hxxps://nexorahacks[.]com/

Analysis

max time kernel
247s
max time network
251s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2025, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nexorahacks.com/

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4796 created 3336	4796	Nexora.exe	53

Executes dropped EXE 1 IoCs

pid	Process
4796	Nexora.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 5920	4796	Nexora.exe	134

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_743872708\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_743872708\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1323333687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1323333687\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1323333687\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_82560781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1209087937\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_743872708\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_82560781\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_82560781\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1323333687\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1209087937\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nexora.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133882094241831128"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-994669834-3080981395-1291080877-1000\{34D60315-92A2-4F74-937B-65F7538CACCC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nexora.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4796	Nexora.exe
4796	Nexora.exe
4796	Nexora.exe
4796	Nexora.exe
5920	AppLaunch.exe
5920	AppLaunch.exe
5920	AppLaunch.exe
5920	AppLaunch.exe
5872	msedge.exe
5872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3536	7zG.exe
Token: 35	3536	7zG.exe
Token: SeSecurityPrivilege	3536	7zG.exe
Token: SeSecurityPrivilege	3536	7zG.exe
Token: SeDebugPrivilege	4796	Nexora.exe
Token: SeDebugPrivilege	4796	Nexora.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 576	1720	msedge.exe	80
PID 1720 wrote to memory of 576	1720	msedge.exe	80
PID 1720 wrote to memory of 3544	1720	msedge.exe	81
PID 1720 wrote to memory of 3544	1720	msedge.exe	81
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 3360	1720	msedge.exe	82
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83
PID 1720 wrote to memory of 2848	1720	msedge.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://nexorahacks.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2bc,0x7ff8c4d2f208,0x7ff8c4d2f214,0x7ff8c4d2f220
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2076,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2468,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4128,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4156,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4180,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4116,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3536,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5348,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6056,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
    3⤵
    PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6272,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6816,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6568,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=6796,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    - NTFS ADS
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6840,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6164,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3652,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6932,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3772,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7196,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2012,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,12235535589049850388,13102567792561468657,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:4256
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17114:74:7zEvent18612
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Users\Admin\Downloads\Nexora\Nexora.exe
  "C:\Users\Admin\Downloads\Nexora\Nexora.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
02cf1313b32a8ab2f031cee39bee8fc3

SHA1
861cc0ab9ff881460dd6433e37075b822aac9355

SHA256
7e7fd13903a8d57f314d9e7dab6fa28975050b63f045eb315e96cccaa17d1e61

SHA512
f5464c94391bfb590f6755c2ae6896dd459a2a93d778601caebf272438c2ff127ec5de81dcf8efeec65a56609558477afc7be1c4993977a18fde7b915f7a8700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
90a49282b1fa7ad1bd97e2679b9859ca

SHA1
07b79daf5f6dcf5a642d9e685c021fb5aa4f6aeb

SHA256
1999ca52a19a1852f2cab48bca06d7ab3836ced8b5afa1397c59ffffc8e27638

SHA512
9ef205b51cb3ceb78c51ee83c6001fcf65f1dc7905570e19d93b1a3619478be3d7ab33b9e3813928b6e969bf50c29ba0f1bbf18253442f150c4b9bc98d9f4935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5810f3.TMP

Filesize
2KB

MD5
b63546abae91c2010f3595672bc26b18

SHA1
9ba9422031287d88baa4e2bda776ec96ffce8df8

SHA256
3494046b7a45b991b9b477fabb9b053a0c6767b9f8c76c00816d704df9c1a17d

SHA512
05aa58c3b4198d4a7bc2c8f9187df48b22bd352f528da0c5f1488824721e126062c45ac7e58518a53fdf5a25cd01713439b397e7ea3a96aadca6d8f15612805c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
b0c062db35f1a9447a02cdabe0f1ec23

SHA1
58c0939585ea85775b6a67167905ddb3c061fee0

SHA256
dbcfe6777297e15fed64fdb785f8fbc5621837d81086af31f7b7350bc1a16cbe

SHA512
a6d5869443206324a8458516cc1ecbb171d4b9cb6bf99363eba87bfc63bc494fa36a5375872c577fd67afb9f5ccbe5a028866b4a8c6108ad324084e138311489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
e2fe09cf571342e3bd41a2aff2b8f6a7

