07052026_1500_07052026_HSBC_PAYMENT_ADVISE0203456789.zip
- SHA256 fe97c97f69fd6449fbffb74b2563e38ec5584ab5348edcd8432ff96ee9ab57b8
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HSBC_PAYMENT_ADVISE0203456789.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
msedge_elf.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
300 seconds
General
- Target 07052026_1500_07052026_HSBC_PAYMENT_ADVISE0203456789.zip
- Size 1.4MB
- Sample260507-sdg4eafs2z
- SHA256 fe97c97f69fd6449fbffb74b2563e38ec5584ab5348edcd8432ff96ee9ab57b8
- MD5 2026c84287e2be55641d884640bdc681
- SHA1 ac3e8b6627e338b8b68d5e7687793d92c975795a
- SHA512 276a642469be15ceb4353988d86245c497915f731fccf8d4118de9e9e18725151ee4b4b682ef6118b87283160a040b3e09866cd9e5ec8a7840b9c09f18578135
- SSDEEP 24576:Dm8mcU/8zY32iposeaU0FgK7UaKj8QWZujoQjM/Au2aShl1rbAunrKob/6hWwCmI:ScWF3DpJet0FJj48QWE0UM/Au2aSVrbP
- TLSH T1D0653311C6D32055EBB7DAF842C56CB9FBF6B00764841B0A7C6BE9AC0D0F62856BF548
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/msedge_elf.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/msedge_elf.dll
File Explorer
-
07052026_1500_07052026_HSBC_PAYMENT_ADVISE0203456789.zip.zip 1.4MB
-
HSBC_PAYMENT_ADVISE0203456789.exe.exe 1.5MB
-
msedge_elf.dll.dll 1.3MB
HSBC_PAYMENT_ADVISE0203456789.exe
- IMPHASH 55c92788dc86824dcf85360071e9fcac
- SHA256 232fa5792839dc677b0211b3694954e9660b174aa0f9bedcab772ac1e86d3843
- MD5 e31770026101eaccb1b5de7cffd52033
- SHA1 235beed3a3c2ecb6415eff789d2f4deb2cd28c3b
- SHA512 c65068629659f5e11e0580e57f10f14e685b4e7fe26e30e2447bc5c74fddaf8c233d095bb96df4b982b2695048a5e4f7c7d5bc138613fbc69db86a05dde6e9cc
- SSDEEP 24576:WdpUGxARynhYYI6dwnHL3b5qbDCLTTG/Zl1kngqi6Qj92dgysZI:Z/RynhYYlEbb5Q4TT05hxY
- TLSH T1B9758C13F29902E8D06ED2B9CB568132EA61BC060B35B6DF069073552F77BE46B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
c7:8c:9e:ed:89:0b:de:d8:6a:f6:8a:3a:c7:7f:d1:a2:a8:8f:fb:c8:43:0d:93:e4:08:bf:6b:f7:0f:62:09:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:06:d7:bc:51:38:98:23:ec:2c:00:01:00:00:02:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
593600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
identity_helper.exe.pdb
msedge_elf
GetInstallDetailsPayload
SignalInitializeCrashReporting
advapi32
BuildTrusteeWithSidW
CheckTokenMembership
ConvertStringSidToSidW
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetTokenInformation
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
OpenProcessToken
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
shell32
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
user32
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetMessageW
PostQuitMessage
RegisterClassExW
ShowWindow
TranslateMessage
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateEventW
CreateFileMappingW
CreateFileW
CreateThread
DeleteCriticalSection
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleInformation
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
PrefetchVirtualMemory
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
ole32
CoCreateInstance
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoTaskMemFree
CoUninitialize
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
GetHandleVerifier
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
537B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
msedge_elf.dll
- IMPHASH b0f941132882a88f37d9c4ca7733fcd1
