39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
146s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

License Terms/151/LocalDB/Binn/localdbxeventconfig.xml
Size

1KB
MD5

e880d4f5587eb5d0aaa1b3e9b6a67df1
SHA1

abdc8cdf87375d70b5c135930737c50021d2cf2c
SHA256

93185d3e7a527c760f2e9b98704b8c93ae7a7e30ad52dfb21f1e1ea5238be7e2
SHA512

e6a365b32a4294fc0b68b1a1e47af5a14e081e78eb3b5c1428477f596719ac46c957f514317d95a204ded340ec585126a8da5a8dede1fa02b2dc8e328e4c24ef

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1958028235\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1958028235\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1958028235\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\Part-RU	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "503802923"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175405"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013783821103"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437575798-4173230203-4015467660-1000\{07D473C2-8C77-482F-852A-1E161553DFF0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 5172	2920	MSOXMLED.EXE	78
PID 2920 wrote to memory of 5172	2920	MSOXMLED.EXE	78
PID 5172 wrote to memory of 1304	5172	iexplore.exe	81
PID 5172 wrote to memory of 1304	5172	iexplore.exe	81
PID 1304 wrote to memory of 4764	1304	msedge.exe	82
PID 1304 wrote to memory of 4764	1304	msedge.exe	82
PID 1304 wrote to memory of 2356	1304	msedge.exe	83
PID 1304 wrote to memory of 2356	1304	msedge.exe	83
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 3372	1304	msedge.exe	84
PID 1304 wrote to memory of 2984	1304	msedge.exe	85
PID 1304 wrote to memory of 2984	1304	msedge.exe	85
PID 1304 wrote to memory of 2984	1304	msedge.exe	85
PID 1304 wrote to memory of 2984	1304	msedge.exe	85
PID 1304 wrote to memory of 2984	1304	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\License Terms\151\LocalDB\Binn\localdbxeventconfig.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\License Terms\151\LocalDB\Binn\localdbxeventconfig.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/License%20Terms/151/LocalDB/Binn/localdbxeventconfig.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ff8b611f208,0x7ff8b611f214,0x7ff8b611f220
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2080,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2488,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5480,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6104,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5004,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6172,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5052,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5968,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5208,i,1406272288791980083,4460800352030517509,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
27d02a9170feb143c10bced3f0c7ad50

SHA1
0e807524dd428900bf3c6b91190740adb8e7e660

SHA256
f7b57a37dd1bf12371382fb12cd8f0ebb8cbc86323a10903d62014195e3142dc

SHA512
80723887c4cd5aa3847d68d3bbbfbaa29e1858ee08bfa2c51369c31e44eee1b627a2ae8cb1f2a5ce75a5a91d7ddfe4ce8f3dcc5da818e4f2dcbc2f746bbe9589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
cb2aa164ae4752be5142606fd529c4da

SHA1
8ae3896a17cb1e4faec385d8af3211f651fcc67c

SHA256
4e765c3573b92bb9d5150f347f173c83be5068c43979f74d587231a3303f0d37

SHA512
73345886bc19779523a3b9f54c64761a968d7a87687e01592b6bf4550d24f286e8e37666f9ef5755a01e58f7409a2aa5f2b1d4f9268c2276053b9e9999a0b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7f1090c9899e9d5349898983834fd275

SHA1
86f1692be8d8768ddd03a144dfb632ac609039ec

SHA256
f95eaecbfbd123c451198fcf607116bbc9748eab10c250e4cefe32a1f56ce317

SHA512
d8c9569938242f8bedfaa498fd6d55f503e270485102eb42916ae5ba636ae1a79e35ccc42a10eaede986805e362e3e41c4a45ddca480d460609a49f1d819f0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
a6b26d12e917b8a3db746a68bc02ca17

SHA1
0a4f67558af4ee4dd0e653d5de188bb2788b4494

SHA256
57272fbdaab2f2f07e174aceb9338efa5fe841f8cb5ec7e436290b9bb809de3c

SHA512
8b048e879e915f2ed8897c4f678943b9ba51a1fd1ed0d39c738291d728c5c69b7730aa9d17fd9ca8275b102747024d7af02c45a827550a0d58e6914922d44902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
b6b70e3731d69e4bb67a0074a2155b66

SHA1
0da44bd505ab701df29e0a668450ba273bc53304

SHA256
f12b16515b49c0704096e0ce9a1cdd1e10ae5ba2ae16c166ea9538820463fcf2

SHA512
3ed4e052446ad9aaf6e7280d9a60a3b63de35f0d66707c7f9ed91ca29490429383176a03e62bd2129bc4c60e00199c9ce62695d6e2c15e925d71c240bd0dbbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
7bd6a7808cb835294759d4bed322bfe4