SHA1
b9cd654050965120e4a7813d0a3f176d721aea63

SHA256
384efa83aba7aa726353228ca54551d93e5bd1d879d4c74b6572724021d53363

SHA512
823ba83fd8d03eb9897185f7e658266925eb0d69f09ac1335e66e4de960904b1fb48a42f18b486b7249c64987f21d44fbcfc9a7f0e5aed281fb3ee86e8319883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
fdcfa65fc70702aad9dd61a3b4d0d85d

SHA1
7a98024ef3f504562e45fa7eabdff5e415d5c25d

SHA256
d6075e8790efa87f4c0ba80cd3dd04edadcd74ffd55420cd5502ab3bcb2be053

SHA512
9e870d930f1a0ce36844bb38e5fd97fef3b4501fc64a13d48d5e9d7511df10be1e7760787a1fbeb5ee240669a74097d190e8a70b3c39a21f9e54c2d6ef3facdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
52ea2b4a3c643835d31690ed177d9b72

SHA1
7e743ae57d15c4f80bbcf00d8a22130ad8e54493

SHA256
1ef969feaa787c951fe5e8bf3f5d0e7c26894b077a8a908d4b2744f67a4cc4b2

SHA512
0b8261fa989d96f758bc2de728438748cfd7e94fa00efd20b52c683d678ca9f47250ed244a5cc5217c4b6bae136de328a4fbfb292e29ce268fd890a1c491a222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
9a3b99122927ce0f1157c507c993f703

SHA1
c2f0a10661ef749a2f30e6bab7a6823ad7fbd82a

SHA256
dbfb98c591d1bc0bea18e18ef520c1b12498fffd80f58db41142f950abec68df

SHA512
7f173f3cc1aac1e718158e5700bfeb4afc550c6e3bca15ae6fccedf3c012d269837df8e2705c26506d557926e7e41dcb96a79941690faf73d6cf792f7bcdab31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
29331fdce0c84c169f6a0f0606c8c6c6

SHA1
ab03864ec9952959146dec6cf2cb34297f8df35f

SHA256
782d1909620844d0b8457f9ea062690c31eb04285fc6bcc22e7145f264137434

SHA512
aff736bbfc4c36a80e0df90c27c47638bf58bad2eb749b9764001597173054088eac7b82e6e9913375a80b578c89787c0e02a7ea4f6e40345948dae614679a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
1KB

MD5
2f125050b1e78726c9f2fb7bb4b99014

SHA1
d019af864f3b216d93296abd89d81100a9a91662

SHA256
a3170a08c66dd83000ee55b97d9c14d9f205fdc696b422bb9636a060e1940bbb

SHA512
620598eb40f76685597826bea60152649b2b12ba5e88c37656f6c254dd898f4018d76c52ce49a0635ba6a3b1775e74817f1b381c58bbaaeb22629d9317f43ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
81B

MD5
e9e4b6d3a0262aa38894086e3b0513ce

SHA1
033b1271d22f0a6d8b2e8aed9e1e567141d45851

SHA256
1bab328e448e51b6a70cad2103b9d0375d57b9c975788f3d5ed00cfbdb31da05

SHA512
18cadc47d9644e6493e478d41ebca7e3333d140f5db173de77374aed583966de8ad3e3e7a61ec6a338fdb9fa25e7cb48ca608eef3abeccbecd9986c24006f242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57c0b0.TMP

Filesize
145B

MD5
2fd63d2b5059b5d17a1da40e9b4de878

SHA1
c51a62a74140f7d1953386e82c1ee410830aad3b

SHA256
30b93dd3159f466f8948cfc6c7b7ef6798a6c69c0a28342b6865a34342ed816e

SHA512
04fc7f27d42823ffb0a966f23e37d52c976db1decb1d3ea0b038de6345ade4daee436d769876dcdbb169f08487f662f97db68caf3f874235912b1156c375c127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c413de7a-c768-42ba-b2b0-175b118db919.tmp

Filesize
15KB

MD5
28ed89619e4f2af09657fb05ac107e11

SHA1
e2fe409dccb89e871f7d19882657470e14baea82

SHA256
ec2a33a93e2db6d7fc575a03a5cb7b14dd7ac6fab03d4ff30b27f75c265631c4

SHA512
8e81a10ed8d04427d3e68f094c42a30b20c93a84e3e831b6669484cf5133f40f4a093d065dc832872c583cb2d8a6b311c53795cd124a8b3bdc43adf1e8fc8c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
866B

MD5
dfad3526019695b7e8132147f4082c24

SHA1
c3ac7c11ca48c7c53f6da047d140829adcbcf4da

SHA256
d7b186d586052a3dfd6389c3fca46c643a018becbb23e616020c8e7205692ede

SHA512
a5d4aea27f5367995d8362fe8da4c6f72d813b9695a9f3b68061f01f5499b390ecf2d5f7d38f7013a4cf5d1e43176948a87333f551761ae7612bfadc366e6877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
d2efe2fd5ca567a68a407a6a76bd558f

SHA1
0f2108adba55f53a943a80f1d698f096ccc6ea61

SHA256
a4cb2d4d9daf158e2542cd0c0129071dc4bf97a811e2127a419d786fa6021426

SHA512
48dcc83ca660ae10c6289ca594dfb1ba942bebc1657ede09a4a1a6891f32722b6a1e146202453bd12ed13a3c2fb254484abef2a013cdff52caa126c2660547b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe588d28.TMP

Filesize
461B

MD5
003d54e8e93b9bfb7fa21c7eb22f4486

SHA1
5e8edae7d3993266ec3da102920f0f10a2e5eee3

SHA256
7062168e40665623054a7fb5755fe52834eb245ef22525f415a22dd27f67084b

SHA512
c11d17076a4016d690fddc7525f639743e09d81b91414e36296837416c3a37d439115a9e23b87158a2b18fe14c92feb51a5c3a5c77a7e46ea54ea01016190321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58918d.TMP

Filesize
3KB

MD5
47430e0e9ad4838b6b88191b7966810f

SHA1
8933b4ce19e396751f93687305d3d378c48e2e0f

SHA256
98c1f419b9efe0d2a9f4350442d90916bd07593d9ecde4706030d1502cfb90d2

SHA512
e3a4e44240a11ce2173acfe66f6b52bdae8fc9c97dfdca441700ab47b5c73a46b71405da95a2cc08c34507fddf4349923c33da57da244e45b5019b9898e6b65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
2b10e15ca675a54b23a4e2727566cd0f

SHA1
7e003ce24cee764ccf497f893625f9a4645fad4a

SHA256
ace182b2dfa17622aa70e9a8affe41b751508f70abef1277d2fd2c335cd195a6

SHA512
3802827a7e6a2b2b5b8cc8a9e56907388438e5a8e5af1ddc9555b0faa0631bc688a86ec934d8b6358cd3c977be1bba926f95ea06ead6e3870cfe10b0aa7b5c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
6dc660e8d20b7a9bde57d1161bdcac39

SHA1
83c377a80a6e3988f88b1e6fdc2274855f12e399

SHA256
154071da7e37af6eceeeabbad0cb069e3abb2bebf28cd734a44d75ed71313c17

SHA512
fec3a4bbdea33500a9aee252e7d9fb939533138d2546f48419f3ac819dcc46c2ed413df8b70ca1edb025a40ee80802e8336adceb6afb0ca4463f6245e646a667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
b433e8ff9009a9022edcd299570d3a07

SHA1
3c07d8675befb0508760549f854b01a22f76d645

SHA256
0638618246a9c0c1b48771c7d367743672e44556e7349b71c63a96b001b2dc34

SHA512
b7d9d2afa2c5b622c1ec9d5c6ae735c7a5cfeba5e1367a4e9cdc24d2745d876dffdee3a223a848a293c6fdf6449f950927a29e69b88ec4c2723fcd686c861255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
66d603d73db44c96da32b75485bb11b7

SHA1
0305d1273db44f3c21fc57889090452f59b0aae4

SHA256
42469f21d012e58d2155cb3b0158d28c81eaa6c0efe5d77c667ecffa096d5ce0

SHA512
1a149bf29e77e61e6d23e17d4e6112c2665aeef19c0bc263c43702534a7059fc61a128b4979b549a2c2fb9d5608efeffbfb6568cc394e5e8362eeed6ebd4a111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
9a88e3f1300e12c9987beccababc2e93

SHA1
c95c9d742fde154845ad16bfdc95386f0ab6a631

SHA256
e15cc612e7f242b31353f606662dea209a46513266a15411199e67bf53bce1ee

SHA512
3a30b8c7abf03d9e49cf0bebe0ac2f7bb7a031b2a6fc8a7b64d3509943fcee2a79356d0c0355feb057c52549936f27e36d538fdd7449b48cff3d008d7e57ad8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
29fd923852c52ebf2b484de12202cdc3

