1d1a5fc58870d170d3aec4bc4bc49eba4d7a20b92316270fd8b6fd8f88ca3c98

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d0b19b4-4ba2-28ea-0628-27c3c0bd13ad.eml
Size 58KB
Sample260910-e1zp3sfq2t
SHA256 1d1a5fc58870d170d3aec4bc4bc49eba4d7a20b92316270fd8b6fd8f88ca3c98
MD5 f364cbc18b2be0f6db23db1c2eef6722
SHA1 454ccbc8b80095dbea2efa3bf33a31f632e37a69
SHA512 0283f8cf84e6f84d1b3e6a9dc4a1b5454d1d919dd719fc7c4f956d75633013a19bd3b8cf3702155ae8704dbc2d5c73bf87455375f1f0b9c333c7c63a7adf1749
SSDEEP 1536:XQsXie8bs1Z+Oz61To/oEKYJa1zC7Uafi3V9ycnaBHUvNEhglOMu7m7ETFZx6cx:XQtbqQu4C7Uafi3V9ycaBHUvNEhglOM+
TLSH
T10B434517E7C16D8688BBC47150272BB8B7394BCDCB3245B460A77A2B1F0DC9385E7688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_319532973\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_972417601\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_972417601\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_1674288438\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_1674288438\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_198276669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_319532973\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_1674288438\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_1674288438\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1396	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334879286297602"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{D9FFF0B7-482A-4321-BCBD-D406BC84508D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3268	msedge.exe
3268	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3488	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3268	3488	OUTLOOK.EXE	82
PID 3268 wrote to memory of 1972	3268	msedge.exe	83
PID 3268 wrote to memory of 1620	3268	msedge.exe	84
PID 3268 wrote to memory of 1396	3268	msedge.exe	85
PID 3268 wrote to memory of 1620	3268	msedge.exe	84
PID 3268 wrote to memory of 1620	3268	msedge.exe	84
PID 3268 wrote to memory of 3216	3268	msedge.exe	87
PID 3268 wrote to memory of 3216	3268	msedge.exe	87
PID 3268 wrote to memory of 1776	3268	msedge.exe	89
PID 3268 wrote to memory of 1776	3268	msedge.exe	89
PID 3268 wrote to memory of 1776	3268	msedge.exe	89
PID 3268 wrote to memory of 1564	3268	msedge.exe	88
PID 3268 wrote to memory of 1564	3268	msedge.exe	88
PID 3268 wrote to memory of 1564	3268	msedge.exe	88
PID 3268 wrote to memory of 2168	3268	msedge.exe	90
PID 3268 wrote to memory of 2168	3268	msedge.exe	90
PID 3268 wrote to memory of 2168	3268	msedge.exe	90
PID 3268 wrote to memory of 3668	3268	msedge.exe	91
PID 3268 wrote to memory of 3668	3268	msedge.exe	91
PID 3268 wrote to memory of 3668	3268	msedge.exe	91
PID 3268 wrote to memory of 4064	3268	msedge.exe	92
PID 3268 wrote to memory of 2788	3268	msedge.exe	93
PID 3268 wrote to memory of 4064	3268	msedge.exe	92
PID 3268 wrote to memory of 4064	3268	msedge.exe	92
PID 3268 wrote to memory of 2788	3268	msedge.exe	93
PID 3268 wrote to memory of 2788	3268	msedge.exe	93
PID 3268 wrote to memory of 3392	3268	msedge.exe	109
PID 3268 wrote to memory of 3392	3268	msedge.exe	109
PID 3268 wrote to memory of 4756	3268	msedge.exe	95
PID 3268 wrote to memory of 4756	3268	msedge.exe	95
PID 3268 wrote to memory of 4756	3268	msedge.exe	95
PID 3268 wrote to memory of 1156	3268	msedge.exe	97
PID 3268 wrote to memory of 1156	3268	msedge.exe	97
PID 3268 wrote to memory of 1156	3268	msedge.exe	97
PID 3268 wrote to memory of 1016	3268	msedge.exe	98
PID 3268 wrote to memory of 1016	3268	msedge.exe	98
PID 3268 wrote to memory of 1016	3268	msedge.exe	98
PID 3268 wrote to memory of 1988	3268	msedge.exe	99
PID 3268 wrote to memory of 3352	3268	msedge.exe	100
PID 3268 wrote to memory of 1988	3268	msedge.exe	99
PID 3268 wrote to memory of 3352	3268	msedge.exe	100
PID 3268 wrote to memory of 1056	3268	msedge.exe	102
PID 3268 wrote to memory of 4628	3268	msedge.exe	103
PID 4628 wrote to memory of 2900	4628	msedge.exe	104
PID 3268 wrote to memory of 4548	3268	msedge.exe	105
PID 3268 wrote to memory of 4548	3268	msedge.exe	105
PID 3268 wrote to memory of 248	3268	msedge.exe	106
PID 3268 wrote to memory of 248	3268	msedge.exe	106
PID 3268 wrote to memory of 4596	3268	msedge.exe	107
PID 3268 wrote to memory of 4596	3268	msedge.exe	107
PID 3268 wrote to memory of 3380	3268	msedge.exe	108
PID 3268 wrote to memory of 3380	3268	msedge.exe	108
PID 3268 wrote to memory of 3392	3268	msedge.exe	109
PID 3268 wrote to memory of 3392	3268	msedge.exe	109
PID 3268 wrote to memory of 2036	3268	msedge.exe	110
PID 3268 wrote to memory of 1056	3268	msedge.exe	111
PID 3268 wrote to memory of 2572	3268	msedge.exe	112
PID 3268 wrote to memory of 4940	3268	msedge.exe	113
PID 3268 wrote to memory of 4940	3268	msedge.exe	113
PID 3268 wrote to memory of 5112	3268	msedge.exe	116
PID 3268 wrote to memory of 5112	3268	msedge.exe	116
PID 3268 wrote to memory of 4788	3268	msedge.exe	117
PID 3268 wrote to memory of 4788	3268	msedge.exe	117
PID 3268 wrote to memory of 3220	3268	msedge.exe	118

