44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
Size 6.4MB
Sample260901-n799tsdj4z
SHA256 44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317
MD5 bb0438616439b60170233a6c41e036fe
SHA1 5adbc92ae75fa92b8e6fa13656a47214927f4477
SHA512 3a28e2cd440e0158277dcbf8baef6591a2fade4f3467227b2689df8f434cdce2eec0fa35b2d085ef9a16729c6539b88a25d79f99ce0b2b072a1278ac2f2bcdab
SSDEEP 98304:gtJndFRPOCbDjyoG0qzKaW2wsTRukz3x0:gtlYCPjyoG6aXTEk
TLSH
T104665B07AE5441A5C96BA73CC6BB0225A6B8BC4CEF753ADB1E8174307FB67D06976300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 6080 created 2364	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	89
PID 6080 created 5828	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	90
PID 6080 created 2680	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	91
PID 6080 created 5024	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	92
PID 6080 created 5076	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	93
PID 6080 created 2360	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	95
PID 6080 created 2684	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	96
PID 6080 created 2364	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	89
PID 6080 created 2364	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	89
PID 6080 created 5024	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	92
PID 6080 created 5024	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	92
PID 6080 created 1064	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	113
PID 6080 created 1352	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	114
PID 6080 created 1372	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	116
PID 6080 created 4132	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	115
PID 6080 created 1612	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	117
PID 6080 created 972	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	120
PID 6080 created 1820	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	121
PID 6080 created 3416	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	122
PID 6080 created 1064	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	113
PID 6080 created 1064	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	113
PID 6080 created 1372	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	116
PID 6080 created 1372	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	116

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1064_1267180983\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1064_34813988\_locales\no\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	chrome.exe
1372	msedge.exe
5960	chrome.exe
1556	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327378371258707"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1327E5C7-1856-4422-95FA-A4F187975454}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
844	chrome.exe
844	chrome.exe
844	chrome.exe
844	chrome.exe
844	chrome.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	844	chrome.exe
Token: SeCreatePagefilePrivilege	844	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
1064	msedge.exe
2532	msedge.exe
844	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 2364	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	89
PID 2364 wrote to memory of 5828	2364	chrome.exe	90
PID 2364 wrote to memory of 2680	2364	chrome.exe	91
PID 2364 wrote to memory of 2680	2364	chrome.exe	91
PID 2364 wrote to memory of 5024	2364	chrome.exe	92
PID 2364 wrote to memory of 5076	2364	chrome.exe	93
PID 2364 wrote to memory of 5076	2364	chrome.exe	93
PID 2364 wrote to memory of 2360	2364	chrome.exe	95
PID 2364 wrote to memory of 2684	2364	chrome.exe	96
PID 2364 wrote to memory of 2360	2364	chrome.exe	95
PID 2364 wrote to memory of 2684	2364	chrome.exe	96
PID 2364 wrote to memory of 3844	2364	chrome.exe	97
PID 2364 wrote to memory of 3844	2364	chrome.exe	97
PID 2364 wrote to memory of 3220	2364	chrome.exe	98
PID 2364 wrote to memory of 3456	2364	chrome.exe	99
PID 2364 wrote to memory of 1688	2364	chrome.exe	100
PID 2364 wrote to memory of 3456	2364	chrome.exe	99
PID 2364 wrote to memory of 1688	2364	chrome.exe	100
PID 2364 wrote to memory of 1308	2364	chrome.exe	102
PID 2364 wrote to memory of 5000	2364	chrome.exe	103
PID 2364 wrote to memory of 5208	2364	chrome.exe	104
PID 2364 wrote to memory of 1308	2364	chrome.exe	102
PID 2364 wrote to memory of 5000	2364	chrome.exe	103
PID 2364 wrote to memory of 5208	2364	chrome.exe	104
PID 2364 wrote to memory of 2980	2364	chrome.exe	108
PID 2364 wrote to memory of 1004	2364	chrome.exe	107
PID 2364 wrote to memory of 2980	2364	chrome.exe	108
PID 2364 wrote to memory of 1004	2364	chrome.exe	107
PID 2364 wrote to memory of 768	2364	chrome.exe	109
PID 2364 wrote to memory of 768	2364	chrome.exe	109
PID 2364 wrote to memory of 1176	2364	chrome.exe	110
PID 2364 wrote to memory of 1176	2364	chrome.exe	110
PID 2364 wrote to memory of 952	2364	chrome.exe	111
PID 2364 wrote to memory of 952	2364	chrome.exe	111
