hxxps://bbgdabid[.]r[.]bh[.]d[.]sendibt3[.]com/tr/cl/km1X4EqZpAhGsUVUT-qrCM5qqgiFC4HqrI4zNhz6J3lcEe949YmbhhdUcvR155JN90xLJyh8eKRDHg8RsKeZOBF0xz6jbvsV2A1w3FTSIvGLE69_2seE0YbOKvnFxvaY_Rn1PRHJgd8vOyEVmVqMJqk6Ji4rW21cbqnUopsYSrnp1I7JksApBVwNBy-zdNY9_C1YBQ8eLZGY44e3MuMNqLnL9ARtV5OVoaqSJEMFpUQXhKInePfWdy1YnoOhqFkW2csG4CF2-bE_211cbbwoZmu5YTFbl4NyD9K0l4COqn-lKZjCzjtSUOsXAaZ2Sj4Fem171wpker-XuaC9A0S93ykiFhqeoNOOXn3Glqu8En3KW0puu-G6RGi7OTqWwRO-bHcrUumAtt496xfJ_SdHOuDGOHYEZfE-Rj8_Li7xVv9ERJT2QbZ9XN0EW_ON9UG1hKqjHZRbmORJl5rcwTqDQ0fLPx3qoJ355_7vI90FwHpdiDOfIqC-teJbYM_XSNAxLWzxaOC9zehbjl7LZeo1VrUl05QaCcrP2iz33S3ccCNC6BfIcyrdUrYqDXvvOSrN0HzoEXIkzWpKhjwNT82Vbr_NV9BK9RtyuRaifB-l4on-svRGzk-4ap_QGefUrZ8E3VDpO9MkeZX73EV0Y9hUJzc6D6s85c0kztD2ozttHA5MPFbWuVYum63Jy9iiFQmgV9DlUxPUGiolUqVOJBYFMVJ0iC_wE9K-w2ih-Y5b_86QUBJwRBiiL8FNHsKO-Yow1AAfXmdgHmJxNWAC40TSoh4pOaMytr-mcPsu_kQgSLTWZf15DifUy8IA_J7welfLlm0lgsYB8hXnh-X8fb5NzmWOtivCShJT4re3Ew355lyRPUCNNWnQSRCo6Pesb09rG15z1T5HVXvjcQgrTgyBixWfJlnGK6GpiNmK3ODqcWDyyMu5IIdgg8PdRLlsrutoSI0j0zSTq2EJularQzyK8DdtxLmYCO1k7p9S4CulKr-2enmQa528temJO3UZZxs6C9506mic6UmVELO9RMfuBKaTvmxyr_YhSjKoQTKiNJ0Maso0gSFTCKPTAIrngel-jpSBgrE-dDYKiv7SmpWgJuMyX1DidrK9zQK5c2eB_oITP0t6kwcnXHS8utE4kVVZ8Y2b65UkM6IgrK--QXhUBweNVEJD8fyWNub493KtFFFvKuSQBtw03InWJZB80AVLjAsfDMxhj1kC1Qbbhip9nA6dlU3eSivt8UHhyqzmjPZjHTa3UYZPrR2iQ9iibJ0rYywGMkd3bVheDBbFP5UBh-CjoNr7Fy_c9rDvkn39OR5khgagYvKEhm6FsRwbqblWF1HbV9TI1IG9HQ6-AvepZwjnO23Sap9Vg5aMJbzSq3qxK9aHb4MmaG5eORhOrbSo1Y97e2bOtzt1W5M1vBCOeIsfiw

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bbgdabid.r.bh.d.sendibt3.com/tr/cl/km1X4EqZpAhGsUVUT-qrCM5qqgiFC4HqrI4zNhz6J3lcEe949YmbhhdUcvR155JN90xLJyh8eKRDHg8RsKeZOBF0xz6jbvsV2A1w3FTSIvGLE69_2seE0YbOKvnFxvaY_Rn1PRHJgd8vOyEVmVqMJqk6Ji4rW21cbqnUopsYSrnp1I7JksApBVwNBy-zdNY9_C1YBQ8eLZGY44e3MuMNqLnL9ARtV5OVoaqSJEMFpUQXhKInePfWdy1YnoOhqFkW2csG4CF2-bE_211cbbwoZmu5YTFbl4NyD9K0l4COqn-lKZjCzjtSUOsXAaZ2Sj4Fem171wpker-XuaC9A0S93ykiFhqeoNOOXn3Glqu8En3KW0puu-G6RGi7OTqWwRO-bHcrUumAtt496xfJ_SdHOuDGOHYEZfE-Rj8_Li7xVv9ERJT2QbZ9XN0EW_ON9UG1hKqjHZRbmORJl5rcwTqDQ0fLPx3qoJ355_7vI90FwHpdiDOfIqC-teJbYM_XSNAxLWzxaOC9zehbjl7LZeo1VrUl05QaCcrP2iz33S3ccCNC6BfIcyrdUrYqDXvvOSrN0HzoEXIkzWpKhjwNT82Vbr_NV9BK9RtyuRaifB-l4on-svRGzk-4ap_QGefUrZ8E3VDpO9MkeZX73EV0Y9hUJzc6D6s85c0kztD2ozttHA5MPFbWuVYum63Jy9iiFQmgV9DlUxPUGiolUqVOJBYFMVJ0iC_wE9K-w2ih-Y5b_86QUBJwRBiiL8FNHsKO-Yow1AAfXmdgHmJxNWAC40TSoh4pOaMytr-mcPsu_kQgSLTWZf15DifUy8IA_J7welfLlm0lgsYB8hXnh-X8fb5NzmWOtivCShJT4re3Ew355lyRPUCNNWnQSRCo6Pesb09rG15z1T5HVXvjcQgrTgyBixWfJlnGK6GpiNmK3ODqcWDyyMu5IIdgg8PdRLlsrutoSI0j0zSTq2EJularQzyK8DdtxLmYCO1k7p9S4CulKr-2enmQa528temJO3UZZxs6C9506mic6UmVELO9RMfuBKaTvmxyr_YhSjKoQTKiNJ0Maso0gSFTCKPTAIrngel-jpSBgrE-dDYKiv7SmpWgJuMyX1DidrK9zQK5c2eB_oITP0t6kwcnXHS8utE4kVVZ8Y2b65UkM6IgrK--QXhUBweNVEJD8fyWNub493KtFFFvKuSQBtw03InWJZB80AVLjAsfDMxhj1kC1Qbbhip9nA6dlU3eSivt8UHhyqzmjPZjHTa3UYZPrR2iQ9iibJ0rYywGMkd3bVheDBbFP5UBh-CjoNr7Fy_c9rDvkn39OR5khgagYvKEhm6FsRwbqblWF1HbV9TI1IG9HQ6-AvepZwjnO23Sap9Vg5aMJbzSq3qxK9aHb4MmaG5eORhOrbSo1Y97e2bOtzt1W5M1vBCOeIsfiw
