hxxp://exo-api[.]tf

Analysis

user interaction
yes
max time kernel
299s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://exo-api.tf
Sample260731-vgkd2syses

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1556	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299908465533231"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{64DD3627-3585-4907-829A-F58C847D0DD4}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{1200CC22-393C-4924-B475-BAA1245FC4B5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5180	msedge.exe
5180	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 2032	6084	msedge.exe	79
PID 6084 wrote to memory of 4788	6084	msedge.exe	80
PID 6084 wrote to memory of 4788	6084	msedge.exe	80
PID 6084 wrote to memory of 4788	6084	msedge.exe	80
PID 6084 wrote to memory of 1556	6084	msedge.exe	81
PID 6084 wrote to memory of 3804	6084	msedge.exe	82
PID 6084 wrote to memory of 3804	6084	msedge.exe	82
PID 6084 wrote to memory of 3996	6084	msedge.exe	84
PID 6084 wrote to memory of 5336	6084	msedge.exe	85
PID 6084 wrote to memory of 3996	6084	msedge.exe	84
PID 6084 wrote to memory of 3996	6084	msedge.exe	84
PID 6084 wrote to memory of 5336	6084	msedge.exe	85
PID 6084 wrote to memory of 5336	6084	msedge.exe	85
PID 6084 wrote to memory of 5364	6084	msedge.exe	87
PID 6084 wrote to memory of 5364	6084	msedge.exe	87
PID 6084 wrote to memory of 5364	6084	msedge.exe	87
PID 6084 wrote to memory of 5780	6084	msedge.exe	88
PID 6084 wrote to memory of 5780	6084	msedge.exe	88
PID 6084 wrote to memory of 5780	6084	msedge.exe	88
PID 6084 wrote to memory of 5344	6084	msedge.exe	89
PID 6084 wrote to memory of 5344	6084	msedge.exe	89
PID 6084 wrote to memory of 5344	6084	msedge.exe	89
PID 6084 wrote to memory of 3600	6084	msedge.exe	90
PID 6084 wrote to memory of 3600	6084	msedge.exe	90
PID 6084 wrote to memory of 3600	6084	msedge.exe	90
PID 6084 wrote to memory of 2464	6084	msedge.exe	91
PID 6084 wrote to memory of 2464	6084	msedge.exe	91
PID 6084 wrote to memory of 2464	6084	msedge.exe	91
PID 6084 wrote to memory of 3360	6084	msedge.exe	92
PID 6084 wrote to memory of 3360	6084	msedge.exe	92
PID 6084 wrote to memory of 5072	6084	msedge.exe	93
PID 6084 wrote to memory of 5072	6084	msedge.exe	93
PID 6084 wrote to memory of 4440	6084	msedge.exe	95
PID 6084 wrote to memory of 5616	6084	msedge.exe	96
PID 5616 wrote to memory of 2560	5616	msedge.exe	97
PID 6084 wrote to memory of 2492	6084	msedge.exe	100
PID 6084 wrote to memory of 2492	6084	msedge.exe	100
PID 6084 wrote to memory of 2492	6084	msedge.exe	100
PID 6084 wrote to memory of 5356	6084	msedge.exe	101
PID 6084 wrote to memory of 5356	6084	msedge.exe	101
PID 6084 wrote to memory of 5356	6084	msedge.exe	101
PID 6084 wrote to memory of 5484	6084	msedge.exe	102
PID 6084 wrote to memory of 3996	6084	msedge.exe	103
PID 6084 wrote to memory of 5816	6084	msedge.exe	104
PID 6084 wrote to memory of 4280	6084	msedge.exe	105
PID 6084 wrote to memory of 4280	6084	msedge.exe	105
PID 6084 wrote to memory of 4700	6084	msedge.exe	107
PID 6084 wrote to memory of 4700	6084	msedge.exe	107
PID 6084 wrote to memory of 4700	6084	msedge.exe	107
PID 6084 wrote to memory of 3276	6084	msedge.exe	108
PID 6084 wrote to memory of 3276	6084	msedge.exe	108
PID 6084 wrote to memory of 3276	6084	msedge.exe	108
PID 6084 wrote to memory of 4232	6084	msedge.exe	109
PID 6084 wrote to memory of 4232	6084	msedge.exe	109