PID 2364 wrote to memory of 3400	2364	chrome.exe	112
PID 2364 wrote to memory of 3400	2364	chrome.exe	112
PID 6080 wrote to memory of 1064	6080	44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe	113
PID 1064 wrote to memory of 1352	1064	msedge.exe	114
PID 1064 wrote to memory of 4132	1064	msedge.exe	115
PID 1064 wrote to memory of 1372	1064	msedge.exe	116
PID 1064 wrote to memory of 4132	1064	msedge.exe	115
PID 1064 wrote to memory of 4132	1064	msedge.exe	115
PID 1064 wrote to memory of 1612	1064	msedge.exe	117
PID 1064 wrote to memory of 1612	1064	msedge.exe	117
PID 1064 wrote to memory of 3064	1064	msedge.exe	119
PID 1064 wrote to memory of 3064	1064	msedge.exe	119
PID 1064 wrote to memory of 3064	1064	msedge.exe	119
PID 1064 wrote to memory of 972	1064	msedge.exe	120
PID 1064 wrote to memory of 972	1064	msedge.exe	120
PID 1064 wrote to memory of 972	1064	msedge.exe	120
PID 1064 wrote to memory of 1820	1064	msedge.exe	121
PID 1064 wrote to memory of 1820	1064	msedge.exe	121
PID 1064 wrote to memory of 1820	1064	msedge.exe	121
PID 1064 wrote to memory of 3416	1064	msedge.exe	122
PID 1064 wrote to memory of 3416	1064	msedge.exe	122
PID 1064 wrote to memory of 3416	1064	msedge.exe	122
PID 1064 wrote to memory of 5612	1064	msedge.exe	123
PID 1064 wrote to memory of 5612	1064	msedge.exe	123
PID 1064 wrote to memory of 1788	1064	msedge.exe	124
PID 1064 wrote to memory of 1788	1064	msedge.exe	124
PID 1064 wrote to memory of 1248	1064	msedge.exe	125
PID 1064 wrote to memory of 1248	1064	msedge.exe	125
PID 1064 wrote to memory of 1336	1064	msedge.exe	127
PID 1064 wrote to memory of 4732	1064	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe
"C:\Users\Admin\AppData\Local\Temp\44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb604ac728,0x7ffb604ac734,0x7ffb604ac740
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,9744558482755028284,3342406265319105751,262144 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:2680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1324,i,2728996767204651257,2547490992354467996,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,13390499663372602706,17580957341108976945,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,3086714719077336349,2630217310347930840,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,14978658347692644508,16997018599916330056,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,5125107017934735222,17787757422088966647,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,1526351882056359837,13787604420903957399,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5492,i,755212247735147946,18229988685069189895,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,14132482874539570021,6845412501952373421,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,7998357394380510006,13523865933390714284,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,18108251672253355045,9277703177023494737,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,5847129388734487959,6557960487124905111,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:5208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6208,i,17820973100687718866,11604295029502125613,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5824,i,1306451508635896068,10149383153324440405,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,7338467455593585711,5550511441178608156,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5340,i,9865228995972363935,7095506982731471355,2097152 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,398602107725127458,14929223633431834419,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
    3⤵
    PID:952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,12800951624340376237,13056546813688922172,524288 --field-trial-handle=1920,i,17705915642402566426,16410556967046224184,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffb507cc188,0x7ffb507cc194,0x7ffb507cc1a0
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1728,i,3518515663127541251,11831605048587073458,262144 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10133859684657341949,12457176850477828957,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,6114583351450160459,13046996147436863219,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,11002742098441232612,11489706639948557952,2097152 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,5797670270405436529,4071727034466787017,2097152 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,1386874128673494521,433882791371831395,2097152 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,15413792534227103284,2749515533481023312,2097152 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,14007858611548677809,11251874082677703974,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14680591072518743958,3876490681238897723,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18259203463787900846,5708037555626989500,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6287318082325620248,9001854659804983566,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6287318082325620248,9001854659804983566,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,14301036489338955366,9150514549914178614,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,13838635286687311814,14569338498640745607,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,7258334689006690743,15858367283417545465,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9823267457144889916,15064728081292905254,524288 --field-trial-handle=2340,i,970749585341415879,17463757864709551064,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffb604ac728,0x7ffb604ac734,0x7ffb604ac740
    3⤵
    PID:5808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --force-high-res-timeticks=disabled --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:5164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3776 /prefetch:9
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2184,i,14750591683972903643,16189810653182169015,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4596 /prefetch:9
    3⤵
    PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\runimeMsh\9df508d7 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffb55bfc188,0x7ffb55bfc194,0x7ffb55bfc1a0
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2616 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2864 /prefetch:13
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4668 /prefetch:9
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4820 /prefetch:9
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4804 /prefetch:9
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4852 /prefetch:9
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4912 /prefetch:9
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\9df508d7" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2552,i,2729416667141643711,3701769225202556854,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:1112
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\runimeMsh\99c29b91" about:blank
  2⤵
  PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\runimeMsh\99c29b91 about:blank
    3⤵
    - Checks processor information in registry
    PID:4940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\runimeMsh\99c29b91"
  2⤵
  PID:4508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f"
  2⤵
  PID:3268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\runimeMsh\9df508d7"
  2⤵
  PID:4252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b81390e4b5fb13255a685feb35852405064a324c6a4732cc94cd474db5d56779
MD5 42e2977c75252fb13dc1f513dfbac229
SHA1 a518769ecc50cd9def1c565885d5e08008405bdc
SHA512 3edfac64cd71c7eaea79091e6e88a27d35982168b142b593c4ed795b621864f2c3dd8c8b44db0e716dd6cea08c2d1ff99dea01c16916dbd981efd256fe116470
SSDEEP 192:rRWkCWIv7IvAPRp2l98Hsb+WNnCEPq1ckw7arE2+VyIsnAUge:rRWknU86Xauw5Plbao22e
TLSH
T1AA32B72EB914797B5DCBC21AF9227B53D7F5202161D42E84EBFC856C14E75CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48686ccd47d4875794e02d6de0ba745c9c114bbb570eb2bfa450065bc97e7115
MD5 fcc4ac0b3e13e17412608b51cdb75300
SHA1 6ec68ab015031b875b725e4a093ef2c735aa1bcf
SHA512 74f0d2fb5c5875c94224ac11ecd561b723807bfce88ce92a41516ddcba0df930ce89a4fc2f339f255a906202b322ffdb854d762c427bf97fdc683bbc4fbbbe14
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKN9wrtumtK7p:Majm97KxkXqKf/pUZNCgVLH2HfgslN18
TLSH
T1E732D827A88D9E7F0FD8D81CCC176F8BACF5029262780D2456FB5D0803A578E115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 77b66225d57313237ff9ca3e9adb30a2876118e7ad1d04569407ecbb3f2749cb
MD5 f24537982a4dc3a3e43fcb69ac459d96
SHA1 966057a82554e1dfaa93f46e593b5cfe246f650a
SHA512 b58a186fa4566b6d49c0ac868ecdc7b993e2c3d4cd093b11d5fe699cecec52b440a2e57daf76205c3eae03afe4c6654363185778c41054b7de80b23a46823d51
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQgPkVum8nX:1nbZeMrv/hGtQwnX
TLSH
T12BD3864B3A747102EDE59A721CE0507F5E3CB16D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 cc5e60fb4bd5db4a52a4bd29f608567ee9a423c86eb8a02296fb4b57eda5f048
MD5 d99b2e4c56b95a4e710c04a6a32cb69e
SHA1 14f85940a7006dadcadd824a3d35c7c1e5864ca9
SHA512 e457033320eef85040e33a0eb75fc97544387285f845b97767bfefa59e1d6d2c5ce9cd0b90c748f5fee2111da8f0eae274e252ce5b57735cc85cd37abd6b5b1b
SSDEEP 1536:382wO1fk3gS3jsJzqcKvA0LorOH/8j7gwfLp6tZ4NOZX4w0m2vyEOrylS39qDtUV:6rsJqJY0Lore/c7vp2Rt4VvyDbKVg2bG
TLSH
T18ED30275FE3E71371DAED411F14E370B4DEB329A7D880A6950823E443AE70B5A50BA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 97d040024a7642870bf02c4070175712c415b2f47862fe163170155345c8a502
MD5 39a1f0e180e9ee669201a7200546fe48
SHA1 681f9695a045b60418da22b47018eb8e3f92d5a0
SHA512 cd94735f5934d3fd42c582c73ea875a10cf42e1fbc8bf6ea63005e08719f8d7251e4826b2ecf70553962c56bbbaaa782f2691cb40e3c3aec6bba0ff65ae7b8fd
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok50HDQB6eGyvkongob1v4a:MC0HJm5FHuPgXDUDGUW8ngobZ
TLSH
T1A0A12BB1A4B94CB759B7D345F8833E83DEA4A22769A0EF80D9DD1E0C01F71D81342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3fe129da48551e76bd14b4e85d8e4cf19f413c868e8fcb15dd9ea40fc18f9a7b
MD5 99ec255314e8b93bc02bf54085a8ca2d
SHA1 2c831c3a54f108644d7fee92715e94527c0e8b4c
SHA512 a5b1bedb5ee857a3f270129bf31007800886dbf7690b9b2e3e78e171909cd0c5a7582bea51cb1d92bc4638fa1ec1fe67034158158163b9f888cbac9801bb715d
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOH+zC+4AwmWgFNg+mK4jg8mc2edse3H3gFq:CbEBVj5JAdSp9/EgTK7j6dJOH+zC+4AG
TLSH
T105912210313A0240383EAA1C80B98C6ED6C17967341AF56F3BE945974F2BE479DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 48248480035e7c7b0cafb9bf843e03bf890923c808af075f0f225dba0b9b41cc
MD5 89aa585f3f1c8f2d130c47bfa831391f
SHA1 40eb2818570805d018338aafcf5c9ae58724b1c1
SHA512 272880d45450e710b1604a42970c49a90db25f38f6ca0e3da332883f42f7613e74f4d4f255c64ee9a2c757fc96bbe35e349a21cdb84b78f9af0fd6c15f64d047
SSDEEP 384:DNrRZyCSDnxTICtMEhIKyll7svbFKfk7:xFZJSDniPyI1l7svbF9
TLSH
T1BF44740A7B747001EDE6D9725CB080771E3CB16D8F22E6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 84e60ba314aa1914d1376adce15742af1328ad5d196bb0f8f2b668187ca6f340
MD5 da9c3aa530712a03af0a4cb01375d991
SHA1 cf0e2d27ef6c6eba12feb76f2ffbba2b94cabce5
SHA512 651f0d5334ec66ed749ef4e465d33bd7e17f2b937bcc6fa2b3c3f909a3a6e39d8a0cd86ec75aefd4ce9a8905a557f1f6746a2d81bb3e4be90b8cd58e4fb9b261
SSDEEP 768:Irv+4UNbdD3Ac7TzNp8+p3bd66j+4BRv86aLIiV2bwCl1:Ibsbp3TTzL8+p3Z6n4y/0ww
TLSH
T18F03BE33F9A899739CE6C644B2467A437FF851A396C10AC4D4DD2B4E419B1AE630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cdaf0268e0fea5271db03f51ee2b2ac40477b1d4c66fe9fa8d14d36ac8000f21
MD5 1418994b161b19ef99074f183efe9502
SHA1 7086a9ac1bee9ef35e49eadf68704fe76a8430c4
SHA512 e891efcf771184c21ebfb171c038bcf2a5bef143b96d42150e740a89ff7cacb2ac7edc7956706cff6e1927251a134109812eec83f0809b760e7ee570c35bbb3d
SSDEEP 768:Lrv+4UNbdD3K+7vQNp8+p3bd66j+4BRv86aLITh2bwCl1:Lbsbp3TIL8+p3Z6n4yU0ww
TLSH
T1F103AE72F468A9739DF6CA48B1467B837FB821A395C10ED4E8D92B4E415719E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d13f51e-31bd-41fc-bc9b-3f21330551ed.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d13f51e-31bd-41fc-bc9b-3f21330551ed.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1064_135585050\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\runimeMsh\5b9f920f\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Crashpad\settings.dat
Size 280B
SHA256 a66776cd56b1b7225ec36c4df91849260d21a71da41c539f5490acf285690448
MD5 97578c43922b86328c7e749681a3c8f0
SHA1 b332e8d95fcbff2a399585b86e5cd4fa9fe2c875
SHA512 e4181307705e52ed8de015b18d04c78dc1b4b2b87ab4f141fa526412625df014e1779cb9ceb66993d29d217c96aa3c857b4df2562cdfc124ad0095f966fa10e8
TLSH
T124D01108A3F02022F08AEB38A8B0B2028A80803220800222202028A808882288A2A230
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Crashpad\settings.dat
Size 280B
SHA256 d80bf53cb5e9d4d3f8efcd95be69388d2ffc625695dd4bad57e46069017bfed6
MD5 f87c5c0e56ad5c96f77777902434d22d
SHA1 ce995d7163050b74328799fab36d1c283e63d5e2
SHA512 bf68a02a75c11ed259418c6326f543b53384eefdcc2fa5f30556f257df13bc7945d18369cdb809762703a79236ae605d63af91e8ffcda5d6d279107e697e87e8
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

ARBITR~1.JSO

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Default\ARBITR~1.JSO
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Default\CODECA~1\js\INDEX-~1\THE-RE~1
Size 48B
SHA256 e109675db31a1d1f054c049cedad55b173483d39da8a26c250cb8b1b502e3cd7
MD5 0d6df84b77a077d85d259b68f27face2
SHA1 aa4b8defe23bb0de23c3f5d2180e61f4b3489183
SHA512 ece818d73dee0e50d92461b576670a82131cc56dab7ed0eabc8ca4a240f4c2dc76473b46f9b7aebf37ebfbf0b0e66cc3007f7edb8bfbddc8b78e1eb92132d769
MD5 SHA1 SHA512

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Default\CODECA~1\wasm\INDEX-~1\THE-RE~1
Size 48B
SHA256 1c16b90a0c64d1a2a3bd129090bd9cb86b1a75275006dd93d389f3557e7f6e27
MD5 bc94313fe45beffe2b2a99411d37dda2
SHA1 d2e75c2b9d0305ed7e597f1010596eaec082c945
SHA512 10a96ca50f381e7a72a168993b900c1206aacd62c6a47e3931f40a315ce64f762bd583d8e46104fe21d236865ed917aa07977ebc262fe00054416be797c5a1df
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Default\DAWNGR~1\index
Size 256KB
SHA256 57bb7c9c0bfe322ffc280a08ae0399750bc354d4775082a00207129a50db0611
MD5 883e490f2b5b22678822a4527fd5957b
SHA1 b4551b959deb285480b2996b7e6245dcfcbc19f6
SHA512 528c141d03a0c8cf32dd321f17a287ec9c46b69c817e0bd538f448532ed1cde060d9ab9fb035afaee51b67e0c871103ed6f04fb01f2b6fac1d7620a0086e87a2
SSDEEP 3:LstlNllklkXl2TKll:LsX3lP2T+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Local State
Size 3KB
SHA256 1bb25cba01d8168eba83f7233bda8d3d7ebcde4e6aef208e60fa48c22a4904da
MD5 61f04f20c18253541e391c4b6a3f8481
SHA1 d9282f799970ad7e6a2874baf4d309f3f400d7f8
SHA512 48de4afcdfe73a99a741e4f692a6f6edd52891a8f7691fb2b79539d0c08c34f90b5ba523e8ddcf5cfc0675c276d0808d73e7474ec1738946cd24cf284479aaf2
TLSH
T10881E6736424FC6B59E15A44F5873A238F39F123D725BB8461DC222C05FF65C930AC66