SHA1
46b9a328da6e2be894d233a0054f51f205dfeaab

SHA256
e6a3785dc5cc62abadc91d455382b88ced218ac1bbe9c76260a481205a583bd7

SHA512
0e790fe99e0d1ed0bca0d9c32d659ca84d7ba2ac5da96e4093f6cf5932e5ee07a3945e19ca7bac484a722f86f6a55266942ef85a27c5a4c463dfdf2cb348bbb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\15f3b372-1420-4016-b735-28d6766d89a9.tmp

Filesize
467B

MD5
700e6c47068847226c0b39b15b4edecd

SHA1
754893ea36e7f28e7c64570daa576ba86699e097

SHA256
58fa277b698ccfb87d5e88e4cbb79f288ee88864d044695127661743c8c499e9

SHA512
6d67820bd257694fd05fee6a0b054bd8292f6969b127382cad3f682522ce996ab08e724f22bb21126ec81a5ea5ca04e220d100aacf012151d2c35ccaf6141554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
468e4ff809db63834d0dd83dac3971ad

SHA1
07e74a8435cea90ddce4dca952133ae9680c3570

SHA256
ca5850055f5d65b176423b0baf9f192f338bd3c821acdeb62a4626f59aa51edb

SHA512
acb8109cbda81adcabe5d3cc0a23c5dd00794cbdd4286966acf0bcb0c79b4131add4921b507360871735cef09b0297a618065ae101be6408ba1b3ff1686ee9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
769a75beda10de8337273d36a4a56667

SHA1
a8b42e0daa615e00459dd8e7ec655ff1441f793c

SHA256
087f1fae518bc14d49c00a96d744e277b5063a5c1c7aa4332606249f896e556d

SHA512
5599bdf45a96867fed239fca4db2813349e50d800883b4ad0db2ed0d164ee81fb74cb940f43e9dea7abc71a1657258b3cdf739e086fab80d98b8c59f0d3f6ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
7fd541c5a812614399487a6748558b83

SHA1
61f6da43502adaff936e5e4124093574f1f8757a

SHA256
712428f12689dadadd0c921c3d08f5f5018439872d40437e54b2ed02a7cf0761

SHA512
0593d20b2e665110aba488b5278bc77bb3d9145e33cee085c802c5ab3243ae8e8a57a092175945393a690098bc640236b0607c3e6122b544daabaa05918a0a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c180308d67778c87f9ae699077066144

SHA1
939c733d3fa0622a4c8b96e71d22608efad1499f

SHA256
2b9507064010f60784d100a24f7225b66dd5a76e8a95c5fc486bbf5b003c955c

SHA512
4d0e978d09d3fdb958d321bde922dad4da1684fe8ca793aa5afadeb3c430a1e3c56460f2636165021632647d52c96f64bb7fbc72a1234f60c7e97a85541bff1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
a08da8b39b16e38ab8ee2f53b62ef2f8

SHA1
a6c9b3e24e3e2a84c92c86975e0021b690c3647c

SHA256
b73c5184536c7f5d7ba7b975c8b742994c988f8659fc76977f410be7a8d3d58b

SHA512
ddb22c09b009d25b8b810446506b511314ea741281baab34b204e287544dd6850921682da50d054e3d178ced12f60a29da22fae176b838c60dd61a5204b7e2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
1d06fa8891e4839dba5f28d9b895bb72

SHA1
b388750b311106f8daa46e43caeeaeb37b5e1eea

SHA256
c37e2ebf2a5f90a20b25f06178c972ea9feeb35b78061d36707654739aeba4a4

SHA512
6c06540469de408d3b1bf5edfb4b1c4900233a520a028dd4015b40df91b52ca0557daf801cb4e530fcebf60fb26cd7fcc1ccf8a18df32a91ee13a684b1b5636f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1250665725\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_173725407\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1958028235\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_526344289\manifest.json

Filesize
116B

MD5
d20acf8558cf23f01769cf4aa61237e0

SHA1
c4b21384309b0ff177d9cd3aa4198ab327eb2993

SHA256
3493b321a7fc5e183ed6f223ae55ce962541717d0b332d16bdc7cbcadf7e6f78

SHA512
73d082cbd71f6d0f06c7afc1bf63ee41c9a8e501df3e56f21a551b2d369a0afc8306894c8e0a38d0324e2ac403ec506ac1ecd8e9b61a9cb27134a229ccb13725

Download Submit
memory/2920-14-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-2-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-6-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-5-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-7-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-10-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-4-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-1-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-12-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-0-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-9-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-13-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-8-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-16-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-20-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-17-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-19-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-3-0x00007FF8C9743000-0x00007FF8C9744000-memory.dmp

Filesize
4KB

Download
memory/2920-18-0x00007FF889730000-0x00007FF889740000-memory.dmp

Filesize
64KB

Download
memory/2920-15-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download
memory/2920-11-0x00007FF8C96A0000-0x00007FF8C98A9000-memory.dmp

Filesize
2.0MB

Download