SHA1
0414098e930060d8193bf50ddca0b777321e9ca6

SHA256
9a30e12dcfc52df34da62556a89add1e607353e609c303a55e9e7cb1fe950635

SHA512
6d6bbcb32bd34ab9dc7b83a51eb114dfa254fc8560148e5a330807262ff1582649e36025cb72ac89611153b5602fc40dfb4d0f640d1d3d01b1d16c4517cdf158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
6d6a6936c11cb2ccf72e45b503236df5

SHA1
dbbf79e4efd4f544e39fa632fb0b41f54cf1fc41

SHA256
e65257bbed21e0312492f91f80e2bfd9be4533d9876c6ab718d144d0c6b20e67

SHA512
30958e91863882fb53a40279f77bb38274f5dcd1fb28684b3f63641e31a0ee88deed0b9a5aee525063e905fa3306760697a527372e00093af193252c88e663b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57e8e9.TMP

Filesize
392B

MD5
c69aaeccbeb0a8d5b0d8adf83134c27b

SHA1
b5322520a6a486b9173149f3122bf9cf1f50fbe6

SHA256
751df4464e1afaa338b05616175ae678cc8e386c8a0e28aa00ea58f2c713361b

SHA512
2ed4deebc64514da711bd446b26218f66723695e38e6a88cb8d1641937aca4860c8f4b059891841e7396c3e7db8c358e2fff1d921715b69363ca2ad18e87ce35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b4aefd3-ee8c-4e2a-88a1-b7f94b7c3494.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\c02569d9-aa30-41b2-b629-c94b78d5cf57.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1720_86275767\315125c4-ce29-4441-af6c-c71ba2bd7bab.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\Nexora.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Nexora\Nexora.exe

Filesize
4.4MB

MD5
dcb3efaf77e63ee24a7dd19d0bb7c966

SHA1
dc1324fdf52f6013d3acd8d6a2f7695d392b1ac8

SHA256
9717d2d8713016e8ae615994e05d9d53d0a348334c39b9b4d6a7b44e21adf06a

SHA512
da7967ea3a9504b99004494ae053c4d0bf096ac4ff458c62e2a896647b3cd2ac4ed4cfb9a4497abda19803f022b336b1dc0fceba188c71420469a11d46261e45

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1209087937\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_1323333687\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_2125771338\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_276959513\manifest.json

Filesize
135B

MD5
4055ba4ebd5546fb6306d6a3151a236a

SHA1
609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

SHA256
cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

SHA512
58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_336979529\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1720_743872708\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
memory/4796-831-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-867-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-865-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-861-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-860-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-857-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-856-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-853-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-851-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-849-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-845-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-843-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-841-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-839-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-837-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-835-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-863-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-829-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-827-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-825-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-819-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-817-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-815-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-821-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-813-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-811-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-810-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-2155-0x00000000064E0000-0x0000000006568000-memory.dmp

Filesize
544KB

Download
memory/4796-2156-0x0000000006590000-0x0000000006614000-memory.dmp

Filesize
528KB

Download
memory/4796-2157-0x0000000006620000-0x000000000666C000-memory.dmp

Filesize
304KB

Download
memory/4796-2158-0x00000000067E0000-0x0000000006834000-memory.dmp

Filesize
336KB

Download
memory/4796-869-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-871-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-847-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-823-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-833-0x00000000061D0000-0x00000000062F9000-memory.dmp

Filesize
1.2MB

Download
memory/4796-801-0x0000000006440000-0x00000000064D2000-memory.dmp

Filesize
584KB

Download
memory/4796-790-0x00000000068F0000-0x0000000006E96000-memory.dmp

Filesize
5.6MB

Download
memory/4796-788-0x00000000061D0000-0x0000000006300000-memory.dmp

Filesize
1.2MB

Download
memory/4796-787-0x0000000005F60000-0x000000000608E000-memory.dmp

Filesize
1.2MB

Download
memory/4796-786-0x0000000005960000-0x0000000005AD6000-memory.dmp

Filesize
1.5MB

Download
memory/4796-785-0x0000000002960000-0x0000000002AD9000-memory.dmp

Filesize
1.5MB

Download