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Local State
Size 4KB
SHA256 3a44e315d8022c296e02214838933657ab75e9a98b1616e6df12844bf9a33027
MD5 db8235f673b34649ffdc1d49c4b2b559
SHA1 7740f6fbecdb156e281c23442442e11f0ea49235
SHA512 dcac0c044d2a4cd4eb6b7f81f4325f79e3e2f937a4fec2d9ee150493af8930bee8156eda8e3786f4be90fcf239f3aef52356f293d49d9293a1bbfe8ac7af5dbd
SSDEEP 96:6qGNkrQsFfDcfjJ58Frh/cInURoDotovxnDUBK2vvsgJntpe0eUcJ+SDS4SYSuSj:RGNfWcMooDUwZYLnm1Jc
TLSH
T102A1C6726474EC2B4DE2AA44F4863A13AFA5E127E6587BC8D5EC1A1C05EF398430AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59be64.TMP

Path C:\Users\Admin\AppData\Local\runimeMsh\9df508d7\Local State~RFe59be64.TMP
Size 1KB
SHA256 7d521329f1e6c10e80e3117efb81684fe083c4c3c88c09d816879f711278af03
MD5 f142fe294d97949791ebab7fcc5dd8e0
SHA1 51a08993e40674f6fc6f0ca78685beb24ffc53df
SHA512 da988811e27ac7e5876f247f76d2b1a0dfd2ac67d53ee8d4d4cd98767a6a6609a3c9318106669af36542808868eb9e619f7dcde358552d6d603aed20c77e66a7
TLSH
T1DE31957074687CBBE8E16B05F6477BA35F35B0B681225A4C65ED052909E778C120DC3A
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6080-51-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-75-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-65-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-77-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-83-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-82-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-89-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-91-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-90-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-84-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-79-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-78-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-81-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-92-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-93-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-95-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-98-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-107-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-108-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-105-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-100-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-99-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-109-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-106-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-115-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-114-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-116-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-113-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-123-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-122-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-121-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-67-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-74-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-61-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-76-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-73-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-69-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-68-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-66-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-60-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-58-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-57-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-56-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-0-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-50-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-49-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-48-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-44-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-18-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-17-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-16-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-15-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-14-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-13-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-12-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-11-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-9-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-10-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-8-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-7-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-6-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-5-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-4-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-3-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-2-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-1-0x0000000750000000-0x0000000750295000-memory.dmp

Download

memory/6080-1250-0x0000000750000000-0x0000000750295000-memory.dmp

Download