69c929901f7ed794f5f0f953619a6c43c0987f6ef0e9f0197a9da13d57f38deb

Analysis

max time kernel
148s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ai client/ai client/.gradle/loom-cache/remapped_mods/net_fabricmc_yarn_1_21_1_21_build_9_v2/net/fabr.xml
Size 463B
Sample260503-dfwx1set7n
SHA256 69c929901f7ed794f5f0f953619a6c43c0987f6ef0e9f0197a9da13d57f38deb
MD5 47fda2725a39b149f8bbc1ee55d4ba2f
SHA1 93d284434bfa99186749a897d0b25a68cd7e7bcf
SHA512 3b83ef233f55054278af0592fe2352472e55fd6212dc19d8cdb40443b3e9b34e607a81d68801e6e3042ba1b8aa4dfdd9d88516b564969ce26bf4ea41ff98124c
TLSH
T148F0DCD0D2FC8061419A8FA6DAB3D62DE33104BEA2E483E4D0C84C97564A4CE2142187
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1060_1496684942\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2548253250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222507267335677"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{55EA7396-B0A4-4F69-8323-D5B2F6F229B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4948	3408	MSOXMLED.EXE	79
PID 4948 wrote to memory of 1060	4948	iexplore.exe	80
PID 1060 wrote to memory of 5700	1060	msedge.exe	81
PID 1060 wrote to memory of 3112	1060	msedge.exe	82
PID 1060 wrote to memory of 2308	1060	msedge.exe	83
PID 1060 wrote to memory of 2308	1060	msedge.exe	83
PID 1060 wrote to memory of 2308	1060	msedge.exe	83
PID 1060 wrote to memory of 1908	1060	msedge.exe	85
PID 1060 wrote to memory of 1908	1060	msedge.exe	85
PID 1060 wrote to memory of 1720	1060	msedge.exe	87
PID 1060 wrote to memory of 4296	1060	msedge.exe	86
PID 1060 wrote to memory of 1720	1060	msedge.exe	87
PID 1060 wrote to memory of 1720	1060	msedge.exe	87
PID 1060 wrote to memory of 4296	1060	msedge.exe	86
PID 1060 wrote to memory of 4296	1060	msedge.exe	86
PID 1060 wrote to memory of 6132	1060	msedge.exe	89
PID 1060 wrote to memory of 1668	1060	msedge.exe	90
PID 1060 wrote to memory of 6132	1060	msedge.exe	89
PID 1060 wrote to memory of 1668	1060	msedge.exe	90
PID 1060 wrote to memory of 3396	1060	msedge.exe	92
PID 1060 wrote to memory of 4348	1060	msedge.exe	93
PID 3396 wrote to memory of 5852	3396	msedge.exe	94
PID 1060 wrote to memory of 2424	1060	msedge.exe	97
PID 1060 wrote to memory of 3676	1060	msedge.exe	98
PID 1060 wrote to memory of 440	1060	msedge.exe	99
PID 1060 wrote to memory of 5984	1060	msedge.exe	100
PID 1060 wrote to memory of 5984	1060	msedge.exe	100
PID 1060 wrote to memory of 2592	1060	msedge.exe	101
PID 1060 wrote to memory of 2592	1060	msedge.exe	101
PID 1060 wrote to memory of 3412	1060	msedge.exe	103
PID 1060 wrote to memory of 3412	1060	msedge.exe	103
PID 1060 wrote to memory of 3768	1060	msedge.exe	104