Sample260710-23pdfset2q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5300	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281984065681774"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{58891447-E66B-4D46-8B71-6291B7E2973F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 5884	1912	msedge.exe	80
PID 1912 wrote to memory of 5300	1912	msedge.exe	81
PID 1912 wrote to memory of 2808	1912	msedge.exe	82
PID 1912 wrote to memory of 2808	1912	msedge.exe	82
PID 1912 wrote to memory of 5252	1912	msedge.exe	84
PID 1912 wrote to memory of 5252	1912	msedge.exe	84
PID 1912 wrote to memory of 5252	1912	msedge.exe	84
PID 1912 wrote to memory of 744	1912	msedge.exe	83
PID 1912 wrote to memory of 5548	1912	msedge.exe	85
PID 1912 wrote to memory of 744	1912	msedge.exe	83
PID 1912 wrote to memory of 744	1912	msedge.exe	83
PID 1912 wrote to memory of 5548	1912	msedge.exe	85
PID 1912 wrote to memory of 5548	1912	msedge.exe	85
PID 1912 wrote to memory of 1204	1912	msedge.exe	88
PID 1912 wrote to memory of 1432	1912	msedge.exe	89
PID 1912 wrote to memory of 1204	1912	msedge.exe	88
PID 1912 wrote to memory of 1432	1912	msedge.exe	89
PID 1912 wrote to memory of 5000	1912	msedge.exe	91
PID 1912 wrote to memory of 3864	1912	msedge.exe	92
PID 3864 wrote to memory of 1388	3864	msedge.exe	93
PID 1912 wrote to memory of 1636	1912	msedge.exe	96
PID 1912 wrote to memory of 1636	1912	msedge.exe	96
PID 1912 wrote to memory of 1636	1912	msedge.exe	96
PID 1912 wrote to memory of 6080	1912	msedge.exe	97
PID 1912 wrote to memory of 6080	1912	msedge.exe	97
PID 1912 wrote to memory of 6080	1912	msedge.exe	97
PID 1912 wrote to memory of 1572	1912	msedge.exe	98
PID 1912 wrote to memory of 5124	1912	msedge.exe	99
PID 1912 wrote to memory of 2184	1912	msedge.exe	100
PID 1912 wrote to memory of 4592	1912	msedge.exe	101
PID 1912 wrote to memory of 4592	1912	msedge.exe	101
PID 1912 wrote to memory of 1656	1912	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bbgdabid.r.bh.d.sendibt3.com/tr/cl/km1X4EqZpAhGsUVUT-qrCM5qqgiFC4HqrI4zNhz6J3lcEe949YmbhhdUcvR155JN90xLJyh8eKRDHg8RsKeZOBF0xz6jbvsV2A1w3FTSIvGLE69_2seE0YbOKvnFxvaY_Rn1PRHJgd8vOyEVmVqMJqk6Ji4rW21cbqnUopsYSrnp1I7JksApBVwNBy-zdNY9_C1YBQ8eLZGY44e3MuMNqLnL9ARtV5OVoaqSJEMFpUQXhKInePfWdy1YnoOhqFkW2csG4CF2-bE_211cbbwoZmu5YTFbl4NyD9K0l4COqn-lKZjCzjtSUOsXAaZ2Sj4Fem171wpker-XuaC9A0S93ykiFhqeoNOOXn3Glqu8En3KW0puu-G6RGi7OTqWwRO-bHcrUumAtt496xfJ_SdHOuDGOHYEZfE-Rj8_Li7xVv9ERJT2QbZ9XN0EW_ON9UG1hKqjHZRbmORJl5rcwTqDQ0fLPx3qoJ355_7vI90FwHpdiDOfIqC-teJbYM_XSNAxLWzxaOC9zehbjl7LZeo1VrUl05QaCcrP2iz33S3ccCNC6BfIcyrdUrYqDXvvOSrN0HzoEXIkzWpKhjwNT82Vbr_NV9BK9RtyuRaifB-l4on-svRGzk-4ap_QGefUrZ8E3VDpO9MkeZX73EV0Y9hUJzc6D6s85c0kztD2ozttHA5MPFbWuVYum63Jy9iiFQmgV9DlUxPUGiolUqVOJBYFMVJ0iC_wE9K-w2ih-Y5b_86QUBJwRBiiL8FNHsKO-Yow1AAfXmdgHmJxNWAC40TSoh4pOaMytr-mcPsu_kQgSLTWZf15DifUy8IA_J7welfLlm0lgsYB8hXnh-X8fb5NzmWOtivCShJT4re3Ew355lyRPUCNNWnQSRCo6Pesb09rG15z1T5HVXvjcQgrTgyBixWfJlnGK6GpiNmK3ODqcWDyyMu5IIdgg8PdRLlsrutoSI0j0zSTq2EJularQzyK8DdtxLmYCO1k7p9S4CulKr-2enmQa528temJO3UZZxs6C9506mic6UmVELO9RMfuBKaTvmxyr_YhSjKoQTKiNJ0Maso0gSFTCKPTAIrngel-jpSBgrE-dDYKiv7SmpWgJuMyX1DidrK9zQK5c2eB_oITP0t6kwcnXHS8utE4kVVZ8Y2b65UkM6IgrK--QXhUBweNVEJD8fyWNub493KtFFFvKuSQBtw03InWJZB80AVLjAsfDMxhj1kC1Qbbhip9nA6dlU3eSivt8UHhyqzmjPZjHTa3UYZPrR2iQ9iibJ0rYywGMkd3bVheDBbFP5UBh-CjoNr7Fy_c9rDvkn39OR5khgagYvKEhm6FsRwbqblWF1HbV9TI1IG9HQ6-AvepZwjnO23Sap9Vg5aMJbzSq3qxK9aHb4MmaG5eORhOrbSo1Y97e2bOtzt1W5M1vBCOeIsfiw
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ff9e2a4c188,0x7ff9e2a4c194,0x7ff9e2a4c1a0
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7841668833741630340,12736464630564728103,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,13338571539266872776,10168052515461276045,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,5149175853686328979,12852112621049033419,262144 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,13250127003835166006,13477961042308236299,2097152 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,16119335088994454745,137172137292752761,2097152 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,16713056481740981066,16733669228342831027,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16261218756338349512,11586180946757479657,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,18242074050402641729,15503502455699449410,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,18242074050402641729,15503502455699449410,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,677789810798813518,10014120956084620127,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6180,i,3420914435019990995,14222327246726811494,2097152 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4276,i,8351724786039994243,12667077161789774427,2097152 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,15908761337145483911,55939989879840791,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,16634502349065589908,2053284979151166053,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,14469907369865200183,11248423740539189704,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5538665986146711496,11119620564040097012,524288 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,13891213346007807194,17093772090173072533,262144 --field-trial-handle=2200,i,11567408740195284914,8490312871058927977,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2ab6a1dff6a2de6a6e801f2a1891feedd36eaee2b33a88805ce137a449e5926c
MD5 1ed7a7a75935522ecd33b934319c56b0
SHA1 ad097bc674616a88844f6d92868ab2ced451ba2f
SHA512 d39d2584738562db6e6a9f2a2d8466b215abec15f58836be152b55fc8f3df66acfd01fd56eed47a3ef12ec662a8523f04453ecc6b4992bfdc418cf8ae15d2073
TLSH
T1A0E02BBACD619C2724FD0B1AB0551786EA6023671780945F3B3D450C8FF173A02C582C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2435435db2bf7b3d9d32dae52d6e569fed80b44f2caa35a444817318ae178ab5
MD5 d832e6eeabfb75247dba3b7870b44262
SHA1 d9417050e2c1597d09b955fae363bfff9e938f35
SHA512 999ba074336841c73abad0010ab3de0c1718a8f41974312efe5721761ae5e89bce0d5450c444c7dbb2dd00e8b5b501dcfb194e815df36851e9527ff26a513d8d
TLSH
T18B31CEF783F4856E8A1196F0EA18BE2FCE1D0511436C3DAA89E0AF1793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d1697cf97c2e4d24e150cd86e853912f25578594a39e13958bb0637fd88f5ae4
MD5 9b5018d1dc3241bec1516ba82e93b033
SHA1 a045092f0f76c9b950fa7a7d01c745d171202e97
SHA512 ad4c201801b2865f87b2a8ef80376d9db0a9510e554b27d42260de3220e9576614dc05cbfab3f3297236ab30c5818478819f171f92050881d684ada262b79c8d
SSDEEP 192:sxZARCyMqZjK1Ml8UQ0FV/fVXs0eE0CXUDzodpb3/W6+WNaAWXY0dzIJpYIg5k5J:sxZAzqCV/fNs0h0LYr/b4X5WGyj
TLSH
T1686208166A34597BDCDBD319F6447F93D6F9052392805E44AAFC8A0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e2de47fab62bc0f4f1c9cb4b741187e5de203ab049cd1ab6329a178eb927462b
MD5 682f30bf122d9e4e536be64804a059a6
SHA1 02778ada99d1bf26215117314f049a27df7fc6d2
SHA512 4f6fffbe9260dd3a6f775abdccae24704f33c7c0eb1a3e124f575615c99aaab0a092b4ba98d8e43f02db7441d8865257a39a83ffd93a82a7c6ddcd5f08c3404d
SSDEEP 192:sxZARCyMqZjK1Ml8MFV/fVXs0eE0CXUDzodpb3/W6+WNaD5/Y0deI6pYIg5k5J:sxZAzdV/fNs0h0LYr/b8/5yGyj
TLSH
T18A6209166A34597B9CDBD309F644BF93D7F9152392805E44AAFC8A0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 911b8bcb70f6af6f3c085b1d1a6d0352a6ee32e599f4b67c257ae8b8eee5470d
MD5 c52d42bd31081274de1d5bd5fb020966
SHA1 20281c4317b19d2d5c6165083775b1a1b04c5103
SHA512 75cd2c3fb1e70a3af51b4e46d11496075d10f5c9d771a99c5a600b9d53b259c0ee64ba7fd8133157e66c2d71de0fe6bf5157ce1216fba2243c8076bc4827213c
SSDEEP 192:sxZARCyMqZjK1Ml8MFV/fVXs8gkxE0CXUuzodpW/W6+WNGY0d3I6pYIgj5J:sxZABdV/fNs8gk60L1W/bG5xGjj
TLSH
T1346208066A345937CCCBD309FA457F93D7F9152392905E44AAFC8A1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f026a2146ff4a034ad27410270875145bd4cd61ddd777060b9ef4da48ad9031b
MD5 cc0ae8e485694c5d77c4741ff03dabf7
SHA1 79f6567bbe4dd4c883bd00e584164b5d6daedd40
SHA512 540ac18b52dd7406a8012f24a94c2625e9e232b667810c0193aadaa6143e082cf07ad33012c82a353117d111de0a765197fa8fee9e0324f8c39acf586ecd11c4
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72zK:AFBHhTofhno2mB21q3Llbfe3sLDdeEpV
