35de8cb38e42a3c0448bb3ec4c9183fa392abc28fee4ca08bf16da028ffbf31cf0c0f8301ed810238961e745590e5c71621bc5a2a889dd12f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0415858ee4e44709bae20afaf252ba62

SHA1
1c26c37b7a7a8dedc24d8bdba7fd8e7b4c035958

SHA256
38f896eddda4d72864ec1da909cd800ecce8980a3c24df91055c0130f991a393

SHA512
72e38752e9e840a186228f74f68517c1bc47aec267f684a9b6d835f3856fd88c7c046c1252a91b3efa84b9dd6d5c4b90a9de9c381b809174da815a9fc3f8f831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fccf.TMP

Filesize
3KB

MD5
2a7b4f0374d5b40c29b88352f95a85d8

SHA1
1d88c465442f9b59eadb9b8168be5f01b8c340a0

SHA256
accf88a5e3d71bf7ea470a4e16b6d7048a168feb72d081532af3ff07aff95cc6

SHA512
dd96f8eda53305cbcab262acd71e75e8f7ec7867049630ebe9bcb5c81c8266cbbb5e25db3cb66a63f07eb997eeabe7c70a8a077ed065f4c8e90abcc7bf404a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a003b262404214a0beee4dbad3d4598d

SHA1
e04f0378a0bbbd6f7633f4b3034bece3c74a1505

SHA256
bf64b3f6fb1d69f71c74bfd45c7d0fe105c6b319d6f17520af3b48e3170ce213

SHA512
3c20d313c04c43a8895a96f7394e13bed733178a713f219ffb73f94aab14a1ba68964b1233c64cf7dfa44ca97fc3cdb7c4a46a4c058dcfb826236656887e18d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1b243d386c7a35affc370913431a721f

SHA1
c722fb3b2a9e77caa01067076eb09667aa36c42b

SHA256
dbcfba5575163c23eeaee6300086b653fabb439e56ee39fdf498686196e0f829

SHA512
0f941a71ca3804a5d0fcc0118bcf1e65bb41a47ee74fc6675850409740aaf4a2eebb0f3def11688853319256544de93f37bac511d08937d551192fc2df15ff8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8f1585cc088844ac75688c08c4d29904

SHA1
3247d2031f5792cb0f6c35f91b2f0c6c63e2f447

SHA256
242456972291e9839ee63eac153111ca7405af6ef912db1be544d214158766bb

SHA512
643e65594134750ad9610eaffbcdc2f09420d6cb6e3626086700632bef48154d7eaa462ecbf0acacbbae00b3dc546bb54a0ce1b30aca80f596cbbd6b333bf559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d79b4e86523555b9c1fd0c351c278f06

SHA1
f97f49b792602993d8f406061ab6db7667e87985

SHA256
5bb770b08808cca3000cc648de84ce208bcf3be8f66d3d686b8cd618ea4e061b

SHA512
2ac93ebd0adcb8e6da1486a65687181e720c84610f988ee2c02950c932e5be1658bfba6ec703b5f354abc6ece0f5e2125621f24ad98a2cc7007d6b3820042589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
24e78488b9633a0d46c4096530aae662

SHA1
aa323ca3609b1f04eb640e8f8bed775e2b92540d

SHA256
70788abdb26dd7cc6633a1bdbfc6d5de1c1498f417b56ee04d878793ddfd74b2

SHA512
32c1e1e7b3d41ab540c4db99c23021e1f98d53fb406a8db658aa76ace94da99e74cab5adbdc860f6f8aa37b000bfcf9655274ab257f50e3d29e2037c1e18a70e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
994e606ebe4d5cf6325f71b1ee49f781

SHA1
d54e1c8303e12bb69908f85b0cf164ee574f05c2

SHA256
cc833b9381bd434beb70287b9094ac38f00a85c5aae398763b5d07fbd6847ebb

SHA512
a1b07a2a68850ccfb37409de20d300ee9085e1fd5959a69408e7560a9664aedee5fa706626ef1db12aad73bc9b77c46bffd929da5153ac6087bed6da6dac2f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a8d33ae22fe130867b140b4e5a2889e4

SHA1
15dcdaa1af08ec0aa55085eba073d9bb2eea54e5

SHA256
513e4d2de52f8e1f92ec21088db4a273aaf070891ed8ca75190dbac1d24a6af1

SHA512
7571e2616291f98a7ec8f3396a47a15e612d76bbabf70d3edb690a3a36015e340a0191a32d712cbb801e0900d67d47a00d0b176d8ccecf2b7c085d0bae7065f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\6385289c-a048-46f4-a84f-2e4968cd5f70\index-dir\the-real-index

Filesize
72B

MD5
54e7492065b78bd97c42d30de342e442

SHA1
082e163cd8600731ae129f87fe07e0551e9c6f27

SHA256
bef18459eea7ba744d103e2df9509e9273a82e57f5269185d0c99a29a1e25e98

SHA512
f1b797b9d66c8bc6d87cf49dbecc158446eb80088fb598261b1d16a54abeb93183890fb6f1f16bf09ab520b6fbc2360f411cf684f718766ad8fafcc4c5357e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\6385289c-a048-46f4-a84f-2e4968cd5f70\index-dir\the-real-index~RFe5804dd.TMP

Filesize
48B

MD5
8eb9f603169d6b7f374da31212b389c4

SHA1
3fbc8c8cc92d8230910c46effe76e3a5d06e1602

SHA256
d6ea9fbf5743f22edca1c107f9ab435a9b40255d775b7b9a2fb7938148a2e222

SHA512
92270ce5779727065fee1f1c522408eb0aa105ac33d75534d6e8d5a7f0a8eb3e794d3f9e390a0ddf3c62d9eb73347181961f9d22d0f57fcf1c039a1a1325374c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\6c7114e3-bfa6-498f-bf2f-029f05b7ec31\04192d36108742f3_0

Filesize
4KB

MD5
c555c05884372d2fb6f792ff5f1a9fe1

SHA1
f3e64648be0f47c75d2519cb077ae4b550494722

SHA256
a539dc831041b493db657501fd82fcf0549b1064c3f9269f366a8790906182e5

SHA512
9c2322883ffce783cdf3fbbebbd43330ecfd736947e4b028884604989d9e58afb83e057057db01d19b441145afff24b4bb77012c8df956168e61262c34de27ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\6c7114e3-bfa6-498f-bf2f-029f05b7ec31\index-dir\the-real-index

Filesize
96B

MD5
d4ce9a5c67af0304c38c81f912c0efb3

SHA1
25ad629c11d2f034f824ffe37140300cb10d1750

SHA256
3d7d1a895f8bbc08c5b32f43531435dded9f5d594b2764f907560c78e9201d7a

SHA512
428550b93fff52cf66c655ce40b39a212ff199cfe290b03060071a87f176fa2c22ccc0e1bc925ad4f45825bd0fa918899cae14f9ae37be7624ba815a538dcee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\6c7114e3-bfa6-498f-bf2f-029f05b7ec31\index-dir\the-real-index

Filesize
48B

MD5
2f2ffb205e4fa4b0d3493e32db043433

SHA1
7fabf686550b9659d29dd0d365cc762a3056583e

SHA256
b18dc8b977ee237ef3fe8df049560fa35611822fd783bc8abb808941c19859e2

SHA512
9568f59f2ffc276313d6bb3d051a30d8063d7a57638d2bd6fb4f801e103b7d04b07479aa20d1f8b76f8109706b1aa6a5653a3e07a6c3964b01144921dbb88c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\a01c6b01-056d-4144-8ab5-1722d1d99364\index-dir\the-real-index

Filesize
72B

MD5
19b5404c51bc9266b6a516f03b1420aa

SHA1
5230440c14cc4cb074a44d351d2163966e21cf66

SHA256
93db00e380a4f8013f1ec9f802c37ff6eed04adce30c680b9babe8a1353abec7

SHA512
f8703299386c34116543f859066d3602564f2b7e221e3aa66bf04a52a2c337ba2ac21196bf794c2c32bd9bdadd38378b5d5677ceef4f4ec1faf59d6cfa219759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\index.txt

Filesize
262B

MD5
f591b210e19faea4837f16d4f816dac7

SHA1
2857866ca9a3740c83bfb82e816d00068d8f0489

SHA256
a506c5cf8d62ef0cc6124eff7d549bf294401b90d96b0e7e564576b4c4a9f575

SHA512
2f4d31a8d110723def3f92fb321d9f070c3cc30de75bdbd6f6f351b61f286377f07cb4dcce384143b9fe81bd09725d9cc303afe61d25950222266a15cfa2e1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\index.txt

Filesize
264B

MD5
d110f69662cc485a5e641689b168739a

SHA1
5f2fdc351cd0446f135637d671ceaabfd82c720b

SHA256
ba23a2d2f4db7dc8041e491defdb614c11979521b16bca25a965b9ad5c6ba834

SHA512
948cc7bac1b08709323378ac6593d1301a8e4be822a78ecb11fe2864af07be5eff27b1aa6946132e66ab742dcb2cfb8feb347152595b6bc4c6f4101f1e141c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\index.txt

Filesize
203B

MD5
2e59ab503cabb5a3619819b30b04cbd5

SHA1
36825e57c3b4c9f6f77164d6718ed33f713c4748

SHA256
5a4c028266161c253a6cca92929af7df55cf04fac98effe08fb701ff9a8d3219

SHA512
99152a2f3ee5595d5d2107196e7127e806fe23366044048f180dfab5b380e1698786e4379f3fb747e0e27dec7fc807529168edc258fba9f6f2107179ea474d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\184e8a20286fe876b972f5ce68b1c7e39569fd71\index.txt~RFe57abb1.TMP

Filesize
138B

MD5
864f77e8fcc1914b19b03755ce43ddfe

SHA1
63e4128c0e40aee10ffc5c3f2829e0b1ca485b90

SHA256
d1020213bcac7d22158caf4692d7fc258446c9dc822ecd4b64b06dd83b31d61c

SHA512
b3e48d731179f79b41cb74e53da4439a68297e3b1234aa2bc0760ab105e255f1a86047e0136cea9adcf4aefd951a043ab468ac2d9bdd0189834477ca50b7efe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
df1aaacd9ecf20e689a40198e197528d

SHA1
9b4dd88409fc53a9cc81e8a02f698862c7386b39

SHA256
f77e842643580700e045c765e7f6aa8dfd7339f7340009f99b52df518a3a3973

SHA512
a268f7600811f31f2dd702273a80024caa1002380abb3efc40eb606676150ac03ba86e4ae4c93649494f69457b32306fb0ebc6392c2a82611fd37a082b439d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f9d1.TMP

Filesize
48B

MD5
fdf58de51bee1226f88fbf1807f3b876

SHA1
954068cfb20838694976667a967f8dccc094e196

SHA256
decf7e8d0b2c291fcc751adb7021955b83d635e1356a84a78a7afc6608a0f862

SHA512
c10576c27489192284dc8bb45f6f90eae551ef615e14af944d2ae93961c0246243a9601628934f88edddabe019a039b53a0ad5b37aa42e481d8cd7280544f572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
a0bd37c10f736ae9fd0591a471e1c3f8

SHA1
31732a901a079789a453d90fd5e5119732a684ba

SHA256
349cee87cf21e08a47e25bc6a24ea1ab6cf5357ee672aa7fa33f272d47315474

SHA512
d4112bde3d17cce814b65f792224ea370eb02f69437c047f95f6a87e1cfc867880cb0251955081c297144ec04250fad2e428d8f709830ab4958f665ff5a750b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
8586db5ceb41f1c37e332c10ee8bdcf1

SHA1
fd748023d4db019b54bda57e9eb447b702c04558

SHA256
b9cceaf649b0c7569bbfb5c4631f3c43c802ede6ca0917def0e03351299c2f4c

SHA512
e7bdae27ccccd7ae80c01b3829a2b8e7752e692ea85b8f6e796a4e29839680b3405d02f55219a6a67fdf61d8f13cae913f18c2f92b440806c7f06ed3831c95e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
bf90dd65e4f2109ea933fdbbef6f92bd

SHA1
8089e97bfed5d112254cca8aa834aa5c00b036cf

SHA256
2164fa9f903e7c9895fce4837bef40e6487334e3ea2a5e665bc4dc7a0613eb53

SHA512
c636cf3af47f4edd053f2d429b97765a87d9b3cd797d7645ae01973270ee9369a505cd31b0efbc9d25cecd2d49efa5b49eae7ae8d63d55e49016774a4db463c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
4a367e3e1650fdda929e4a433a7e76ad

SHA1
ea072d9e221fa2d4d9fb8011f927d0989d3c08ee

SHA256
a0ecb11037de243a27c1f174f2552e92a4f804a73da469d4e0ff66dda7aeb2f3

SHA512
1cb12d041d40f3ca9062f860cc25c3ec404dc19b5703c32f0f6c4983b2e58c59e95486a1a0e808e670775f0c4d32e18baba8f59e5092c2fb4533625f07157ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
31433f38b186b9bf96c5536216179cc5

SHA1
e1a16e677cf7711062848844bfb684cdf609cc43

SHA256
0fa151b0e47c4127eae642647845ec7357e500e73c22980d9f7642651e98948f

SHA512
4563f284ca1e5dcf9f2c8d173ccb2525274e15823a8d843e3a48851dd5bf094f19a394169f86d5f32812238863852fa3218f04ce40c9a89198ac51eaff412067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
9c7f1191b6858c005225c18e6fa9ba43

SHA1
63e7068c1239014a471bb3bf15bc725020391eb5

SHA256
fcced692b6ce5dfbed3c18283223af3e0e62be409d1be6dec8b58be9458a0356

SHA512
6e47012637f10d6ab5cebc2c5e0a281c457a251bd405243967f9a006d7989a54b61ed8118fc89f3a880abb69b79e75a561e615966196abb6cdf6eb229d7aa90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5610ad1afd421be6d317362be0e1c4af

SHA1
c996f3e52e05c46734b9fbae03b8740e8d028df2

SHA256
71ccd2cfa137ec392dac36ed6701ae89bb8ac82e11932f19c643bee6d02918dc

SHA512
fec830c40d6e53d3e6a5b703a5efb9e37f4e05c3aae23b6ee7d3e8076dc80d81c4702c9fa7b8cbdb49b39e8487913cd2b090c7bd9b6bf1c974d0b394b5f5154f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
6070d15d3062a34af286d89a4c6475e6

SHA1
7faa4ef530bd8c682ac9c48c54bd714ef4944311

SHA256
a09580f716b87c3f25d7c441a0f5f1bf3b504b78ae35fc326e5d04ffe779b83f

SHA512
065553d1b3ad485e5a0448bcee0e2e58faa6ede35616c15efabeb946648f2093193ca5bb4dfb682e3c783da2b750bc2bcd2233fc597fcc6b35e45175fbc9bcb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
85cc5780ca32b3f25177482f56137b97

SHA1
b89419d93c1e9bae17264a04bc7bfa1049af881f

SHA256
5b13e3e49f43c524ea46ac6fd50a3129fbc46965a4898571ecc3d06835801cdf

SHA512
cff0f993010fbbdfc6055e548c9b83c530a824dd9930ac842fd57f7430f164d84c12ffa53367aaef46f89f73c69cad30d24471c0438ca27fc75d4cf79dbd01aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
53e3ae8c50c6bb5f2e891cf7e59c2478

SHA1
e67b8286132f78050ceb0a4e0e08f97046f423ef

SHA256
d992cbb93efea1e3c18875c7088b4f4f82836a54c8258595f7e3ed12dd021b87

SHA512
114bd3b6020d321cda5766f12d0394a742c06439e5faf4057f9ce41705a86fdd171da90cf3c85d4494967b647fa4baf19a81ed4711fe6b42bd03e2b906c39a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h54haa00.ydo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D4M13.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HCLF9.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HCLF9.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JPCRC.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q87QT.tmp\daff2f8.tmp