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ai client\ai client\.gradle\loom-cache\remapped_mods\net_fabricmc_yarn_1_21_1_21_build_9_v2\net\fabr.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ai client\ai client\.gradle\loom-cache\remapped_mods\net_fabricmc_yarn_1_21_1_21_build_9_v2\net\fabr.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/ai%20client/ai%20client/.gradle/loom-cache/remapped_mods/net_fabricmc_yarn_1_21_1_21_build_9_v2/net/fabr.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fffab06c188,0x7fffab06c194,0x7fffab06c1a0
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8899398734911728403,12019752383312381219,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      System Time Discovery
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11304751226744207459,13025378438640729317,262144 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14893362819722102862,11190622767370866127,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11007873412390130084,10599104477600447012,2097152 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,398813804601147923,17092583549558654815,2097152 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,11796350216379226067,3480589205817200770,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,2268447395739406571,14491010014564394786,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17124329238478283087,17472886598408557685,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,8465173083140041203,14335669121305265611,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17124329238478283087,17472886598408557685,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15272071635971457004,7218314116237521779,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13355909740505915468,8334576459237784404,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9934887003173255972,13841582244192491529,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1729354525075767737,5541478845074559922,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,2056292045665570396,15124112063616785305,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11813592168912718643,3134494089141812122,524288 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5884,i,11963480983210826961,1670681357474171048,262144 --field-trial-handle=2148,i,3575117736295517640,14637826059455000365,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:10
      4⤵
      PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5380b1f0-7ed3-4ea5-b459-a6ea6160f8d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5380b1f0-7ed3-4ea5-b459-a6ea6160f8d1.tmp
Size 27KB
SHA256 608eccc03f759b4e66ee986fafeed7aad50f401fb9ec54b9835233285d439ecd
MD5 4f326e64dc1b01fba92358a092fa1988
SHA1 b37b96249d1002259fe53bacf54f89115f7be0d5
SHA512 d03737335a1b2f413b4f8d582fe631b97b66418a4df8ce8a640062c717f1774bafcf03a4b35c730c36b2521d76b99b6ab0c16561a53af9094ff2a94a430b119c
SSDEEP 384:nnniFHcXqnG38NC8TUNTUlIR+gPSY5s6qVFfLYpuv1ZTagPVjFzqFvvuVOUrN1kZ:iFfG3FwgXt4YpM1sG7zqVuVHa
TLSH
T14FD24C32E864CDABADEA4FC5A75A7683AEE011A3C98C5ED4D6C85D4C00C71DD270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60d46d58f43ae79ee6eb16eed13439dee4e50e5b08b9870403c51ead1b5c7931
MD5 594727a4c8ad0841029e6b0f3c90b74b
SHA1 6e256849c24e6a03cf87d157b5dffd4667278a95
SHA512 04e6e9b5b5d4b13950bc65fd2ceb29904d13895e1ff39e8f025c676d31db5648309bce3a20b3e3613765269ff693b385e262bc77686a04c5ea38ce6fce062d6e
TLSH
T1BFE02BAACC25DD3708FD075D25440746F65113671B40691B3A3CA21C8F71A7E85D581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d68ac1c7cfe5b0bf17f8aee77281a19b686b9ef190bcd346c950ddd23b4ec83
MD5 fb2e81a7daa83cd87011ba25a499af15
SHA1 a5f408508a2dcd6ef2f2a742df502f11f73252a6
SHA512 1074730043dd10a8a602d82e54bcdb6673a1b372771122b99bc154e36beba80d863e7979c6f41dfd242eb154c651d611dcb81481cbd4cf5bdca5e7955c4280aa
TLSH
T13D41CCF7C3E8856D8A0196F4AA187E2FCE1D0950436C3D5AC8E4AF5B93E2471E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 363ac483cd79922ab475ef7276814cd59260a37163343afabd2daf375668f8ce
MD5 b86580a96d61e74f68b51189c912458e
SHA1 5968d1988afccf603de1e5887554308b25207e24
SHA512 0d16ff65d57d33ab3142d92bc81a9babe73fa087bd8ed528b9dea4554be5d6ff929a7797afdaab49ac0c0249e7589c4fdc3739eeeb3bc14aad59b6c88ca9bb87