TLSH
T17CB27F56717B12123C3E290CA7A59B370E8272A33458A96F7BB804B64E67E115DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 20e2f4f004d7a628c99145ead3525232620152169030b5077780a3dd57621dc9
MD5 f39d4d6850c24c27fb3070e499a42b29
SHA1 9f9d16ebb9b7cc90a4b7259185787580c28e6e7d
SHA512 b1cd4063f8b46db3f33292cfbf2970ece0de51824954a7960ababf3f4e36917ddd25099aee4328218abfdb81214378f4e3f059be2b4b757f13b7ee822b3dfef8
SSDEEP 384:nO5iF1tNn/s3n9SN8N+8TUNTUlIRQyKqe7jGfb7oodhLCiLxDOObjI9G6w75xnHC:OQF1j+9slwgu7+o0B29M5g
TLSH
T184F2D4F298D78977E89E4B97A37E2E0699FCC163B5485984B7C85D4CCC861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 85808efbc9abc143d724988d32226c57daa2062cb45bdf62685cf9d5d7cd4816
MD5 92fc02310362121c3e00f75179aa0aad
SHA1 79b6554d13e972a5807930afe5b967445b13b005
SHA512 ef4d73ad7271e555febcfb3fe2b457361673bceffb9c596e25c3d77b66b42ad923b8f2a5bd12c0ce8e0efb8d45cb4e4f04a74010b14806f7f950c16910055f5c
SSDEEP 384:n5BaiF9CcmyWCk38N+8TUNTUlIRzyKVl7jGfb7oodhLCiYxDhkP+lFYS/VNHy/7B:nRFccpk3lwgPf+oRBhkoFYS/O
TLSH
T198C24A32E8A4CEA7FCE64F99F24A7A43DDE04163868C9ED4DAC91D5D00DB19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2598f2eef4f5ea9ec605db6cfe0391fe3faed232252efd6b88c18c7c28a39409
MD5 96baa00536f471c017e6b4a6b3039e39
SHA1 1af117fb532573e7b1cda875a8f99608806377e4
SHA512 cc00128828ea650ede94fb80f8924b11722b88adc92510af597541a0cf8a7d93e8da4de7bf0eea0095cff4c88dd772b40d342df8c91f19ec327108fe382d1da4
SSDEEP 384:nOaiF1tNn/s3n9Sg8N+8TUNTUlIRQyKql7jGfb7oodhLCiYxDOObjI9G6w75xnHC:ORF1j+9rlwgu4+oRB29M5g
TLSH
T101D24B32E854CEA7EDE64FD9B34A3A17DEE04263868C5ED4DAC85E5D01DB19C430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3538f2367483c583b0e7b772d9a29f5fba3d3cab01bfaf3dc8bcdf1d07c49a18
MD5 0f210e4626d077237863e0d56e89a278
SHA1 5e251697b2829c6df0762bc5c1930ba788f9ac27
SHA512 c6629820ef8989719f63a1a97f4141b9c6cabb1c0b57fcd4aea62c58b637512c27db0e237b83fdad7968fc240fde467b37333d67fea4a67acc8b7044066008ed
SSDEEP 384:n5HiF9CcmyWCs38N28TUNTUlIxBydvYoRajGfb7oodhL4jhkP+lFYS/VNHy/7IgS:cFccps3VwgBmxo/jhkoFYS/P
TLSH
T1C8B25B32ECA8CEB7FDE64F99E74E7A06DEE00163859859D4DAC80D5D00DB19D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9f2b08137a44fd5f1b7d64dec84ca98ccaa509eeb8f6cb312e6d2cc6538edfd5
MD5 d91abc6a02545875d45527143713356f
SHA1 c04b10ae81c9f037dcd338774227e796f021ace7
SHA512 65ce5b3bffc9773d6f741ec932ed53d4b2f4ae269008d44f41dfa205ab72971a839fc8b09d7046469ed941ec4073bbba9d32f55a32f68114dacf5c7e9bb1656a
SSDEEP 384:n5AaiF9CcmyWCs38Ny8TUNTUlIxBydO344jGfb7oodhLCiExDhkP+lFYS/VNHy/g:aRFccps31wgbIroDBhkoFYS/P
TLSH
T127C25B32E8A8CEABFCD64FD5E24A7A06DDE04163868C9AD4DAC81D5D00DB19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5000-196-0x000001F900000000-0x000001F901000000-memory.dmp

Download