hxxps://ghosthub[.]cc

Analysis

user interaction
yes
max time kernel
189s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ghosthub.cc
Sample260807-v19s2stses

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4840	AutoIt3.exe
2548	AutoIt3.exe
1992	AutoIt3.exe
5964	AutoIt3.exe
3344	AutoIt3.exe
5392	AutoIt3.exe
4260	AutoIt3.exe
5412	AutoIt3.exe
5024	AutoIt3.exe
6032	AutoIt3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
66	href.li
67	href.li
69	href.li

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 1992	4840	AutoIt3.exe	145
PID 2548 set thread context of 5964	2548	AutoIt3.exe	146
PID 3344 set thread context of 4260	3344	AutoIt3.exe	154
PID 5392 set thread context of 5412	5392	AutoIt3.exe	156
PID 5024 set thread context of 6032	5024	AutoIt3.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305973290236007"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{5C339097-78BC-4FA3-87D9-FCADE658452B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{46401B89-AA25-490C-AF45-DE621149F1CA}	AutoIt3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{06947840-902E-4D9F-86EA-5981604C323A}	AutoIt3.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F867F2DE-706B-433E-B683-63252547A66A}	AutoIt3.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{9074B0CF-78F7-482F-8AF8-7561EE67D806}	AutoIt3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7CAE29A5-2394-4B05-9BBD-8DB583220AB1}	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
1992	AutoIt3.exe
1992	AutoIt3.exe
5964	AutoIt3.exe
5964	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
4844	msedge.exe
4844	msedge.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
4260	AutoIt3.exe
4260	AutoIt3.exe
5412	AutoIt3.exe
5412	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
6032	AutoIt3.exe
6032	AutoIt3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
880	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
3344	AutoIt3.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
4840	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
2548	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
3344	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5392	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe
5024	AutoIt3.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe
880	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4304	4060	msedge.exe	87
PID 4060 wrote to memory of 1072	4060	msedge.exe	88
PID 4060 wrote to memory of 5336	4060	msedge.exe	89
PID 4060 wrote to memory of 5336	4060	msedge.exe	89
PID 4060 wrote to memory of 5336	4060	msedge.exe	89
PID 4060 wrote to memory of 2516	4060	msedge.exe	90
PID 4060 wrote to memory of 2516	4060	msedge.exe	90
PID 4060 wrote to memory of 2536	4060	msedge.exe	91
PID 4060 wrote to memory of 2536	4060	msedge.exe	91
PID 4060 wrote to memory of 2536	4060	msedge.exe	91
PID 4060 wrote to memory of 3496	4060	msedge.exe	92
PID 4060 wrote to memory of 3496	4060	msedge.exe	92
PID 4060 wrote to memory of 3496	4060	msedge.exe	92
PID 4060 wrote to memory of 4688	4060	msedge.exe	96
PID 4060 wrote to memory of 6080	4060	msedge.exe	97
PID 4060 wrote to memory of 4688	4060	msedge.exe	96
PID 4060 wrote to memory of 6080	4060	msedge.exe	97
PID 4060 wrote to memory of 5792	4060	msedge.exe	99
PID 4060 wrote to memory of 676	4060	msedge.exe	103
PID 4060 wrote to memory of 676	4060	msedge.exe	103
PID 4060 wrote to memory of 676	4060	msedge.exe	103
PID 4060 wrote to memory of 6060	4060	msedge.exe	104
PID 4060 wrote to memory of 6060	4060	msedge.exe	104
PID 4060 wrote to memory of 6060	4060	msedge.exe	104
PID 4060 wrote to memory of 6108	4060	msedge.exe	105
PID 4060 wrote to memory of 6108	4060	msedge.exe	105
PID 4060 wrote to memory of 6108	4060	msedge.exe	105
PID 4060 wrote to memory of 1964	4060	msedge.exe	106
PID 4060 wrote to memory of 1964	4060	msedge.exe	106
PID 4060 wrote to memory of 1964	4060	msedge.exe	106
PID 4060 wrote to memory of 6004	4060	msedge.exe	107
PID 4060 wrote to memory of 6004	4060	msedge.exe	107
PID 4060 wrote to memory of 6004	4060	msedge.exe	107
PID 4060 wrote to memory of 2936	4060	msedge.exe	108
PID 4060 wrote to memory of 2936	4060	msedge.exe	108
PID 4060 wrote to memory of 2936	4060	msedge.exe	108
PID 4060 wrote to memory of 1536	4060	msedge.exe	109
PID 4060 wrote to memory of 1536	4060	msedge.exe	109
PID 4060 wrote to memory of 1536	4060	msedge.exe	109
PID 4060 wrote to memory of 4984	4060	msedge.exe	110
PID 4060 wrote to memory of 4984	4060	msedge.exe	110
PID 4060 wrote to memory of 4984	4060	msedge.exe	110
PID 4060 wrote to memory of 4088	4060	msedge.exe	112
PID 4060 wrote to memory of 4088	4060	msedge.exe	112
PID 4060 wrote to memory of 4088	4060	msedge.exe	112
PID 4060 wrote to memory of 5056	4060	msedge.exe	111
PID 4060 wrote to memory of 5056	4060	msedge.exe	111
PID 4060 wrote to memory of 5760	4060	msedge.exe	113
PID 4060 wrote to memory of 2900	4060	msedge.exe	114
PID 4060 wrote to memory of 3112	4060	msedge.exe	115
PID 4060 wrote to memory of 5228	4060	msedge.exe	116
PID 4060 wrote to memory of 5760	4060	msedge.exe	113
PID 4060 wrote to memory of 5760	4060	msedge.exe	113
PID 4060 wrote to memory of 1952	4060	msedge.exe	121
PID 4060 wrote to memory of 6136	4060	msedge.exe	124
PID 4060 wrote to memory of 6136	4060	msedge.exe	124
PID 4060 wrote to memory of 6136	4060	msedge.exe	124
PID 4060 wrote to memory of 2076	4060	msedge.exe	136
PID 4060 wrote to memory of 2076	4060	msedge.exe	136
PID 4124 wrote to memory of 4840	4124	Ghost.exe	140
PID 4308 wrote to memory of 2548	4308	Ghost.exe	143
PID 4840 wrote to memory of 1992	4840	AutoIt3.exe	145
PID 4840 wrote to memory of 1992	4840	AutoIt3.exe	145
PID 4840 wrote to memory of 1992	4840	AutoIt3.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ghosthub.cc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ffe3fe6c188,0x7ffe3fe6c194,0x7ffe3fe6c1a0
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,17543773025438213059,4723239235221998990,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,7220167725012786085,700364806555682117,262144 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,5397542071461612150,3069698230191888118,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,944463878810132293,7573717326447164334,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8436343972334023452,1525761529757099548,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,632668486273651814,12872193236186406402,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,3827910838083863524,2905269112410885925,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,202510923258985780,17361362864867193910,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,202510923258985780,17361362864867193910,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6132,i,16629830243365722618,105791994090686745,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6216,i,14825793964234581826,8001031400398405190,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5008,i,10965798964160852239,5948476702227331334,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6400,i,5009893836900460651,16978174231806194328,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3496,i,14096305552429714416,11856316857846348593,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6300,i,12809831379044473118,14483399842274986530,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6784,i,6294861201327211960,17540715614784893520,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6396,i,6190531423313654326,4684771302080519860,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,6871408559378619576,13442787376683238245,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6300,i,878718378387273,8972696869560224945,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7140,i,4809078192613657749,9192263456238235451,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,11200960067225413581,7134137875040765319,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,544449410031569770,2952844606665467236,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,11273110885467660536,9209703941166972929,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17536432107113358536,14906497562613521793,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2944,i,5855817318314244452,14197986779948936377,2097152 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,12627651416790782956,5943005781583004137,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7920,i,16394503346285236015,656723531034058706,262144 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7606538029359516307,11406108989432616640,524288 --field-trial-handle=2336,i,13982026188534621914,6589912028175621930,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3700

C:\Users\Admin\Desktop\New folder\Ghost.exe
"C:\Users\Admin\Desktop\New folder\Ghost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1992

C:\Users\Admin\Desktop\New folder\Ghost.exe
"C:\Users\Admin\Desktop\New folder\Ghost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5964

C:\Users\Admin\Desktop\New folder\Ghost.exe
"C:\Users\Admin\Desktop\New folder\Ghost.exe"
1⤵
PID:4356
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4260

C:\Users\Admin\Desktop\New folder\Ghost.exe
"C:\Users\Admin\Desktop\New folder\Ghost.exe"
1⤵
PID:3992
- C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:5392
- - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5412

C:\Users\Admin\Desktop\New folder\Ghost.exe
"C:\Users\Admin\Desktop\New folder\Ghost.exe"
1⤵
PID:512
- C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\bin\temp\resource_12.dlm
  2⤵
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 d25f14bed4bdfdbf70e173a4444326fba376ceb01bcaef41b9d6cf5c9365c84a
MD5 8505a2c773da8bb02f103bcc926e31c2
SHA1 2d5481d81b2b23a5ca47d3d8afe8bbe52c96fee0
SHA512 5a6cbbefc22837c4d1bab5b1405f1b4f573f97c97ae8d9bc85d98ac60a67df42ad58cdbfdce8934ce3bcc5fbfdc118f7d7b1d2d99fa858642ff3888030d5158f
SSDEEP 192:aj3up+7Qe2IpiFZxv8qDgNMototfgGGGSO8UU9cABh:aj3up+7Qe2IpiFZxv8qDgNMototfgGGN
TLSH
T14BF1588786D5DB9EDF05108B49A0635C10F13709FFDCEA48139C89DD358F8ABB5B6AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a9793fca1d9eba27a3d4b2e70a05a1954049ece1eb404cab9fae7a5535c24549
MD5 4b4222c2e141df8d5118031b755d4cb4
SHA1 a4fad49a7f5f058435d3db34717fe7fc4c193063
SHA512 0bc80bfdfc2244db37f2792a7e45d8affc3cbc8880e93375ccabeeb5dafc0616b6b116d4e6ec805d4018c4724caa58d3a5d0864760c03c247c83f83284aebdd2
TLSH
T10AE02BA5C821FC2708FD0B5860094A56E75013572640895F3B3C81088FB062645C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c9c052b4a4caddc95025f33b60f6ed8092a1c8d2fe5d27862f9df86d507a467f
MD5 d618936d1fa2b7702e7d89f434378df5
SHA1 0c83abd0ec8d4e444857791737211a6bf2a222c5
SHA512 b5a8906ccd6e8a78792f106a463d421ae3594880f09546885b700b718841188f54e75d7b317f8668c46104a9e16cc3da313cc37de9615c62ead72ce4700e171b
SSDEEP 96:JLYvHkfVGAHRaD59V0+JOHNl8TKl24V7Xivnc07y+Ftq2L:GsfgqaD59S+mF2criU07fvL
TLSH
T1DBA1083392462E73DB505E33CAD10E08B07785EDFA839E4AA2C27C7041EE7910138B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592fff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592fff.TMP
Size 3KB
SHA256 eb062f410d13177bbc1e10ec6a15813c4127ae4f2a7da6385aeb589b6fae2c1e
MD5 25019458b4f74500e2f074f7036f27aa
SHA1 208a94034a3f32a663fcd8cbedca080e59ddce0a
SHA512 a0a18fbee37b27cc67c28d7f1dc0637ff4324f646a1ac37e632292913a1001006180c30cd69aa74a8665d2fa4791ab409e03c719edd499633121828510f0e793
TLSH
T14B81B23345421EB3DB110A33C3D21E14B03BCAFCFB638E96A1C6557596CD792817596E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 0c20acc04c8ca5fc724d92c9ad8bdba711aefa6794090349eed47b52c2dd2045
MD5 9a18563878821ac094e9b1b07e8a8442
SHA1 591a0df3f05158b35805b612f9d247f66476ef07
SHA512 763b4e91b7b359475771be53c5cba6bede7be323b29b2496d2728059be78be6b8ae7bd5372c81008e0c82a1a93e2b3e35715691c52490191f7f91a07cad954bd
SSDEEP 384:D1Xz4bT5qEPP8peUERuVOSI5aaiGzy6GHNt/09x4uYdD6LAYD5ZozhAZ7q789IbN:KuZ2byAE
TLSH
T10F5299F3C2E5962EC91156F497146E6BCE1D0A19832C3C2689D5EE4BE3E2032E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 56849d6be91c30ca0c8f7b2148662a9a4ee93a3dab3bb4c62a0d2550b7c91c81
MD5 5e25c57b33741bb2e4287d248eb47e1f
SHA1 5def5f8bd7e2f63c4cb2b6211bc9802367785d6f
SHA512 e9c92ce3ed12738faa1deb09051e1071877056f630c63a4a2e4a8603835944c510be660dc4b2e637f945aae957ca4a2c95e9a7ba09b98ef6354fb08ff8d7ef38
SSDEEP 384:D1Xz4bT5qEPP8peUERuVOSIh9aaiGzy3HNt/09x4uYdD6LAYD5ZozhAZ7q789Ibw:SKZ2byP0
TLSH
T151529AF3C2E5962EC91156F497146E6BCE1D0A19832C3C26C9D5EE4BE3E3032E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 302665c4855ad27a570682c9affc0bf5c5d0e2c88f0dc1ca79faca8cf1748e78
MD5 bd1ea83c33c4f397368ab8b59f727f52
SHA1 5435d18f1a5945d44b43ee4b6aa86a45de411ac2
SHA512 792840d63a0e00057702b83054839b4de8f64ed668b73a94f70a12b4bbfc8352119c1262b998da7a8692306cd791be78486e285c9e418e50392b597982188d74
SSDEEP 192:sxZPRCyMqZjK1Ml8Mf6D/fdsJQZdHzodpb4hyUFSHW6+WNtUqC8NaXYv2tNP4UIi:sxZPr36D/fdsJQzM3HbtWXLbJl
TLSH
T1A272F85666345D7B8CDBD219F645BB63D2F81163A2904E94BAFCDA0C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d5920e01f90a441c802353e850496b58a300afa0babde774e597551fa7e2ca45
MD5 ede37e8cb01d03b74017d8bb1e76cf58
SHA1 5e68a53bd26aa1808283de4486e64829c46193d7
SHA512 c24b17296147d8485d7e139681083349c841c1b9c7815d4b8395eb023262cb659f3118ae3010b082a44885c3d3959d0c76f72064744341c06805eb53f9cc233b
SSDEEP 192:sxZPRCyMqZjK1Ml8MlD/fdsJQZdtzodpb4hyUFvyvHW6+WNtUCEC8NaXYv2zNP4K:sxZPr9D/fdsJQzmvHbtFXRbJl
TLSH
T14772E946A6345D7B8DDBD219F645BB63D2F8106392904E94BAFCDA1C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f6c5a1aad816e4d5e3d454076b2f86d169720c51445567fad17ec01a813a5841
MD5 49005d5ae1d650a0e51e1e6026f6d6c7
SHA1 e0683f7b26510e0507e096eced50ed6644de5835
SHA512 566c11c038d0ebe28604774167ef12eb03c6690604d47378333cc2e09364f62d78b76e53176eb499d0eb0a36ca28532f09424bd66c52775986721a892c2d8419
SSDEEP 192:sxZPRCyMqZjK1Ml8UQVlD/fdsJQZdtzodpb4hyUFvyvHW6+WNtUCEC8NaXYv2zC7:sxZPrqrD/fdsJQzmvHbtFXWbJl
TLSH
T19A72E846A5345D778DEBD219F645BB63D2F81063A2904E94BAFCDA1C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1fa0abebe77647cfb8f9976ec4c2f36b43a594fc696d4eea39e2fe394909866
MD5 c8a28100188af9b661249d27d55752cb
SHA1 20f0ea24a65aaade2dd97aea00219d8540c14c9c
SHA512 b91c3e207557b8a8ada11e63d7e2a9aaf1d2a2675c47e3ad40b0597b767ad985419eeb31ac0fa4fc496c59acd0382096b4925e5cbad601bce333ccbe893ae3e3
SSDEEP 192:sxZPRCyMqZjK1Ml8MkD/fdss81aZd+zodpPoHW6+WN58Th/YvTunNP4UIgjzJ:sxZPrMD/fdss81azlAHb8/bbjl
TLSH
T1EF62E7166A349D778CDBD209F645BF53D3F81563A2905E84A9FCDA0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b54061020cbb099fa097026f9a190e9b93389a96dce69d8b7ed8ec29057a138a
MD5 43fa3857e831c8b190173b0653f6f8da
SHA1 7d125f59b64cdd6074b6522268eebaf34073db69
SHA512 47c4f3759782a4fb7123c4b69af8ad6759aa27a58c9a9814f2e8a247695a3d109a2f55478ea9665769915dcc9a41c1848ffab7dd99acdd6ebaa7be89c4cc5b1e
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGC:05ppxnY753RNBvRJJdt7p5J9j6db
TLSH
T1FBB26A5A703E0211397E298CB39696364F4235A33058E4AF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8e0ed0fa03b0f4dbbc6f7e25e5fad7cbbb38d1d5853f83c25e1a530486a8217b
MD5 08ea791ed815f5124bb9b140ac015006
SHA1 4f52e5c2fa15166f8be94685daecf6ad52b345a2
SHA512 c275775de4a6db23fc75c900d2e079dc32210590e276a762ced41ada20c05a7d5a7246616a48182ae60304ed1df78ec20df3fdd2204d616d7e89c7235ed4fc08
SSDEEP 384:nZiFcZcIYLsNE8TUNTUlI45QckCr1AKl+phiftG4WXGXMd9hf5UrzOWity/7IgS:wFKopwgsk/KlgoG4+AMd9hSOWA
TLSH
T1FDF2D3F298D78976E99E4B87A73D2E029AFCC153B5885994F7C81C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a48ef3ca6128dbb82178deda0044b779b3734c1ebfa84b88e2aac619bdeba736
MD5 85ad36164b12f211ef406cab0c840c22
SHA1 40b3ad982af9616b73a41a554d66605da6f94d79
SHA512 9f264bfbc72c85278c78d514b8a83daaa9c3556004e937f931cfc179d500c69d3e5477a48276e2198e6f9f9d942ab7db2ab69f7da04712185b1cf54fbfe8069b
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9lYKphiftG4WXGG5pJe4KV8p0nLaty/j:pVFccps3NwgbkUCkoG4+p1I8p0nLP
TLSH
T1C8B25B36EC54CEB7EDE74F99B74A3A03DEE0526785D89AE4DAD85D0C009719C030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3816d9f0e3de91746c2a5c61408a32c3ebbbbbfd4db0aff74d8a6a3662214af2
MD5 1f6cbf2454a3ff6e228bf40cfc478336
SHA1 100bc0a5a598d2f20237129d431244525adb835f
SHA512 b32a7addec45b881c745547d050bd3039854d2a2a0f068a0f4a1a32781d5264e13d9ff4a490965f0e917c911bc66b418b3a4f41f06c4f177982314dee64237cb
SSDEEP 384:np8iFiZcIOsNE8TUNTUlI4NQckCrYAdl+phiftG4WXGXM19hf5UrzOWity/7IgS:pnFQOpwgYkwdlgoG4+AM19hSOWA
TLSH
T12DD25B72DC64DA77BDE78F89A74A3643DEF4426385C85AD4D9D82D2C00971AD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ef35788844011a4a60758df0d0d90457dfc3829e1d8b7b58362f4021abe8fb44
MD5 609382e41c7ab3fcc483091c1b2c4d4b
SHA1 065b3b46b64572a0202c0afb774251d435be2471
SHA512 f5fc5d41bb92f735a1fe68201ee7d42cfe94dbb2099608e7606732ac8ab634d0465c1c7cc105c06e83b124e155afc8434307f1236533c4e5c4db7d7121259c73
SSDEEP 384:nTiFcZcINsNE8TUNTUlI45QckCr1Adl+phiftG4WXGXM19hf5UrzOWity/7IgS:+FKNpwgsk/dlgoG4+AM19hSOWA
TLSH
T159D25B72DC64DAB7BDE78F89A74A3643DEF4826385C85AD4D9DC2D2C009719D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3cfe60b94ed282480285143e6ed089a7da50a2510f7766931ebb4674f2950d37
MD5 a37e18c9d3f99cd6fffa56251f8df92d
SHA1 e26ece48e800251eeeb3d1d9c45389fa5c0ccfe4
SHA512 256bee8c73762933fbab6b0429f55dbc00ec06451b1f2c8f06713ca6676e0875d3264191f85c5d17fe55574edad1871834d6d8031e10b932f47982fdb88f8dc9
SSDEEP 768:pPFccps35wgbkUDgfoG4+AMu9hI8p0nLP:Bs3jGLmI8p0nLP
TLSH
T15BC25B32E854CEA7ECD64B99B74A3A43DEE0526785CC9AE4DADC1D1C00D71ED530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 47f1dc10fa1b47f4b021e6734769104520a84b388b2111b4c8e6c327cba48320
MD5 405e1f0519acf388ba5bcc5162e887d2
SHA1 ae59a27fd7788adf317bd81edfdc3f69e6c8e9ab
SHA512 b5100e80ca02709b2f96a3e60b6c0da49ce09f81afd6e4baf737168ceb0434619c0a78f14a0ee6b961768a3289a4e5d77358d0fffbfc78d56e391708e4a11c3b
SSDEEP 384:np8iF9CcmyWCv3sNE8TUNTUlI45QckCrMAv0phiftG4WXGXM19h5/n1ty/7Igt:pnFccpv3pwgEk8vSoG4+AM19h9u
TLSH
T16CB23A32EC64CEA7EDE64B89B70A3643DEF041A385C89AE4DAD91D1C01DB1ED130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2efd4cb8d66f6fee39b9650d9c4464140d744bd4ef09ebc674fe098eb0654474
MD5 7968c0d2e41b4962e6b4ebdb7b81d661
SHA1 cf379b46b289a3c80b0585cc1c58e3338dbc4e15
SHA512 0d1a89f2b3b47fd7667cf8af56aef4763af72c808e7d4a021144e72b2696d289829cbf19703b92ba5b2eb2bdc1f1ec4dabb17f555cb3ab02cf4c320b1b8be0d5
TLSH
T151E00216D210107AD4181B3000471B252ED2819142B0035A623015483D27300FE50740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58acf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58acf4.TMP
Size 392B
SHA256 a54fb2903c07f087a441d02bdbbdbfd99dfaafcdf84ac60da841f6878ab9a6fe
MD5 279830fe0abce70f895aaf5d650bd8fe
SHA1 9a18c9dfae4d5e8107e89ab9fc39495b981cf7e9
SHA512 54b2ee53d72ab9bb35152d6b4cb01266b3b4c0830b700187665155f4f2581ac316fd02e3666cc05eebc9f9cbdbb8b436b674f27dbf7ea00f2f535788de56342a
TLSH
T1F2E00401D110103DD014173000431F311FD1C0C1037103455330055C3D33300F750740
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8f1e0532797a9f239795e2aece047b1694e91f1cfc0801dd22d4e113a2838d2
MD5 93c611d6ac9cc7ee7945144d7d3b7535
SHA1 0b1ecd2bd9867369bbb63763cb42041c891fbceb
SHA512 e742757f31941599f368e6d874791350d497e7e96f6e8a2d5336e3082e7538df4318dc2f3d8c2a87579f71e72ad6bc51ff77e50fce0a7e5490522f62700bcc4a
TLSH
T150412898A6FA1148F3777E569FF6A86D487FB8762E0BD09D10110D4F0A32A01C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Committees.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Committees.a3x
Size 1.1MB
SHA256 6d6980639bb20c551c762bb145d8615dd7aa092f64e9ba56bb464acbc7d28f90
MD5 a94c25fcb7f258495ad9c07800e49322
SHA1 22b3731ea89c018c27a7f9a714a2ea09ba6a9547
SHA512 6fee6b9e48d61b5fc4f392d4badb9a35ac6fb72a8ac6e4418b396b88bc048a298a998fa3c38ede73521114f0b478cca19954f1c379c815ccbe00d0ef45bdadc5
SSDEEP 24576:UR4wdS47w6960Yt39WQzZ8G2DsLne7HBPrpOSqfQJa/bqySW+v:Um6w6I0E9WQlq+0hISGbbqySzv
TLSH
T1403533058BEB11B5EF55BC0BB51757AF1C640A69FC60A09B7E98432CC4EDF8E44B289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-559-0x000002760CCF0000-0x000002760CD42000-memory.dmp

Download

memory/1992-556-0x000002760CCF0000-0x000002760CD42000-memory.dmp

Download

memory/1992-563-0x000002760CCF0000-0x000002760CD42000-memory.dmp

Download

memory/1992-561-0x000002760CCF0000-0x000002760CD42000-memory.dmp

Download

memory/2548-554-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/3344-584-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/4260-600-0x0000015311690000-0x00000153116E2000-memory.dmp

Download

memory/4260-602-0x0000015311690000-0x00000153116E2000-memory.dmp

Download

memory/4840-555-0x000001C96B0D0000-0x000001C96B0D1000-memory.dmp

Download

memory/4840-545-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/5024-634-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/5392-592-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/5412-607-0x0000022C14FE0000-0x0000022C15032000-memory.dmp

Download

memory/5412-609-0x0000022C14FE0000-0x0000022C15032000-memory.dmp

Download

memory/5792-262-0x000001FCE9B30000-0x000001FCEAB30000-memory.dmp

Download

memory/5964-567-0x00000258D6F30000-0x00000258D6F82000-memory.dmp

Download

memory/5964-565-0x00000258D6F30000-0x00000258D6F82000-memory.dmp

Download

memory/6032-638-0x00000251218B0000-0x0000025121902000-memory.dmp

Download

memory/6032-640-0x00000251218B0000-0x0000025121902000-memory.dmp

Download