SSDEEP 192:sxZkRWyMqZ/K1Ml8UQCc0/f+ssQdsBAkTP6ZJzodpE7/W6+WNGY0r3nTirbIg5kC:sxZkjqx0/f+ssQWBAkTvy/bG5nivCi
TLSH
T1BE72E9156A349A7B8CDBD219FA45BF53D6F91462D1800E449AFCCB0C00E7AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 01d431e0e5b0789fdbd271710340b337b054e504f68348f718bd262959f5caa0
MD5 3771f9aba955be046eec317386c72040
SHA1 3824b3f59a9b7640765f0bef11ad2d5c37b49358
SHA512 c5b879001b5a5f6598f2cb4bd9de0960c38c73c5752dd0c9e6bce9f4ee0897a6083c585a7e6b9218bd97c388de0502a1dbcc02dfa9f177c46eedbaa355282c73
SSDEEP 192:sxZkRWyMqZ/K1Ml8Mc0/f+slPpdsBAkTP6ZJzodpE7/W6+WNGY0rDKQirbIgjiDJ:sxZkj00/f+slhWBAkTvy/bG5Rivj0
TLSH
T1D062E9156A349A7B8CDBD219FA45BF53D7F91162D1804D44AAFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b47202c3e8b6ba0834e66a6c17629a4131cc0cbb3c33a8a9813ea9270557487b
MD5 6747260cc2ede0ac1b058ecdf9a3c0e1
SHA1 3516775757b3554687ea61f3053831dc169a68f5
SHA512 40908679fb3ff081193796c06ab54002fa489a83b5ea46db57061d36b6ef52385328cba940c38b5e0514a1640e480e865f4d81f13731f7d6674357cb9b14e15f
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EU3SLl4:kA4so86s2+CE/HzWRmH9QYRu1jaKEU3l
TLSH
T16F031D3B684CCB7F4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 36c27d5d9e455dcff0adc1737f97c087e1ffbcd579f513a25ab2a79a8e91dad0
MD5 d5290e754d7f13d6184c59efeda4f86b
SHA1 a4834581bab157172f94301dfbbeeb0666cd95a0
SHA512 9d62f505744dd370fb5d0a11ed9ea9f616c8ccbc02bda6f1f5e06c91a0e91f33dc1719873d71a8341b1ea5d24338539e1ec4d9d1a408cef6ba10858990c87437
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSV:ubB91NPhfYXHkvl7X3S9r4dFf/XH
TLSH
T117B23991797A02903A7E259E8595B83E52C231637118E46B3BF900B64F6BE31CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 912d54f579b6bfc2dff86538ae47b51c40cfa7d7fd61e4acc66107dbd7914f5c
MD5 631a5485bade8309367e9573b21213e4
SHA1 8e097cb819bb1b00cc7d2054910b3175dcc244d0
SHA512 2fa05a76f9405179ed87be52cd1406b8c6a4a6b7e88598d7c5dd89964bea0732c301b306b9ed023ec50a1a97715e07a5e768448aa6f126f26593b331d7edb678
SSDEEP 384:nK4iFavqMg38N/8TUNTUlIxBgPSY5oQtOVFfLYpuv1ZTag/YRYV/Vw1mRNCe02r+:aFayv3cwgGBtEYpM1sIYRYk1mj/0a+
TLSH
T1E4C24B32EC55DEBBEDEA4FD9A709B602EEE00267D99C4AD4DAD81D0D00D719D270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0ae36eced6a5663e8ee0345b0a1663fc4bca5b76b77157c9f103a4665eea9d9d
MD5 58e9fd0baa974619b6ba9f207478efdb
SHA1 06b3c922d7461576d22aa9b27fc425d489080214
SHA512 c95a30a37510e5dd75032eab2a588fa8623c9a09f0b4dd4a47641ba81bcbd505fa55a680512ce826818ac0c1d60382cd5c8ddd0786d5f32781e17d9a7ade412d
SSDEEP 384:nX4iFavqMg38Nu8TUNTUlIxBgPSY5zerVFfLYpuv1ZTagPVjlzRYV/Vw1mRNCe0t:zFayv3VwgGIXYpM1sGLzRYk1mj/0a+
TLSH
T12BC26D32E855CEABEDEB8FD5E70A7642EEE012A3D98C8AD4D6D44D0D00D719D270BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7807cc1b18a1112c73353a1c1aaaf81f00769aa35f0d1e35ad93ec0840588654
MD5 d580117bb013c001c41fc373fbc3fc15
SHA1 ad9270a471ee012d46f9859ad4142042044b9275
SHA512 e9d67ad4ca3aa0022d8a04c3ed3ec80c611b48385eaa80e2f2e4d0667afd6f4d79914a797b612c98ed7e7187a36861270a522523178fa2646ad4bfc16110593c
SSDEEP 384:nP4iFrcXqn/38NC8TUNTUlIRigPSY506qVFfLYpuv1ZTagPVjlzqFvvuVOUrN1kZ:bFz/3FwgXh4YpM1sGLzqVuVHa
TLSH
T161C24C32D864CDABADEA4FC5E75A7683AEE012A3C98C5ED4D6C85D4C00C71DD274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9f02201b4d843d429bda141cdb696fe6e97790b7d00b159fb4b2e4e9d639b069
MD5 215eae27d23139d5527cdb5a4da9da1f
SHA1 e2d0d29a67a13fcd077686f4085180d900a3cad5
SHA512 d95ea3d3e46c2fbb4d7d0147d5fcba4a3aab96a0fbc1563325363c75bea50eb9e289774038573ce9c06d55fe77c6c74db9b595166f085194f59dcbcd9cc40bb8
SSDEEP 384:nn4iFHcXqnd38NC8TUNTUlIR+gPSY5s6qVFfLYpuv1ZTagPVjazqFvvuVOUrN1kZ:DFfd3FwgXt4YpM1sGAzqVuVHa
TLSH
T1F2D24C32D864CDABADEA4FC5A75A7683AFE011A3C98C5ED4D6C85D4C00C71DD274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b1ec49c62d6adbd0f7de55fa7ffd471f508c1d02421c260fd293bc1ac7671f76
MD5 b529ea835df4140e06bca61941c55cb6
SHA1 caaa7b6540da54f1a872f3c5335b86fb75366cf2
SHA512 6918b5270b775b3e14885be433565b996dc296e79b95efbb78beaf306455ebb7b1ef1345ef2a09273b36519b0b9aa501a71926c75f6b592915442ed61519bf98
TLSH
T1335163D18C7D5AD1D4BD0A7EB09B78FC84DCC626F4A4347D2868E9980A7EA1D604143F
MD5 SHA1 SHA512 TLSH