Filesize
1.1MB

MD5
b1f9d665e52c29972b50d7145d88dce1

SHA1
df2c67a5c32a19bb110ec8372134522c0dab9ac2

SHA256
2ffabb0018d335267d2d0101a41cac7ac7d1aa80956fae91825e46aaa85c0787

SHA512
bcdce189402ffc1c17b9803ac4040bd1cb23e32ba2c1476cbcfae13438078e01f78ad3f76e1bf71a6ec204663aa5f5780990016fc074218763d63db1431f1e75

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\CoreVideo.dll

Filesize
248KB

MD5
71a9ef1fe75c74fd548ca11b657e7da1

SHA1
d0850bfc2b904a82858dfcc159c5bd97d081d2d0

SHA256
a7b6c72f54ca53d284f231256230959aecddcfe2340ae2897e3558eb6be98756

SHA512
cda1d9ddc950edbfc67434a11a106f1e9d5e385a957636ad2e9397af6d898ce1aba6d7723a9098e5826add3ee4d9246af5c429a20433ddd69286a15364f4b963

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\LocalService.dll

Filesize
259KB

MD5
cc1bb09a094143e53d03c39873c124d9

SHA1
948303dcea4dada79b6d8bee010a59fb6dedb686

SHA256
5c2546fd37d8e67373b2e51e3b3c8ec67ff4bd70224502286eb5afda1d756b77

SHA512
8680cc4772cb29ae9676aeaed63b2285e15d78f186a933e0b352499b41f7f97ea5cdd93752ad2e84df3d9abf9b47cde5799a9985814d10e78920087337175c95

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\Microsoft.VisualStudio.QualityTools.TestCaseManagementUI.dll

Filesize
282KB

MD5
2ff1dfb9b00b35b2e15cfa3c31a80c09

SHA1
32efc6c0b70d8a99b2dbc4ab8848fda2b41c212a

SHA256
53276255ad2d7e7935384b695038d18045289ee1b44a545a09ba1f98cddedbbb

SHA512
e548842dbef65588c75d962d3d4237f5e8556cadda5948f0e4dbbd65aba0d327dc3451ec12195c5507bdeb680db879c1607811c1dd641dde3cd0cd08a48674c7

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\PresentationFramework.Classic.dll

Filesize
266KB

MD5
12b4079e9b8a633bbdd73d2acff6fc0a

SHA1
09d0ec3283d24adda3e89d262e2534672ee6488b

SHA256
e402ba494618196ac70087d37739881f8b6732974c8124e6005fef39d5bbb55c

SHA512
31cec0f939bc6bd9e28c9c5b20d8d7be337a9c6677403b7f8d0c01788954accd6b5f0dd565a5ad7f58199b0ac3ef5e0fd7d7eae680f79b085dbe0a834ea13d18

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\javafx-iio.dll

Filesize
223KB

MD5
ecd247ec430dbbe8f9ed829e827514ff

SHA1
4fa71fe07d820d0f185fe2d8acf5b132fbcb7ddf

SHA256
11f428cd8602ec280ce87ce031842912f64caba3772ce32f06d40935001f9672

SHA512
53aef2f4e279474ec13ed60e40f836b6788d4108b0aed2707243fd126be16376723d7decec305ffdef69d3412f865d1dbeb58d5e9b991059bad0d11c2b921a41

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\libjpeg_plugin.dll

Filesize
238KB

MD5
ac92c5ea6611d9b97a7f70ef64d166a8

SHA1
956dc300090993af25a516c28d4b6aff79edc468

SHA256
7f539b72ad8a5cd75369792e887a55f86ce38ea600cc8281afeccb5a9a031b01

SHA512
6a2f95098fccc797a8c3852dfda39b8e96f3821ef8840ade98443312f20da0d2106d53a9a94675d96bc1b905faa4299f638c6944dc21033414975098a21c7184

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\wmfengine.dll

Filesize
203KB

MD5
bb6f3c46b003b34fd189c58b2c39962b

SHA1
3cfff78fba6497bc1fd2c2ad4be494e97254e898

SHA256
7e76a6b05ea7919a17c90591aa406e4f4835bb6478b5e43fc683c18f251ea96f

SHA512
dce7bb4dd739251168f697c58b9f96dd883adabc1d9a89b601c0d58c12d587f61f1d0a4215f66d3e6e6108778e4082f230043fb2d417cd4908754e58a0e1140a

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\GitLab.UI.exe

Filesize
35KB

MD5
c647366eef0dbf13980cd384f8e75363

SHA1
9d3269e05ce8bc9d8feeacdd70dbbaa4d9ad65dd

SHA256
a85e6a39274ad80848b5c3e2f9cdbc1cc1e333ab17178ff4fb8fcfee25e63399

SHA512
0225359ea981f8644378df95d564be5565ba17c1bb15f2f793c67c4c873bc6c4d1ecbc48d766738ecc177e94858cad82d144109d103b797bde6fb75a3927b7e9

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\gettext.exe

Filesize
120KB

MD5
6abfda33a745638ef71f233176e1be74

SHA1
29f3e4dd05f6d69d964270b2823429719b621fb5

SHA256
f8e52330576aa237ac9b9eacc74e800686803967500b732b6dc2a5fa962bc3b4

SHA512
17c34abf6c40bf32ad94ba69b00fc1b0b9922b9fef6d7ecf3e4aed670d08096d50beef74332b72ff1f0231df8783893b0af58b979cf997c471e20697379c80ba

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\git-credential-helper-selector.exe

Filesize
61KB

MD5
ec609f6eca19d272aeea18e4b708b3d0

SHA1
0febfec0f8c603c5845f11695670151d784f2063

SHA256
abc5b739fa08345d0b12d97acd8f28d03880d98280a229558b1a44e6d64c3ded

SHA512
99258e7120b43696b98444ecb11080035dfeb7ea654e8263f10481d191696d5153f3aff9f72787abd1df927693de181a660fe415bc8c7317e3717f28c06a8dc8

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\is-0OTFI.tmp

Filesize
65KB

MD5
04e5e2f8ad46008a4691874bfc4a7a5d

SHA1
94a08eee1b13612cc11b77ebf44ece901362df31

SHA256
fc199ee77bc8ab131cf21ba332fafcc8a7132e7006d69a6e4195d48962c87fa0

SHA512
5b5521a6f256d812f3c8d3c0a8d03210da6c490c5a1ed53743a02cc422b6c1fc1136698f5e41ba6aaee6b92a5d6e4a5b2306cd77e0b8a2e4f7ecbde72c5f0944

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\is-6ASUN.tmp

Filesize
229KB

MD5
f825cf140156703f5b0119dd32f13fe3

SHA1
927e207d484ffe3271f98e7a91d5d2250e690357

SHA256
95a65f1203e444c80fde62f10d3b6f24ff7ca2ab14a253cbdbccce1e2ac58462

SHA512
c96f77e13b8ef53a48cc6021b4408ba7d558589aaab1d39db617d5d9c93f28863df44e32f53d6d8bb800d32edab5564c305f59bb5e921eaa8a2307edc387d88b

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\is-MDATF.tmp

Filesize
85KB

MD5
fa5fb932217fc2e1a5829fe58a0e8695

SHA1
6cb315dd459ad9881ef1b85d65a73ad387ae60ea

SHA256
1e2ce91d2892fd17b6ad16065b1e391922cf4c34f645348b64f789dc0c9d269c

SHA512
8dd31c82b8bd714a0170180fdc104a45435b25c343fc90c2e5ebf05292284b1606d8d099876680ce777fc210c28bb4060d5973e1d17dc96471799eddddc10f1e

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\is-S7217.tmp

Filesize
77KB

MD5
b94ce9a4c4630bd89bc1755216eb3e9e

SHA1
e957f674ac78d27304a493ba9795dd2fa4056e32

SHA256
c924dcf0b11acf90f268ce5baf415dc25f07a680ce7691afe07a0a2f996a8dc3

SHA512
f924becc38ef2897a2035e5ce09b41e6b825a69f01fc96dabffa760ad33ef77a4651b5bed6565a3a785e1b50ddd777510802dbfb84be3cfee24edbd845b87d3c

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\kcpytkt.exe

Filesize
18KB

MD5
1c4d4d98a0b7b21d3913f7c2d27560db

SHA1
fbd028942ddf14c76e26b4a15800b8021b1beb22

SHA256
6d8ed39bdd1fd2f0e5b49e69d4d9176d5573088615d49e44d2857a9a9201c6c8

SHA512
79d1a260e52198a545deca78ce99bfdde2db3d456c5071dd23d4db531af70c0b055d3f9340af3a0f8bc18de4508d7e1e22b4be9e52190549e1c9bfb96c86f50c

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\kvno.exe

Filesize
22KB

MD5
b7e5d9a2dc7e37d13dcfa24e7c81c0f8

SHA1
f87bdda9ff570ff3d53cdfa3393b7a2d826b8dda

SHA256
b51eb89d1dfb794095e98fbf1b87373006a1bc6dda6fcebfc86402804c32f7c6

SHA512
1a6af325524513b176d1a34c653b438a4f284f9079e9841ebaa27b025217027ec669189ea81b7d80b15e2de18b628f255822ae105ff40b7355dc9c071be9384c

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\lzmainfo.exe

Filesize
28KB

MD5
013140a2b2d866eb5d5a6e0fbc53d0b0

SHA1
6318cb31e5a6326e32cc9bb65151d4721638d7c2

SHA256
5ab4c7bcfabf26e2d95a7fb57ddc0c7a60f53c7440a2fd04aafe400df19f2c23

SHA512
8a409bf77da19a3f8ae0a742ec8c8aefcdc8de1f382fb0886a5ba38bde217a0493c00b6a48077c6b0406d30f37565796b83b7f85aa99f01ac7ec5955ecedf267

Download Submit
C:\Users\Admin\AppData\Roaming\{28EE4D4C-2682-4F39-96E0-E35951F3C301}\x64\sexp-conv.exe

Filesize
62KB

MD5
28dfa4942f159d4078c8d59abfbb0d15

SHA1
1189807666fb4cbb131a54c4e73a16d536a84041

SHA256
49a56387ba47d53025b2e78cd957fc465e5a8fddfc771d776f87ec2ca455764c

SHA512
2703edd205d55d6ffcfed968d6e2f3fc91e111d626443180f295d139b3d3d82402ecb4973e23bc37c0f78078ab47d9bb5cbf133fe8030088e19fae87c64fe0ff

Download Submit
memory/664-1260-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/664-1148-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/664-1265-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/944-847-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1016-821-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-851-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1316-1133-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2360-965-0x00000000029F0000-0x0000000002A35000-memory.dmp

Filesize
276KB

Download
memory/2360-964-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/2360-973-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/2360-968-0x0000000002F40000-0x0000000002FA4000-memory.dmp

Filesize
400KB

Download
memory/2360-967-0x0000000000E00000-0x0000000000E03000-memory.dmp

Filesize
12KB

Download
memory/2416-1135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-1112-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3720-1224-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1230-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1229-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1233-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1234-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1235-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1232-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1231-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1225-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3720-1223-0x000001A68E530000-0x000001A68E531000-memory.dmp

Filesize
4KB

Download
memory/3724-844-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3724-963-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3724-875-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4584-1146-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4584-1192-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4584-1240-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4684-1267-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/4684-1270-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/4684-1271-0x0000000002DB0000-0x0000000002E14000-memory.dmp

Filesize
400KB

Download
memory/4844-597-0x00000197BB590000-0x00000197BB606000-memory.dmp

Filesize
472KB

Download
memory/4844-594-0x00000197BB4C0000-0x00000197BB504000-memory.dmp

Filesize
272KB

Download
memory/4844-572-0x00000197BAFF0000-0x00000197BB012000-memory.dmp

Filesize
136KB

Download
memory/4952-1241-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4952-1145-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4952-1076-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5188-1079-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5456-1129-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5456-1266-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5456-1147-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5648-876-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5648-945-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5648-961-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5860-1083-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5860-1051-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download