- SHA256 275a378bf78ca4914f706bc1adb96d1583a23a0484bf5d667408299a0df4966c
- MD5 f57d1855aa505434d16bbad108aa3f5a
- SHA1 c1801cdb535597c2cf52a512156f0ea6f4bbc4dd
- SHA512 1af4025900e220ccb593ad2c40b32446a36cddf4d02cd661b96fb24d608b64c4460e019efd47a417e856afdeee16d28887dae7dedfe724e92e506a09164af13a
- SSDEEP 24576:A13H3fiS0kbhNeSESPFjlo6s9v2UoWIhzjWs5D7wH:A13HXISrnotcnhnt5
- TLSH T1D055AF56F3CC26ECD517C9398751A232D2B274264BA2B5CB0B9AC3192FB7E905F39701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
630224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
EncodePointer
FlsFree
CloseHandle
CreateEventExW
DuplicateHandle
FormatMessageW
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetStdHandle
GetThreadPriority
GetTickCount64
IsDebuggerPresent
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
SetEvent
SetLastError
Sleep
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
AddVectoredExceptionHandler
GetProcAddress
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ResetEvent
SleepEx
DebugBreak
InitializeCriticalSection
WaitForSingleObject
GetCurrentProcessId
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
ole32
CoInitializeEx
CoGetApartmentType
CoUninitialize
CoWaitForMultipleHandles
api-ms-win-crt-string-l1-1-0
strlen
strcmp
strcpy_s
_stricmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_cexit
abort
_initialize_onexit_table
_crt_atexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_execute_onexit_table
_register_onexit_function
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
calloc
01czUbF7nlmRSvpCWSeLLbyT
0SxBmBudgogJAAQcFdE7kmZ5zUMSpt
16dkHubQlX
2T2TdPS1
2ZRZudsEVjPqU
34Z5ZCmqA
3Osx8AP75T5PER
4Th6rZVEEOW3eTSfF0E
4v0gRIsK6P
5LZyzGoVY7
6Oa62g32sjKlv
6Qb0kiKBaPzSUJGuklGGkL
6vBNqVBmFINHHUDVBxjwInCbbt
81tJir5ybl5EjjMimaU69hod9P8c
??0PwaHelperImpl@edge_pwahelper@@QEAA@XZ
??1PwaHelperImpl@edge_pwahelper@@UEAA@XZ
??_7PwaHelperImpl@edge_pwahelper@@6B@
?AppendMojoServerBindingInfo@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z
?BadgeNotification@PwaHelperImpl@edge_pwahelper@@UEAAXW4BadgeNotificationType@mojom@2@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@Z
?BindWidgetManager@PwaHelperImpl@edge_pwahelper@@AEAAXV?$ScopedHandleBase@VMessagePipeHandle@mojo@@@mojo@@@Z
?DigitalGoodsAbortPaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z
?DigitalGoodsConsume@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@@Z@base@@@Z
?DigitalGoodsGetDetails@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@V?$allocator@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?DigitalGoodsInvokePaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4PurchaseResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z
?DigitalGoodsListPurchaseHistory@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?DigitalGoodsListPurchases@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z
?GetAppAcquisitionDetail@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4AcquisitionInfoResponseCode@mojom@edge_acquisition_info@@V?$InlinedStructPtr@VAcquisitionDetails@mojom@edge_acquisition_info@@@mojo@@@Z@base@@@Z
?GetAppLocalFolderPath@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@W4LocalFolderResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z
?InitMojo@PwaHelperImpl@edge_pwahelper@@AEAAXXZ
?InitializeAppUserModelIdForCurrentProcess@PwaHelperImpl@edge_pwahelper@@QEAA_NXZ
?IsCurrentAppPinnedToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z
?OnClientConnected@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVWaitableEvent@base@@@Z
?PinTileToStart@PwaHelperImpl@edge_pwahelper@@UEAAXXZ
?PinTileToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXXZ
?SetPwaHwnd@PwaHelperImpl@edge_pwahelper@@UEAAX_K@Z
?SetSingletonProcessId@PwaHelperImpl@edge_pwahelper@@UEAAXI@Z
?Shutdown@PwaHelperImpl@edge_pwahelper@@AEAAXI@Z
?StartAppWithIncomingMojo@PwaHelperImpl@edge_pwahelper@@QEAAXVPlatformChannelEndpoint@mojo@@@Z
?StartAppWithPlatformChannel@PwaHelperImpl@edge_pwahelper@@QEAAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@@Z
?StartProcessWithMojoIPC@PwaHelperImpl@edge_pwahelper@@QEAAKPEAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@V?$unique_ptr@VScopedTempDir@base@@U?$default_delete@VScopedTempDir@base@@@__Cr@std@@@45@@Z
?TryActivateInstance@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z
?ValidateHandShake@PwaHelperImpl@edge_pwahelper@@AEAAXXZ
AHph4iLFV4WPq
B4uxMgmKMxHf3UhM7
CVZh9L6jQwo6Xl
ClearReportsBetween_ExportThunk
CqUuj6m4yzHlS
CrashForException_ExportThunk
D8cqxQ6qml
DisableHook
DrainLog
DumpHungProcessWithPtype_ExportThunk
DumpProcessWithoutCrash
EdgeElfBeaconDetect
EdgeGetElfCommandLine
EdgeGetElfLoadThreadId
EdgeGetInjectionMitigationStatus
EdgeGetMitigationHistogramData
EdgeModuleIsEnumerated
EdgeModuleIsLoaded
FvANeYVRupBrxCUvqR6VAI
Gczz6ABF1jPi9T9pNUj30D2jCwzIe
GetApplyHookResult
GetBlockedModulesCount
GetCrashReports_ExportThunk
GetCrashpadDatabasePath_ExportThunk
GetHandleVerifier
GetInstallDetailsPayload
GetProductInfo_ExportThunk
GetUniqueBlockedModulesCount
GetUploadConsent_ExportThunk
GetUserDataDirectoryThunk
H2EMnwb2sDwrpJOC
H5zzCXGut0vy
HRMtPjKrN1
HfW2EQoLUeHRQZ68c51UqZWHLi
HuvVzfpEw54EuY5IAg
IH7TrwF39cbRnc8FVG7w7g6VCe55aY2I
IJ1Wq0AHjaP
IOZQJo9UBmU
InjectDumpForHungInput_ExportThunk
IsBrowserProcess
IsExtensionPointDisableSet
IsTemporaryUserDataDirectoryCreatedForHeadless
IsThirdPartyInitialized
LLi5BdkyDxAeSXe
LOdS0jVStsGMHRLyp
LpEqgS44ELxHvJ0LCS
LsnemqPoaPn4o4
M4ptxmGVjQrcv3p
MaFSJMvzyp4oirTDXay
MmwbgAQmOuqhT
MyKqCXJCDxNebriPzD8A
Q6CF74MwA7G7DSpEe2
QN1ct1ClbQ6bSpygeXJex2jR
QmITD4kvIk9YbsYOMs2DQzBw70J82
RDgt3a59oN0Rg5
RegisterLogNotification
RequestSingleCrashUpload_ExportThunk
RtA7C5R
S72yHH3AAW
SetMetricsClientId
SetTelemetryLevel_ExportThunk
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting
Spphk7hvw2n39uBvJ0QqPd
StartAppWithParameter
WwSVqRQiHFLxIll8pOJvbo0XzS
Z5iF0gbPtOmmiih
ZCH39clYBLfpIQ
ZH8LmY0CvyG1R8ABXiMsGXmWUHGI
ZyHHryj72K5egX517VLLeMV8IahbcpgD
aE8CEFm6vYu59C87uwuEwEqIpTz6
ahq7A7fFmEpDV7vzSrTfD19ceHzgF
axgtwHOwvCYLGpZMnu
b4ThJg6K0KmGBffIS1mzqKq55H
c2Jol6snOns0pgR58mxW89OJlq
cVgU4Tb
dVKa6aUlX6Slbd3
dmsVY60l
eNYPnV2bOZZm3Apu1ts2
fC6BlBaGmOV8S9DkWxtVjjR707xdVOT
faEWsMgotY42dU
faaEuPyoCS2dGTNbCbbfFhiA1PfAk4o
fefWt0qEnPo1xhdt8yDbjV
gWVT7h0W16zjn2qUiu4W4M
gc8GGr50q7HSJGPZ0T
hGUIe0k2VHbr
hZAk3IqUef5Op
iKXIwVMr29Tz3G
jTFES4eyxd2S
kTqk1jWEsdiB0UbJa2YyOSbm9x0h
oX1LLWuHyaM0xP
pSRcJAdOh
pgTXfuRwPucR2EFV
ptj3uBVVkfMVYtSzO2u
qBpwu9wLXqrOZLmE8TZqt3N
qreQlfeD0GItyM6dnU
rG1dkYak
sKmxltZaFyRokRbrKecCgOiS7ELv
sNU2HN851c1XnmA0TLfW8GrwdsjUQTV
syt2H0MIGaDdjVyJZ9WwtwHGT3LQ
t7aRzbMVRfa9eO3lwlkk5
tCuLiYNxg0R2y
ulhOJH672jFuYyapzua
wAuocweFhbYzkwjfh
wMkWYkstIs2rZJ
y3rMbrg7MxM5SQzkwCq
zKBnCcYq0jU6Ch5JA0pX
Name
.text
Size
631KB
Virtual Size
630KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