PID 6084 wrote to memory of 4232	6084	msedge.exe	109
PID 6084 wrote to memory of 5160	6084	msedge.exe	110
PID 6084 wrote to memory of 5160	6084	msedge.exe	110
PID 6084 wrote to memory of 5160	6084	msedge.exe	110
PID 6084 wrote to memory of 2796	6084	msedge.exe	111
PID 6084 wrote to memory of 2796	6084	msedge.exe	111
PID 6084 wrote to memory of 2796	6084	msedge.exe	111
PID 6084 wrote to memory of 5180	6084	msedge.exe	112
PID 6084 wrote to memory of 2252	6084	msedge.exe	113
PID 6084 wrote to memory of 2252	6084	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://exo-api.tf
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9eabbc188,0x7ff9eabbc194,0x7ff9eabbc1a0
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,12057117804526562226,16157277598350252436,262144 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,14768670766364155613,9098422060156876991,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,17467288908265339446,3796259073517525073,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4634940077999434799,13908500155221217832,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15403138575243576166,4782747338509498070,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,5911548250495175780,12076026339488312441,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3436,i,4118943046709538688,11219840769529331668,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,1322024573176288057,7948045113542765451,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5280,i,1493507200993328630,15232457529760830838,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5052,i,16084503707453792383,319681042508802094,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,5962752891473962843,6986744718717420036,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,10239643794544820438,6528173707683946457,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,13508722410463983602,7553173291175327203,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,13508722410463983602,7553173291175327203,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7188802355728730017,6507455722672378562,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6956,i,7848666249632210243,2014642551844783119,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5276,i,14082837881628380826,259390577442563159,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7521796466301545444,2935561036974466391,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5755767029954686293,15017159286032062918,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,4181932302499576188,4289973858424016018,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,5087472392920503563,7136184705237709270,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7068,i,12006283895119615764,12011392573126114851,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5924,i,7901038399494924726,3333417923056616657,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7376,i,5421989414229471249,3009665808588098073,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7388,i,4061690203936331329,18216348009030136278,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7316,i,9191630438020341190,1415769385898953241,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7704,i,2612073120737157873,8814885143808036389,262144 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7076,i,4702924998533048877,11000116288224637714,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7308,i,12283633248757316560,16794437039674256720,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6472,i,12039018580339195137,11402511785365547467,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7392,i,9888110436465996745,13621085120017933468,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7472,i,9791992773961861239,3199912426686702465,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,8673279958335806428,9303170664163496502,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:12
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,16421440884082360961,3607134139785533710,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5712,i,15026521406887534977,4444517348677217955,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5740,i,11225055108263132355,2430613898355602659,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5312,i,1902256797115902572,11274078407954043260,2097152 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16071626947363813797,1611936281546901426,524288 --field-trial-handle=1976,i,11946263072010263100,17700746012509103846,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
  2⤵
  PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7a91ec963b25a85250b594413bc5c31de1e1bb9a927bb62f0a017a283a5ba0e4
MD5 a82c345c6070c8ac6d847ee43f2f4a19
SHA1 a0dcff37b66d8ebd7ab5e5caea255975d22bf8af
SHA512 ed2f53fab898a7f70f89e0909e45172bd20352a14951801e4622006295e73844554f874276d79ca24bf96e38a4036c6f902a90d5407fb6e14ae66ac197c38c75
TLSH
T15CE026AD06DCC35EA690688B5168634DC280361A97C87E4F5B2188A4B482AC0E387B96
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4024eca434b751574f888de80c6f0ad7356357a7b071bdd927197ff56062f9df
MD5 ae87c7781047e5ea5046a22c749f54ad
SHA1 0cd59dc5321ada8154e0046c1fe69361d8bc0524
SHA512 69e47564b708fef05a92911f1729d58dfab57394e6b56b60cae00d249d5635999095171eb133b52830ae1e384e685363f52bbf779a56ef3ca9ee0025c9e6bc36
TLSH
T18EE02BE5C872DC3B18FE0F1974500A02D701532B2A40495F373D920DCFB463A0B9691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 2.2MB
SHA256 61f19bce37c4d9caea4399bd388f1c0278266aad631a2ad0e2292b695cf956b3
MD5 1882a3be56455080d2106ba8784f11c2
SHA1 aada342a890edade7ee6d8642d02c52e97171595
SHA512 ff25480c075d1c8309c201ed7186ca4606899827fbb27eb47e39fc573bebb00145935aec8f242b5e835cf06c1858f2923045d968bccb2a60485f7660951d06fc
SSDEEP 49152:BIUJ+y6LWc7pGEC9RwDilJZIp+Nudl6p4ojyklPi4n:BIUJ+y6LzC9KGDGjdl2jLiI
TLSH
T1FDB533D035911478DE8158BD1CBAA222851F6DEDA6136C8D38EFE489CF6C7F6781870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 332ced6e2dcfa98794a541793aa9f027ebe73a4544ce289205fcf1e90f539e47
MD5 01ce65ae7a88e195cfc44315555af3b0
SHA1 f6ca65ab6b90a9c63c74f16ea51c82e7a7fcd971
SHA512 6c0adf87ca74a6043b38a0329f3d9732120e3c04e78f985e57f8e8a311b7d23c57fe6dc67d3492844a7d1aece8f83d4f3b15352bee44a3ec7ca8b118cac19f2c
SSDEEP 96:XxU5iTt4JOqdxCPQlyWm/sX0pClndpKF/v23l:XeA4oqdIPQIF/sEOndI2V
TLSH
T125A17402E4D312A5FF60593277E28B9975A176792C432FC73ECC44B1A71BBEE8113490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 13092ebe4e9c3c962aed64bcb439d6065fad831402fe8adc631b3137efaab6b2
MD5 48d713a2869639591c1c51d9bc7af175
SHA1 9dec493e8b5aefefb49e67b28da4c2a73d4ed84a
SHA512 ce13337e2b681638681df85c9618d1f1d11efd43f4a04330cd8392af723253905868902e15d8c39d7ee6e9f4b7651229be19716a83675d62a0ffa4a5230892be
TLSH
T17551EC07B9439265FF024E33B3F38B54B16247B23D872E973EC584B5672BB2D85A0414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d7dbb089a4fe70423d83b237c63271182961a325cd7463ec0cedfaca16164bae
MD5 0c830096e0cc455cdb55a7bb9313af72
SHA1 7b093a949de03777fb9d3ea809a64059ae3b2a50
SHA512 2fc32b2ca433b1d055f10311afd934a5f1e9b0b0a8e1a47328b94a3bde7eb076f498d582fe555d3db1ac41ae711f324880ed12210e75a42fbc0b37ecaf5e4221
TLSH
T17A510F07B9435165FF024E73B7F3CB54B16247763C872D973AC484B1672BB2D85A0004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d4981c2ccfcb3ce811a2cba4425bd6f720a5d339acb7673ba8e08de3f6c3ba28
MD5 208250d569e5951309a2344db2a5fc86
SHA1 49676b4cd066820f1aeed21e13f1edaa4c0b07b0
SHA512 aad5e669328e494f6674f1c13b93e5e827541dac8b8e656bed836a258d66c041d8f562eec9eef6c36d90656f93ce1b70b3b6b80774a54ae35cff40afa0c18919
TLSH
T1BE51ED17B9425165FF024E33B7F3CB54B26247763D872E973EC484B56B2BB2D81A0404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 53c594aa9c5c7d56ecc74bf924e963c1cb3ca480dd1c6a522ec7226369defa50
MD5 a2e90a09f3e79449e9437c6e9fe518c1
SHA1 95864672c36a6b1a086357f58483566668a7ebae
SHA512 0715da766be9d918d4ff1ad6e586b6964af27675fa89d445d3aa1f94397e3ae6b78a5a07dade3f3779a6284a6dc4e2c82db936f687aee42e1dfdfc7140a5545d
TLSH
T1E651DE07B9539665FF024E33B7F38B54B16247763D872E973AC485B5672BB2D85A0004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5879fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5879fd.TMP
Size 2KB
SHA256 4f5bea511f97f7a04fb63332adbf7a64adf7d44026b090dfa3b1e1e02ebfc554
MD5 a0d89533ad00b29264d79aabdd0a7fde
SHA1 fecf0715dcee816f8cdb1d5b8246875431f87cab
SHA512 df0557c0da8e4eda2db1f61f9a7dc536d80f689041c1a12dbd1d7534eac17a3b3c8993b956903b3c456ee84507314dfdedb1bf3e46b584354582ad2fb79a4d33
TLSH
T13C4110173A42A564FF520E33B3F3CB54B66247753D872D9736D488B66B27B3E85A0408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 2ba3c7571de0d58845c88c152256346b07584d6008580e997ec182330eafaf54
MD5 735e77a6e49e8793825bb4ec416a5598
SHA1 e7d91e6a28c704f0765bae930e0c10e2e2dfd604
SHA512 35fc333bb3f4fce968a376376c52dc84333e80a7b5cf49d6923817fb090494f3e32cfaecf36a995729440127ea649ac8ad21690754eada0cb1f0fa701397562c
SSDEEP 192:D11pbrO1kfgfl91GGaaij6jJDAScylqnu9Icy9uTcecALkX78wGXPH:D11pbrO1kfgfl91GGaaiGjJDAScylqnU
TLSH
T1EA02ABF7C3E4826DD85152F4AB146E2FCF29095843283C7A89E9AF5F93E2470E14265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 1c55d276ddb23fda40d8733d56219de7f950d6ce12b8cc4bf0b26449736ae0b6
MD5 98ebcac711544aa6e35e197a1851d790
SHA1 b272519a09feab1caa53434153a0f831957e73c4
SHA512 ed815d4f305d1f2da999565f374c1c92511f522e15b6c1982ea0afffee3a88249ff3fcc49210e29a752ae3cb7458dee0a2af8f7951ecfc664e44057d9965ea58
SSDEEP 384:D11pbrO1kfgfl91Guf5P71JRbbeYnekOfeTU/MaaiGjJDAScylqnu9IcyPTcecAr:pYIMBRmdT+b+
TLSH
T171B257BB83E4826ECD1156F8AB146E2FCF190524531C3879C9E5BE0BE3E2462E11675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ed7517b1217749cf17f7d6a4892afb8082877a898beb43545d3ace0d2492def9
MD5 b76394796972916f0bc6f9580435d377
SHA1 433af50314e8c2de3759fccebab4bd7d2d06f3eb
SHA512 ce963e07b06746a4b2f09a7afbdc0ee2cbe304cd642f7c929758908ab4f3b064cdb7b004ed0e8c4bd4b406b931addc9ebacb2045571a65d475c9e152e20be5fc
SSDEEP 192:D11pbrO1kfgflFaaij6jJvDUYPScpcylLqnu9FTcbc4SkP2:D11pbrO1kfgflFaaiGjJvDUYPScpcyl/
TLSH
T1BCF18AF7C3E4826D986152F4AB146E2FCF29095843283CBA89E5AF5F93E1470E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 de6f74616c914d38812f9ce66f80926045d643ed265fcb0a26d39c0b0f4c46d3
MD5 2696c6a84f98b866eead5890737d3ed2
SHA1 835dcdb57ba9ceab1a23d1288f8d2303ef218f73
SHA512 5364904fbb720178314fe8a0c5fa8dfd9213e066c99e5aa138920553ca6bf9264adc648e436696341dffa9616226bf04448908baa6c4141931d9a87b0967885a
SSDEEP 384:sxZa+Aqsg/fus5HV7F0t24/b2x/5SdJYf:sbnsg/fPHId/bO5nf
TLSH
T1A172C656A5745977ECDBD21AB944BB53D2F92563E2C04E44AAFC8E0C00E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 752b4c7340d08c83e65d3b2ca8a1718b47e969ef510433f8ac3f975cb9e8d95d
MD5 20cce27ab95eb37b00040ac337143a80
SHA1 6eeb0ab481935e8f0fc2dee92baae67932f92006
SHA512 6aa599e7737e1ff2c1b0ee7f25160d1bbb28f829bd1c8dca5c4069e339cf4a112e989b0256836b44940ed21818089c3618b24111d90e91bf8cddb30e740e9aa9
SSDEEP 192:sxZtRcyMqZjK1Ml8MFg/fusSXKQ7PD0WzodpPqqjm/W6+WNjjly/Y0Zvk58IgjJg:sxZtddg/fusSXV7r0tTm/bw/5NjJYf
TLSH
T1EF62E8166A745977DCDBD20AFA457B53D2F91563E2844E04EAFC8A0C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 75988f22cc332d3f787ca015e8c162ed1888d8179cdf0695d0570e25cc74e092
MD5 e467d890d114507f88d4d103fa5db090
SHA1 7c26657ba257e8acfbac5aa39248a17b33e5b900
SHA512 7cc61fa195ababc4c634af06a6d7ca0dbfd3d895499bbf206e8778d40daa1d6bce39ebe34cd0cb311b9aa7cdd06fd26ea6c77e8474064df6dff0c0a4362599b2
SSDEEP 192:sxZa+RcyMvZjK1Ml8MFg/fus5HKQ7PP0WzodpPqrjm/W6+WNjJafEly/Y0ZbkH8k:sxZa+Adg/fus5HV7n0tkm/bu7/5/dJYf
TLSH
T1D572E8166A745977DCDBD21AFA44BB53D2F91563E2805E44EAFC8A0C04E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ca87ea2fbd2278e2131d778f16eee4fc6ab0691547e3f588c70e1a4aa084fab5
MD5 4d9ee3ceed80791fe227154e85c52cbd
SHA1 d0cf91827768586f51c209151f325ba1b9a359d7
SHA512 024d3fc81b801d21f387aef21f709af00ea403d57fdd008d22b980407af348be6d51364e5950597c9d3cd1c9ab25917173d38c35014452f8f1372d50a8a7e018
SSDEEP 192:sxZtRcyMvZjK1Ml8MFg/fus5XKQ7Pw0WzodpPqwjm/W6+WNjjly/Y0Zvk58Ig5LK:sxZtAdg/fus5XV7Y0txm/bw/5NdJYf
TLSH
T12872E8166A745977DCDBD20AFA45BB53D2F91563E2805E44EAFC8A0C04E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
MD5 d51792b63ed3ba1de7e48851e2ecbcb9
SHA1 441158678a38e65a5837887ae322829c74aa752d
SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
TLSH
T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 94b7e5e3e638ad7afe895beaf96e12ee2c1a1ec6429a141120a18d2b74120dee
MD5 369117659f8d476cd4f90e47e1ae8a01
SHA1 745e0dd0836106c520e6502e62d814381ab75805
SHA512 f8939d33506708ce6735b457b63d7189959d5f9b1afead796b4c8e19cf6119f3088df436eaa1290b04538a2e16b3f785c2029d9b7f082aa12838174bde6cad3e
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlVERt:ctGj+BCNC5qFVpKxV4t
TLSH
T173B27A1632BA02023C3E791D879597375A42F2A33018E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b7345c74a28ac551991a0465d13d80c55065f34945e575b6ead3f5195c96b0d2
MD5 505861c6567b0d845afcb3159e333671
SHA1 9cceb7e80192752228c42d5386fc4f892e438620
SHA512 23c9cab30c99381f643ec108dbbf7d9514e33026d3f0ab41962dc6c2b23ab04fe71807385e29802cb6ac53682cfe57703377d4a18b20e44b46ef096f2944b0f7
SSDEEP 768:MFccps3nwg42rzOoMrnG9LHbWSooI8p0Qg:Ms3a2szG1HKJoI8p0Z
TLSH
T101B25C36EC98CAB7FDEB4FA9E74B7603DDE0516385889AD4DAD85D0C008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 53326bda525a5a27bf2b5b9a90c9dff921dc27a822aaf24c6aaaf5be1617143e
MD5 8ee56a8a98fd8252160c942185696b58
SHA1 03bd3c3bd5c41d250eedbd3cf6b4c2d4329b385a
SHA512 6557a2af876c1686ebdc317649ba56cf17cebbecb9c239f323c1d53aac056d8bba4128ab75a6ccd1e024fe4706d2b800b8f52e20c782d395e11b15344cc7966d
SSDEEP 384:ngiFiZcIP38NH8TUNTUlIRTrk6SRK1zCfbLoMrnJNPcN9LHbVXTdoCOObjI9G6wU:7FQP3owgu3YOoMrnG9LHb1TdoC29Mg
TLSH
T198F2A2F298D78976E89E4B97A77D2D0299FCC163B5885684B3C95D0CCC860BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1c72c6625f70cf0efb954a2462a661c2cf4dd8f2f55ca82f9c294e6b7b8fe027
MD5 1c1192544e3a903e7943ba4c8ccf5115
SHA1 d57e85a3060eb3a334c580a6d5abf9b79bf09598
SHA512 d0b052ed3d26a953d48f7b97fecc18919e05d38a595973c54ee64bed545464e38c66cb44d54cf308985df730c98a84257a0d4fb2491932361fd6a8701ceb328f
SSDEEP 768:9Fccps34wg4h9dOoMrnG9LHb1oRoCI8p0Qg:ps3FuzG1HCGCI8p0Z
TLSH
T165C24C32E899C9ABFDD64FA9E74A7503DDE09263868C9AD4D6DC1E0C008B19D570F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 02e3e5e83bd00c97c142bd11fb697cf5a8344866ae657d4e51c475ab7e1258fa
MD5 870bd970bdb16e9c46eeb6b17aa3622f
SHA1 b60d4506f08468c10352a9d6cc596deed0dffaa8
SHA512 0e1e0cada24e9627e40a08624b20b5748b7ef1ab4c165eb57d3c9ef75aba84e11f4a55fc3cc0a89affb679edf7bdfd27d19d3426f68d3e0c081ad45c6a580fdd
SSDEEP 384:nriFiZcIk38NH8TUNTUlIRGrk68IK1zCfbLoMrnJNPcN9LHbVXoRoCOObjI9G6wU:GFQk3owgzQYOoMrnG9LHb1oRoC29Mg
TLSH
T179D25C32ECA8CAA7FDDB9EA6E74A3513DDF04163D68C9AC8D5D95E0C009719D430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 df6c3b2eacd62e95b6ad4d8503074757974ace431d04361db82cc7a6137dc3ad
MD5 d660c3363404957277de6d6080139e28
SHA1 cf51c2ee40272f0a72c0a36c0a2b38d0eb7b8dc3
SHA512 f1e5c140f934ff438afc244c0ac86ce07128041586e9dee95774cfd756782e61d213ed71c3e4c567c1e8a4d5d4f6334de1e9cf132b044f60396f734265ce2d47
SSDEEP 384:nqiFiZcIk38NH8TUNTUlIRTrk6OIK1zCfbLoMrnJNPcN9LHbVXoRoCOObjI9G6wU:hFQk3owguKYOoMrnG9LHb1oRoC29Mg
TLSH
T114D25C32ECA8CAA7FDDB4EA6E74A3613DDF04163D68C9AC8D5D95E0C00971AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a857966b4270e457d989d0fb816f8508e49ab5cd3a555f960b69331d90a5c49
MD5 9810565af10f8d5eacb2c735b6e3e537
SHA1 2888540b10e4e6863a4a20872fb8901a4d75e45d
SHA512 a8ee6619a915334c499963222fdacaa4abfbbf9206c77c67b8e75f7aeca8ffe9433afa89a7136b8a036cb25e1475aa3587876bf3b6447f132c77af0ecbf0e802
TLSH
T122E00401530C407DD13503301043773037D1C03051F10315471105543CD33001F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f041981e6bf9c02e266f98b888d10344a014575d9b16619100e13c343ba9f576
MD5 9b44dbf885f23819f0ed275f754bd17b
SHA1 7f83022bef4f9ccccd92f93e534d905858726ddb
SHA512 90464ff26eda000b2463b0eb6741a0ce4b2a1fc1ac4d2f4baf8a71a041ed0873e8ca7e24d5b59150e19f64964dd318162cb08c3d3c6bdc4fd168e58ce455eca5
TLSH
T161E00201D208406FD135033010C776343BF1802053B30215462205683CA33002B20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9f0168e7efe8f8bdb42c266ef6fb0db8808531252f9f3ddb5bb9b11d7a11a608
MD5 0e4a290b6a0be9da760ca0939381d9e2
SHA1 ee3e47e3096711ea9f25cef57ef9baed835f4a6a
SHA512 ba0431d97a6440baa582bf6993f52acd5fdc5c19ec016808646c663180cf81fa85373ba8345fbb945ad6ea0c4bdb78cbef9602dcf55f70fdc3d35820ac55aabc
TLSH
T157E00102D608806ED135033464977B343AE2806452B202154B7605583CB33013B60BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591d23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591d23.TMP
Size 392B
SHA256 c097aa84ecdadfb1f6983ab0920ec049315a9412b5a286bc9969662b1f5aaf85
MD5 6f8b90c21ac8723a12a951b3449a5e53
SHA1 02340b48ee64a4688f9fd13005adf1deae8ad214
SHA512 9eebc6630354e2afb28c5e995573ed7b2da72ab12cb3660ff424f990a3e96e6c05996e32e134ec697af0c90a484749589a19f0bc9823b77a04214386a3de1429
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4440-241-0x000002B0EB1D0000-0x000002B0EC1D0000-memory.dmp

Download