Submit Download

ef0e5475-5027-48b9-bb59-a89cb53c71b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef0e5475-5027-48b9-bb59-a89cb53c71b8.tmp
Size 27KB
SHA256 6e26cb32d198e8d5da101ac103677588769c2dce73eca2fcec3fc75a1907b848
MD5 166bd87ced515ca114c4a63908edb478
SHA1 e1fae099ce6ff3f0c71aa0d82d4c633201c4b845
SHA512 4d6af4977d34f2411a96e2f51951927ce549834a96b5a936369027a3ef7435de5cca04117e54461cea09f974cf227b1cedfafe9068a3d0a1ce88de4066f77d41
SSDEEP 384:nP4iFHcXqnd38NC8TUNTUlIR+gPSY5s6qVFfLYpuv1ZTagPVjazqFvvuVOUrN1kZ:bFfd3FwgXt4YpM1sGAzqVuVHa
TLSH
T150D24C32D864CDABADEA4FC5A75A7683AFE012A3C98C5ED4D6C85D4C00C71DD274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3408-10-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-9-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-2-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-0-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-11-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-6-0x00007FFFBAD60000-0x00007FFFBAF69000-memory.dmp

Download

memory/3408-8-0x00007FFFBAD60000-0x00007FFFBAF69000-memory.dmp

Download

memory/3408-13-0x00007FFFBAD60000-0x00007FFFBAF69000-memory.dmp

Download

memory/3408-1-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-4-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-3-0x00007FFFBAE04000-0x00007FFFBAE05000-memory.dmp

Download

memory/3408-5-0x00007FFFBAD60000-0x00007FFFBAF69000-memory.dmp

Download

memory/3408-12-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

memory/3408-7-0x00007FFF7ADF0000-0x00007FFF7AE00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads