877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Size 1.9MB
Sample260602-rel83se18w
SHA256 877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8
MD5 197ced160dec870bef9a830dff660a26
SHA1 c137d8d7e58478bf5c55c02d3b8eb5d672babe9a
SHA512 7680d4b77e4c908f32447e33a308d51e77d726dc2c29e28a8eacb6fa610ecf6e52dd62920ec8a6c4bfb9f20c811c2a19aef423c9113b216af90777f736d7ee55
SSDEEP 24576:eK5xOb54/Vd/HZsMZF1qErbovm4db02BaZgRAbTKT1D1Pwk:eWxObu/OgbovevZgRAb01D1Yk
TLSH
T169957C02BC9424B6D9EA933289B552917B70B8490F3137D72B56B3B92F737D80E35398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
1440	chrome.exe
5064	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3224 set thread context of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3108	chrome.exe
468	msedge.exe
2872	msedge.exe
3896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248828030245697"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}\InProcServer32\ThreadingModel = "Both"	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}\InProcServer32	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7a3c5109.tmp"	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}\InProcServer32	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{FC3A116D-39DF-4CC4-A166-08F1B1937700}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
5064	msedge.exe
5064	msedge.exe
3588	msedge.exe
3588	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1440	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	81
PID 1440 wrote to memory of 1356	1440	chrome.exe	82
PID 1440 wrote to memory of 3108	1440	chrome.exe	83
PID 1440 wrote to memory of 4376	1440	chrome.exe	84
PID 1440 wrote to memory of 4376	1440	chrome.exe	84
PID 1440 wrote to memory of 556	1440	chrome.exe	87
PID 1440 wrote to memory of 556	1440	chrome.exe	87
PID 1440 wrote to memory of 2500	1440	chrome.exe	88
PID 1440 wrote to memory of 2500	1440	chrome.exe	88
PID 1440 wrote to memory of 4752	1440	chrome.exe	86
PID 1440 wrote to memory of 4752	1440	chrome.exe	86
PID 1440 wrote to memory of 1104	1440	chrome.exe	89
PID 1440 wrote to memory of 1104	1440	chrome.exe	89
PID 3224 wrote to memory of 5064	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	93
PID 5064 wrote to memory of 1688	5064	msedge.exe	94
PID 5064 wrote to memory of 468	5064	msedge.exe	95
PID 5064 wrote to memory of 4724	5064	msedge.exe	96
PID 5064 wrote to memory of 4724	5064	msedge.exe	96
PID 5064 wrote to memory of 4724	5064	msedge.exe	96
PID 5064 wrote to memory of 1700	5064	msedge.exe	97
PID 5064 wrote to memory of 1700	5064	msedge.exe	97
PID 5064 wrote to memory of 4884	5064	msedge.exe	98
PID 5064 wrote to memory of 4884	5064	msedge.exe	98
PID 5064 wrote to memory of 4884	5064	msedge.exe	98
PID 5064 wrote to memory of 3092	5064	msedge.exe	99
PID 5064 wrote to memory of 3092	5064	msedge.exe	99
PID 5064 wrote to memory of 3092	5064	msedge.exe	99
PID 5064 wrote to memory of 4432	5064	msedge.exe	102
PID 5064 wrote to memory of 4432	5064	msedge.exe	102
PID 5064 wrote to memory of 4432	5064	msedge.exe	102
PID 5064 wrote to memory of 780	5064	msedge.exe	100
PID 5064 wrote to memory of 780	5064	msedge.exe	100
PID 5064 wrote to memory of 780	5064	msedge.exe	100
PID 5064 wrote to memory of 3380	5064	msedge.exe	101
PID 5064 wrote to memory of 3380	5064	msedge.exe	101
PID 5064 wrote to memory of 3380	5064	msedge.exe	101
PID 5064 wrote to memory of 4324	5064	msedge.exe	103
PID 5064 wrote to memory of 4324	5064	msedge.exe	103
PID 5064 wrote to memory of 4324	5064	msedge.exe	103
PID 5064 wrote to memory of 2420	5064	msedge.exe	105
PID 5064 wrote to memory of 2420	5064	msedge.exe	105
PID 3224 wrote to memory of 3588	3224	877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe	106
PID 3588 wrote to memory of 3176	3588	msedge.exe	107
PID 3588 wrote to memory of 2872	3588	msedge.exe	109
PID 3588 wrote to memory of 1572	3588	msedge.exe	110
PID 3588 wrote to memory of 1572	3588	msedge.exe	110
PID 3588 wrote to memory of 1572	3588	msedge.exe	110
PID 3588 wrote to memory of 4960	3588	msedge.exe	111
PID 3588 wrote to memory of 4960	3588	msedge.exe	111
PID 3588 wrote to memory of 1300	3588	msedge.exe	113
PID 3588 wrote to memory of 1300	3588	msedge.exe	113
PID 3588 wrote to memory of 1300	3588	msedge.exe	113
PID 3588 wrote to memory of 1192	3588	msedge.exe	112
PID 3588 wrote to memory of 1192	3588	msedge.exe	112
PID 3588 wrote to memory of 1192	3588	msedge.exe	112
PID 3588 wrote to memory of 3632	3588	msedge.exe	114
PID 3588 wrote to memory of 3632	3588	msedge.exe	114
PID 3588 wrote to memory of 3632	3588	msedge.exe	114
PID 3588 wrote to memory of 3256	3588	msedge.exe	117
PID 3588 wrote to memory of 3256	3588	msedge.exe	117
PID 3588 wrote to memory of 3256	3588	msedge.exe	117
PID 3588 wrote to memory of 1388	3588	msedge.exe	115
PID 3588 wrote to memory of 1388	3588	msedge.exe	115
PID 3588 wrote to memory of 1388	3588	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe
"C:\Users\Admin\AppData\Local\Temp\877c8b263ab92c09e17ff9c1e856b4957bb4ba0c6e838ab15556acd16d1698e8.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com --disable-gpu
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fface1cc728,0x7fface1cc734,0x7fface1cc740
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,17101709928448286094,6299878902630505474,524288 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,9547933248725864206,15209113239443983494,262144 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,15018392361781942854,15411387560506735947,524288 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:13
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,1495604931826063803,16554750289578522377,2097152 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,16927748192077408393,10948387065886137232,2097152 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3028 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4008,i,15861049570191367812,12190108818436794916,2097152 --field-trial-handle=2000,i,9847324074642150877,10540842821575546933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4016 /prefetch:9
    3⤵
    PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffabe6dc188,0x7ffabe6dc194,0x7ffabe6dc1a0
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,454528111193678669,11260048081872390968,524288 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
    3⤵
    - System Time Discovery
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,14332640568684852559,11624106247846503028,262144 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,5513914708682347337,16721435023697219283,524288 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3333045603169497999,6013673458059174599,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14131004051013761081,181248697036358265,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3988,i,5916915742864097895,134835528263277755,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4040,i,10375073951873654662,13448582706827630031,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4080,i,5293520402067838954,5384650525915147224,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3992,i,17738925018887180916,8752913684770665542,2097152 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13514651041968115521,12465303805207179202,524288 --field-trial-handle=2180,i,625435856167304081,3091430068883576940,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2b4,0x2f0,0x7ffabe6dc188,0x7ffabe6dc194,0x7ffabe6dc1a0
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,11935592935838613918,528224553916152444,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,11682255756846908406,17766249826639296044,262144 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2239789196020802386,7198449142613946700,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16091631638971373798,12384370264483550490,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,11871834399571251345,4308176467289899058,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,16611821175668438720,655978286789179979,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,3153112987189481363,14295771630513116183,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,13708888493788829837,2204301125617492910,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4192,i,5085216708340020361,3443037682236233099,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,13674959085637002287,6994787414931976047,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3428,i,4869972693675324215,5667549699805897481,2097152 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,1017343061460314173,287402141933986063,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,6986909690326789807,1839693116676189149,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,14538324725745177008,8521154360105197999,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,11363085933999945189,2575787720241461364,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,6847332479907784108,11017216626252479163,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,6847332479907784108,11017216626252479163,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1748522730791288232,716087127472597278,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,8246820824794526885,12782265491801228563,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,11234798379268532512,524436243595008430,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,10496823772496784707,17902809339373072964,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,12711493560994516088,3901067506181781457,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,15701151540671809614,787985747256573202,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,3033306862571819774,2273970373004004282,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,16585541619368957670,7688094404028425149,524288 --field-trial-handle=2900,i,12373651283390791188,15548059496224132470,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffabe6dc188,0x7ffabe6dc194,0x7ffabe6dc1a0
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,14541186617138780556,195787541335876204,524288 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1604,i,14304377820231572055,1669008716371611092,262144 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,3974259386567255535,11932247681686337743,524288 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,8659266455586730689,11045485299647929305,2097152 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,2062755709548518251,11298348046918177777,2097152 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,16321884163777974072,17028223008542787211,2097152 --field-trial-handle=2424,i,10031228560949080119,3866047009670050966,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 28795352a8ae9325aa606b1e43229f96b4484a9bc1e558599ee6c442ded0403a
MD5 d85236d8b2c160c5f925bf071fdcb436
SHA1 b52941d2006959757c0c13580285e46975826f6c
SHA512 bd62e18ce48f67762ff84a94f121f3bd0250f49ceb9b2720485be94bf4ee0c0a4ccbde498f9db16d29919cb3c29b262dfe042510b30cf665f78a7e40bf996eb2
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:1m7Rkm1tYpBeh2BAoe
TLSH
T1ECC3122B5E75A9775DB5B70EB08E0B1F1EF14EA6D920DE82C8D85B0427EA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 311f3fbc6da4d5b4ab2a4b62c0b30528f288c191edd41c35240bb3e74dac752f
MD5 e055a37430ab6252309eede2ed728305
SHA1 96e858786ae3ac435a0f47f182d2ad0e0adb5bce
SHA512 595dc42659742b53fdddfa4a0aceb71a6485d800904e1edf981d280354f827e8881931f8306b6d7422e27a691ba18de3c8fe46a210d7385973b76f59dbea7408
TLSH
T18BD080B75E162420DE29A3366453C3071FA55021090217179755E5546DE01D445C30E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 417869a61626e209c0213c1dc35be1585a1b08711c2e125786a3067b27b95fd3
MD5 f23769dce957fc1e3d8ccbcacc7550ca
SHA1 f926054149e09b56810bd2c0c958cf3210b224ed
SHA512 61b6a15987d011bc7ea4a1de6cfbcd047c72e37159c955b8bea50e37c4340ac4febb858e9318226b12b079e50d07a6b78055422fe4321f97df7b9b2fb70ebc40
TLSH
T1ACD080B75E162420DE29A3366463C3072FA55025090217179759E5545DE01D445C30E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 34353d907d78dfd95d3d4fb3bd6713ae62c9e7c267e924c7d72a71111cf42ec2
MD5 1e111657f79036e3f14ef8b769a4585e
SHA1 0c264b7321b5d5403897cb2c62032d994d7c4a48
SHA512 07d2c93509c1b3a8880b666e319929e34a5e9ed8885ec844adabc8b97ded35093be020636d504a8475dff22e98995ebf5f0475866f5ec6482b1db529c5813618
TLSH
T169D080B57F575491C525753F1C55C30B3FDC4415050721274B5658545CD15D984C14A5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb45288665dbb4e4ddce6c4c6c06e7b145970574977697534c462940fdffd422
MD5 7ed77d5bab8d0486cad4b65c1171bb2b
SHA1 0ea6700cb3896aefe96564f923ec849b2bbdaa2b
SHA512 2af16863fb0e4bd3f634ac1c0e97ab6d72e556458db6ceb37bdc470873a03a7e02025eaa521f7b059b41e68bb67b69caeafcbc374b6f62d8d96369064fd022db
TLSH
T1D9D080B53F675491C525753F1C56C30B3FDC4411050721274B5668545CD15D984C14A5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5b05f0f0fb5a4a749eec81664f4cd32ca10f5b3fad53a52b317ba37c15dcd84b
MD5 09d3e05dd382d41dd4a5d1877aeb7963
SHA1 c29a5be7d717bd6b79a2e7fef48c3f29babe727f
SHA512 a4c54633aef391ecfecf550d1dbd9a834351cd51653b0b903fd47f285eba9b36d808ecb9304862e0873c9e35a7b39a556445835034f994a0a5b2d3bdc81325a5
SSDEEP 384:e3Y3fxjtvZEbpLoxn+F4Nnfjf44RMbiZZ9AYU:e34fxhZEbvmNfM4e+I
TLSH
T1F1138F3DBA811F1FD2C74B7E113B6A31273EE4A6D0D8037333753118932A79A096E686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 96512bfbac86c5bd265a63d469333d11d6c2b511b0ea5099ed24a85b44516bd5
MD5 f46fd95ab24c016400925d0d0d65741f
SHA1 5e363127c3bf34d80c7a41c77f7d7a136e08c445
SHA512 41e08d5c4412bf0b1377f4f03b8746313a997b21879db523bd7c91e21565b99892a352b80d0ccdcc5eec239e0dd3f4c79ec0a2a7170a6835f84ddd58d02d7e55
SSDEEP 1536:GkX0RevpTL/Y1XL/iFwJmGK4xzasaWsOL/L/+tL/lxu8GvdtozlXo:BL/UL/wcQsL/qL/HWw
TLSH
T17D441CF70951A01BCFA852F6E2133A3DD177055D7CE1F9E9E2780CD11825B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 2caed0d1541fc02847191ed4945cf9e950750cd87a86fd584f6188b52abef577
MD5 6a5c170c8991cc91f6b983e388cefc18
SHA1 9ac13b2c9a712c99cc9e121f5c0aace46e21349e
SHA512 d14615d745912ed91d0c38d1b50235d638247e36c0cb7fe0dbe82119ff6618030d04138a035b02f6b9c55869e2bffd7d0788d1d7255e66846678bcc6d406756d
SSDEEP 24576:ZK/olRYu0Ta8QRResl0DF8xLFpH2/O97x28JGkksVcqC0uYNCNrSLp2kO9JAPubU:ZJYda8sKDIFpYO97s8MLarbCU9HO9Y
TLSH
T1E0868DEDCA689883CD639970B0F0E9477C7413C3F595C1D68898C688026B7C5BBAF769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 067f6b624a7a52fa28d100dd01cfc4376ef783a513ecfe3d31bb476dccf06878
MD5 4d8af77237e4fc235a1c0a56eca1acdf
SHA1 d33e0fe46147c64be56053ad1ebfc2340f643252
SHA512 e1498befee4fc76824368c10b130b7f8e13c02528f80cbc345b1753640cfab0fffcef94fc41503739014373174683540b0f239494a57f8b591b30b4a587d9ba7
TLSH
T151717F8B47A27B77EB520331A0BD07093672AD4B29A35E7942C46FB6153B722C12D70B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 968fca2e4abc0a6115296415706bb0580654797de4dc21339a20260729184f74
MD5 063407c56ed2434a5a2af4df714752b0
SHA1 e7987e9d2a705ae024fc60d9e948a89143057893
SHA512 1075c3f78ef1a305a12c29c217ceb6f65f34b72c9281971bd2dfc598d66105382b80f90076b07e65202bb5a7e8b552d0a42252a147512b70fa614879380520d9
TLSH
T13B719F0A47527FB7EB621331A0FD03083672AD4B29934E7A42C46FB6153B762C16D74B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 323B
SHA256 8db077c9e1ca64a8ecc7afe28fed0f9e332149189136bb2f1f93167d3013d383
MD5 8e4cef799683b1b4734fb4172e85ebe3
SHA1 e5d0b0aa5da8e615a764e5a721dc7f264108e2cf
SHA512 ec4f70bce5fe49c8bc0bab1c2737dc9d7df97e56fe957e8736cc33941a8076a80db827b8888c497ba0f7db4e5f88483b4b2337b0d9446cbcdf0462d70d744fa2
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 465ab8245de6e513ae4aa6ffef43a28a8c9305b69218f24fe64f83eed3504953
MD5 bf99e2359550290b65e71de3946c6d8d
SHA1 7f4c12de5d854299df660ecfc60848d0c88e0618
SHA512 bf1b3c4ee56086a69cd26174e3894f090fbf1f88db8f6998fdeb293fa6475423d0dc56bc9cde3538feedf7ee32dc8e932bde9e399ab193106502c516c7d68e6e
TLSH
T165E04F6654CDE9E9B054649282A8D38CC3F2794FA6DA39071B0888817502566B2F62D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 5af4c10eb4a9c60ed0361943d86a58edb4602b6a45bd389019b268a2ff13fb35
MD5 652f0aea67a02cf892ebf238dae5a639
SHA1 eafaee8831003e14bcb606d904e2beab78b53bf8
SHA512 94d1b78c285cc27c807453dd372c3fbe575393bf3a9800d4cd9dbd8f7399c3af5a9ceb8288fe5b6231dabc6bd943c3df1292c515f5cf4a0ceba0efcff467bdb9
TLSH
T1ABE0867848CDE9E9B05468938279E38CC3F2794BB6DE79071B08CC806502666B2F26D4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 969B
SHA256 df453142d0f1759d7c78cfb66714ae38810d07ab357650c43e52e2674545212f
MD5 96c202fb7b1285b53659f73bfb5a4f9f
SHA1 e095f8e71170dc3a72436a7ab1024991e5521155
SHA512 4217d1419622fc20a1183fb235594b83414e81a8d651f31265eeab8bd6f25715c7c2d586cb9355d44933862f52572f12baeb6908ce2375b381de007a2ae06ef3
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 4f433e066a77e550c40e2f3385e9b68683005bc3dedea9552d33e637e7003976
MD5 da07b1fa7c24de85f7bf269b865bdc91
SHA1 9c47755b8e57c5cbac278e2a8be4d7c60c067f62
SHA512 98296644d7e052bbf265f0f0aebeb34e5c3752865e89e475f8e70660af3e5298d34534716a9aaf4bc8f1f965ecae415df8a7ff6539320ab58776e47e2d7607b7
TLSH
T10BE0263444CDE1BAA0246893836C6348C3F0391BA2CF390A1B088C847142E4BB2E62A4
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 60e7726daf5bc0d468e3e2910a8af10ba446798a6dd212beade1a5c2cf6ee5bf
MD5 d62a2a2b4c039e996902f39de128807f
SHA1 8272d8f367eed004b2e1b67e53ab21ca1250e9db
SHA512 f108d65bf97d0c10af3f1061878dbff34de8e5b96cdcf8488d743c57b35f89ec5e22398ae629de7a1e7be53acb69d52764c3f8c2bdc28aee068365dd558fcbc9
TLSH
T1C1E0D87144CDD6D9F10420575219F748C3F0395BE6CE2A051F049C41B042419B2F21D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ac1fcb90df75b9323c3a5276eab5ac815303d775829331822f50be1a2eeeabcd
MD5 c95ca82c09b6c85b3990c544a53277f8
SHA1 d52adde8526787083121cf2b071acce435331236
SHA512 07499c2917f2933576b76436875a21749290cc257605329a5021ccb8db605d51fa737ca6de5268e1b504a28d487feaf484fd24aa46873940d176cffa3002dace
SSDEEP 192:sxZBQUn6RyyM/jK1Ml8McT/fLs3+xSt8T6gCodpRih/W6+WNrOy/Y0axEzwIg4J:sxZpn6c0T/fLs3+xSuT6MA/bn/5ec
TLSH
T15862E816AB345D7BCCDBD209F915BB53D6FD5562E2900E449AFC8A0C00E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 08e0dcde4ead4e4f2c027e3f96391204b81cd81c3d50db51506862e313d2540e
MD5 b0b7159787dbc3b95245f741ca860acd
SHA1 5682d07aca584be39a2d742718647c03c0d9b70b
SHA512 0934cc30e333c75d0539067b3d7b9b96562dba974fa61cab57dc05c305ce3da003432a21421f56516fd07c151e09f6629ae206d2388a0e1d9365983b1c547094
TLSH
T108E0867046C9E5BD7115314B026C934892F8BA5BDBCEBD062F44C9506143DD6B1D3195
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 659B
SHA256 c1b8b0923fc090cfb7632f76dccaf1ce85d4a85ca58ca39a1fbec475c02964a9
MD5 6f5ca82d5664d4b6858144428cda58ff
SHA1 fe5bbe094ff5c253c6ad3f54b1e300d885c45543
SHA512 537b60e0bf65d5167b0f177a6e637fa318ea1652669e7efe8b0fe3adeacd7a3b605b84a4c29a66379432117f3acda2c31cdfe596beabe6dc78915f40311ba472
TLSH
T14F01F9E78B0C5566DDEDD1B008926BE4E372C1DE4B8CCED2897C628754112363D11857
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 fc15d746d94a9cd807eb15f70456324ee76306e02abacfe419dae0a57af05452
MD5 3168e95fbd73df6be2f2ddce4ae0f13e
SHA1 c1da23ee74ac8e34154c8ac9231343f32dc8a163
SHA512 3743eac87da34ef922ff8c898a6cb3ead5cce8c933e76f02e7488e8f782a0611d91b89f8799947ccd4b668ac244606e90901e63910bfb41bad27d371b273750d
TLSH
T143E0867448C9E6AEA15464670269A34DC3F17A4BF7CE2D0A1715C4846203957B3E31E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 564f37dd9ca82685c54d31797a575c0b48cbd7d4e8b0a1065ce8faf015c6c3b0
MD5 6f890ae99502563c7c81351a23f6a59b
SHA1 30e2a4575aa218b500335c18df2e739427ccb9bc
SHA512 9649576111d55e15e6eb82e6041f181befb1fcc2a8c3c63d14c698875528886df348159722bbfcc1fcdf97eb7e6a0fbd266b35362ebdb1579a1c15301d2d7458
TLSH
T19EA002900AE40C72D91502F2139A434237517964750ADB43F0DB00599C975D9A21F056
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 b0f2c5f9946077ec824225c809fd69db65c092dc29e7099faaca5b789edf057c
MD5 14775f124497b1a792ad9f896a600e46
SHA1 cb115c667d5ab4a263dc87d5aad53a15ce537a4f
SHA512 e4bca4c0ce25c3b980ef24bce37b58c2892c8fed4fad3a5b27a29effe9a67001cf905ad341144d74d50017b7e3df7a7a4c9fc5623c9775196c9949b0b2466df3
TLSH
T132E0D83056C9D66A7145308F522CE34881F2BA47DBCEA9152B08944062079C172C3150
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 ed37c5e36b8371c998602c0cae5e4302ae265d9c35b5de7d5fa43d5d2d3f7cbd
MD5 6848e9d052d9a9238445aeaf7a639355
SHA1 506bce181ac6b93ce556625d62cba1368704b815
SHA512 66c5ce29b86765dbca42b3bb70513d6359dc2c26defdc1f0edfc6547dc8dec27e98eaf178a807cebadffb41b4f1038d899e60fd63c82779d348205e445eb7c2f
TLSH
T12CE086B087C9E779618470C7826CA74D82F0BD0B97CE3E8A57084840E10395AB2E66D5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 da643b62d9234a3159dddd8302991f2738992f475bb99bfbc9bb2494febfde80
MD5 048ce841836572f45e65b595f3765294
SHA1 ceac2fe4e098559f4bed67dc8966424aa976abb1
SHA512 16f0e7bc1b827bcb8df17dc6d0f5dacbce9400f8cad7c64c99b569f96d4efedc69bc94ca9c10881e0474a99651752fc81866450dcb91e5c0bd97870102a31e70
SSDEEP 24:KdZf0fGaDdrnP4fj+GIjzPKiohaefx2Kf292G23a2sd2A2c2442o20+2rIj2i24/:KEWIHKvQmIfKTyEnyhYIrKNKMBdIZKY
TLSH
T18A91599271FB12463C7D3E09A294871706817263331AAA2B7BE940B24E77F205DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 68c128a0815013e81966828babb23474d169252d7ffce44895a66ba296458cad
MD5 07cabc92cd0d2cd044200347f4a3f40c
SHA1 01acdae129666d83c89785581725bb47723046e1
SHA512 e9b37ed85447ad94be23e7c1633210798dedbe10664bdc24efcaf8e1bda7985e56bf5bcbef9f4b3d52a2146aa50949f2e5515d32d5aaae743071ae156c2daaa8
SSDEEP 192:1Lo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:W3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T14124530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694EB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aebaaaaf-7d5a-43d5-8fdc-1ad2b464a08a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aebaaaaf-7d5a-43d5-8fdc-1ad2b464a08a.tmp
Size 36KB
SHA256 3fe3be617a8dcbeb86f0e311c51b77d3f5cd211a916e2e54cc43a2870c69e6f7
MD5 74d258cfd59c1cc6893b442bee0f1cc8
SHA1 e1537f75b87b792901364414249bc8f7ef8f5ca2
SHA512 572924d65d2d1c8ff4697909878bbc5bf725dc0dfb22e94b699786086741fed44c1d4334f92a93c96397f8e4d594d14eb365ba7765a7a9f483dcaee8cdcdf789
SSDEEP 768:eN/zh8dF20x7pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3QEJjLlt:eN/zh8dF20nEXEkWRmEcQXwu1jaKQEJP
TLSH
T16B031C3F280CCB7E4F804E9CEC2A7E9B6EE8018B6698895447FA494C03C66DF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 f52b3b00a354f2494141d18d6a3bc04a3a16928c5d1015f8bc5784e9cee02310
MD5 1e65449bbc0a719294b05507905c496d
SHA1 391fd2a281ce4d2bfee48d21bc09a62c9be5666b
SHA512 47c2b3f2697b3eb9f66c5f43ab135786a8ef2be4f21d53850c98b902143250149964ce6edf229e7c55e31cdb000c66c6c59e9ea33f39085ff17526facc5fba38
SSDEEP 49152:EDzkBzg8sRsF13YUpJ9HDPTsVsK8sRNOANFMH2yhvv+hmEUMXK52TkyQquhEM/6A:h
TLSH
T1AF1683F36E1941AAC9CE80B4852FEE4854B34665D730C9E5A93D0CC37B78902FEB59C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 eb0a2683adc23bbacacb4c4cd6f64753ee12738321dfd80adef004f70f01cf0c
MD5 c14da3fcd12ac8fa8579041f7198ecd8
SHA1 df7eb45d16c2d750a0d1626ed4f1342665514e37
SHA512 0cb699cdab49ba05528da94e930390325df20885d90c2c56398f14964a2ce253bd715a44aa01e1592c62d1519dfff1d03c617cb0da9a39e350aa05bb58cc72c2
SSDEEP 192:qQXIIImbGMIMslYcYfRsOhZAsLlr0EusrOkLlIr3oblIr3o:qQXIIImbGMIMuBwh6sRcs
TLSH
T16E42716E1A152B7BC19E5F7A5252C5849AD888824870322C31A16C8F8DF7F97C7C63F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 b1dbdfd429c38eebfc924a8c139f0577e0aabeec184becd23f15076bcc82dfde
MD5 619ab5e969d5708c8c7026785bc47da5
SHA1 b6bea195e898abebb38f626c2ea0cbd09e982a7e
SHA512 8272dc69830e0a1a97e67719eb0de59695b88ca6e18722859eecd38354e28f51be63fbd5a4adafa3f15e5d9d86ba34bbf18c6a8d44c5dc6cc837e83f4888d804
TLSH
T18CE02670A8C8E1AFB01920C7413C7B8982E03E0BFACE6D0A1F08C444A003A1AB6C6192
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6bad2be33d132a4708e021362a61b0e4b766a0ff6776acf1215a73370964a801
MD5 34868870e13606fe525237cff3bb9b3e
SHA1 5b22260c90a5b45b9f14a14c073b49c9be47183e
SHA512 0d95130f302cb5b9a92a2e0b380eaa155e4680a812c7a324d67646639816f7c538a467b0402fc4d80c28aa8272b7802f5388604e5f784a4c07bfe2f990de19d1
TLSH
T19E216865F334C209D14A4679503A5B291738D4068FF8ED0F11B520B43F76B144E073EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e3df6c989258c7e5dcdcbb5f36092ac4ee5401cc57a26861234aa2d100ab0596
MD5 a58d390efc0083015ef26dbc1dec1d5a
SHA1 761222f055eed98c3281dcb4c6ea0e9ff1933467
SHA512 f5c50fc1e00754caf87705d933a2f5b43096bec7ffbb9354e9e796f2ec9e678528845086b32af03d526ed1ff4a4906d9bc6e6f0b5c0ade1a2012852d25904128
TLSH
T189E0D83065C4D19F70112087457CB3CA82E13E07EBC92E061F04C844550394776C61D1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4740729f7f0633fd46ac6da449dd0c58e89bbdd0799a117a8b9de0ba4fa85d36
MD5 a197df099eabeed392bf773ca8efcf6f
SHA1 12ab126e9e7e56dfa380e797f3d3878f7218d38b
SHA512 83e5cc74d0e3c67884e77f7eda5e1226a61bece45354c3a4252a4e80febf47837593f5d90b04bb784f946cc0b9bb75fe422f49d4d2153c6f0a3ccd6aa4b16e92
SSDEEP 384:yHtNnNnb978N/ZFwutbrj4nsUOOxZ/tm5KEQYELUX8T7d:ijZbdGwojAsUOObc5HQYEw8T7d
TLSH
T15D927C366C744D365E96A616B08732478F7C65B7EA852F94D8DC9F0E01DBA4C3307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 64ab96e60eca5dc59b1407485ead7347cb870138020ebddc7508ea76c1a43fc9
MD5 86efdff259d426986e17c8c16d7ed50c
SHA1 96c790723c49517a7223b9e8131f8310927460bd
SHA512 4aa2f88057e4162e4c5c1fd84260386426e40170262b631b81c538b4735f555d11528551fb55022aaedbce6637bb369d861de5441515d39e895d16d6bbc5aeb8
SSDEEP 384:yvtNnNnb978N/OFwutbrj4nsUOOxZ/tm5KEQYELUX8T7d:ijZbdDwojAsUOObc5HQYEw8T7d
TLSH
T164927C766C744D365E96A616B08732478F7C24B7EA892F94D8DC9F0E01DBA4C3307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 867f484be5d07358c4c8eeedd361cbc5aa7f619dda6dbbcde9df87d6da316c56
MD5 a93d1b2b251c7fc1af4d79f2d3fb9787
SHA1 2b0dd3903a0441e5e7fe34f2efae891d399e4043
SHA512 79a4ca2661b658d430351d9dedff9fcf6ec75e9a68fcaa458682ccc7b03f08f4f613789486cc11dc1c8d7588a6f891daf1ac9c52ccd6a4fce7c67a02d5e5bea4
SSDEEP 192:BGN26P2UMQmiUyKE3sGv0UObaxR0B+oqH+U6:BGN26eT/QsGsUOOxWs+U6
TLSH
T1B1121A766C785C775EA2A555F48732078FA95167EF492F80D4DC2F0C01EFA9C630B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 405490519e0ea4f9a36e08604e4279c05eb2337eef74345468aa5bac73e37808
MD5 40d71c1878e4527d11f6f6abb0fe0051
SHA1 395d398923358100960aab1531f25c940ceb949b
SHA512 9296959f4c20a1f53f860bcfbbe4e013617dcfbe1cf0bb98114350987800906b13dcd2b47a30dc4063bd9bb3d6e5eed878722dc3ec363d8dcfe09e5cd0061635
SSDEEP 192:BGNY6P2UOcQmiUygIU3qGv0UOb7wSKmU6:BGNY6eXsHIgqGsUOntU6
TLSH
T14E02E9396D782C779EA2AE45B48737178FD9207BEA952F84D5E81F0C01DBA5C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 98e1aa341ccb933c309d1b5a20ce32bda16b8d6a9b219d615d160ae992881dc3
MD5 833411441e3c792687f9a275d4346399
SHA1 cb8a710e2addf3907bfd1cd70dcb0a8a96c6dcd1
SHA512 47272bd02feacb509461322c567bd2b7b47896f782cf567aa5b819e4f610af1791a0db840491fdf2acf7852ed519f6aacc7f4cf44de1472643efd327e6c7d067
SSDEEP 192:BGNy6P2UMQmiUyKb3sGv0UObaxZ/tEZbw4rq1VI:BGNy6eT/DsGsUOOxZ/t35I
TLSH
T123222A796C685C275E92B515F4C233478FA820B7ED4A6F44E4D46F0C01DBA9C374B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

50e46e5a-726a-4e8a-8a95-f7bfb6d20a60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\50e46e5a-726a-4e8a-8a95-f7bfb6d20a60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3f2fbba0-9e2f-48ad-8a1c-73ecf9b9024b.tmp

Path C:\Users\Admin\AppData\Local\Temp\3f2fbba0-9e2f-48ad-8a1c-73ecf9b9024b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

455e8748-97b8-41e3-9a42-b084d2d1f477.tmp

Path C:\Users\Admin\AppData\Local\Temp\455e8748-97b8-41e3-9a42-b084d2d1f477.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7a3c5109.tmp

Path C:\Users\Admin\AppData\Local\Temp\7a3c5109.tmp
Size 115KB
SHA256 3eda45033e872942c8b5717954d658785392c6d63d73f0bf0f8f03f05b4be54c
MD5 f1bf58f2e9264742aca014d33cc1efa5
SHA1 790758b48ae2f1f6b7fdbc600fbe6454bf99c6ca
SHA512 03ea2c3a083391e9f356239474412e8e10826972acb68b7af6fe280798ba163e1af6575621ec2019d92380ef91915fdbe5e15873aa7bf6888968247453826bf8
SSDEEP 3072:JOlSy0gYMMAALtpadZk2ASExjiqFnSbm23MLnfu+4:YcDgYMRALtsXu5EqxbLnfu
TLSH
T133C35B5776E600BBE1BB8234C4A34A51E773B8114760AFAF03A442691F237D5AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gs_ch_key.bin

Path C:\Users\Admin\AppData\Local\Temp\gs_ch_key.bin
Size 114B
SHA256 17c111ae0ed3f676015b90130814c39df2d5f222816cefdef66753d001479df8
MD5 f8f6fd4fa8f0d84a604df19750cc0cd4
SHA1 f1f1529a1f11d58ff410feec30913c18177f943a
SHA512 771087b9a49fce2fd5680f91ec7c8bd43a942f18936e6d838b11fc83192426cb7548b0083ed16d579568bcd58e24011e7af5e834f34d464ebdd97d2f266c6e60
TLSH
T1ACB012A161270401D001077944CAC44E68051804E3100352066C911608F51463D25408
MD5 SHA1 SHA512 TLSH

Submit Download

gs_ch_key.bin

Path C:\Users\Admin\AppData\Local\Temp\gs_ch_key.bin
Size 114B
SHA256 10e57b3266f3b485e253af1a23da995881872b471cb3bbaf2fc8ae0c6d31fbf0
MD5 dea1bb49f06e6e942ba588841a7ccaf3
SHA1 2f1667bcdf112166b030765290e853c192d100fa
SHA512 5c404c60481d8eea5e7f83728c535f9be192fc713698a6beb93f261043556d31d47e468091563b4f55fca23c736f9174044d4563f285aa8710df91fa36d6573a
TLSH
T1BAB004C1C7105051C0003377D0554335475040F5C0C557115055C147C550C405CCC0F0
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3588_1679420705\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cebb7ac0-dbcd-4f9f-be77-da9021433893.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3588_963750340\cebb7ac0-dbcd-4f9f-be77-da9021433893.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-468-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-0-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-1-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-785-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-786-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-787-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-788-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/3224-789-0x0000000140000000-0x000000014007A000-memory.dmp

Download