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\6d0b19b4-4ba2-28ea-0628-27c3c0bd13ad.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u47403157.ct.sendgrid.net/ls/click?upn=u001.-2BDgyMtWkHdrbjwbQxxe1wFLKgR87WVcRlHadeXIN8jsOikZfeh4YWVTtASwUx0wHW9Zc_L0lRiPkWAkVqYFMhKrPtCoIcjcxi46uDbq4FGXmwnN-2FD1WnWwQ1AgRbA0FaDxZSgKqzMOUZFkg7BP-2BanNn7865IzHbHzBxxd2FexFOvCllVZxKap3dOgvqO0kb539yOqerxDJD9-2F4vqu-2B5cRklhB6lhdnyodYonelK3f4pIvQJozFd-2FeLWkJnKKOP-2B2DHgCNvz6ysc8yFcJ2POBjjM574g-3D-3D
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff98768c188,0x7ff98768c194,0x7ff98768c1a0
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13599772923366502306,15282130476902330460,262144 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16477143847579354248,14755683012063865521,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,14043326308610301253,13818422886167568709,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,2999968040376171956,1768827397820538320,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4106797737509257006,3749847681303442840,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,94596259359716926,5579087396447770027,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5147820903597532785,9280313062781357376,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,3842416553321783553,3258615729709344470,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,3891276021875535651,11530062764844105705,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,9592520480630032389,8602626158694925283,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5468,i,14850512677063261365,3064061081606912145,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3644,i,15441324870429317146,12612353425121301040,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4848,i,10654076392065098190,12987576055735163902,2097152 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13443589403192961019,2913106027119200009,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9867629655949857885,16964106255375951507,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,11845163095933782563,3925490247065452886,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,11845163095933782563,3925490247065452886,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7686114586068737985,15906468728585431699,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,1857437187938932110,3186418162502123157,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,17119051514744603843,4161461931768838604,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,6202259493039021244,15295672911562973541,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,9288293008855679375,16168148214814534735,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,5117834245970117591,4952420907550642336,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,9842129659521776264,6142701378074564760,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,11498485609340927083,7002209484788162545,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,1206950865252175506,18440684308855714645,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,7392669289801283548,4752174959254177969,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,3771977406930094797,8295424752424350430,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,1278767926285645553,1640622728381075840,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7920972990736994619,15127490713193395336,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:14
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6976,i,16220735443532125105,17521806093953404704,262144 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3794885678609551756,9722835317281530532,524288 --field-trial-handle=2952,i,18140962342039810384,18365730163651618298,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:14
    3⤵
    PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a061b2bce14f7f7106c5be13db2668e84a4dae62a0b2542958fcd866a71413bc
MD5 ec5fbad837e0deaecfb422082445719e
SHA1 49c0a7008b147a31db0b01e912db33374b6f415d
SHA512 2423c083a0637732ebde8742f0a70c69cfdd4ead4bf066f787d4eceda8e130fe2a8331d931d305f1e58226ad38cb736dee2aa4f9a1509580358582ddbd6a33dc
TLSH
T12D615E1502627EABDB39033094E0A33F3DB281A89D9FDE86354878BD5616BD2E11DC34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589cf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589cf7.TMP
Size 3KB
SHA256 20de3e657b115929f761a7a17427109400e44b28b5fedb2c96d1976ca35c7ede
MD5 5fd229f724270c537175bd70ee59f229
SHA1 a7c7538b1fefbd12d41c9369611faa44a55e9207
SHA512 5fcc95b066cbbf9edac3dbf65fb9934977f66bf87d4d83b9ccad413e7a520ccf17f19196056b3024e718e555b00132a6ece79de822f11dab070dd048267aa6b1
TLSH
T174613E1502627E9BDB39033594D0B33F3DB281A89D9FEE86354878BD6616BD2E11DC34
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1d2ac7cd766ae97a67615632c21296f59c0ce55d295d3316c7ea9b0775e35868
MD5 49f3794e39c426273d35d12e475637f8
SHA1 02885a9b8011f54d7abac9d7159efc5595a92eba
SHA512 dedc2ca0046eb16896dcc541d2ba01016de4e6ae5f21b44357098659347be0f05c2e63706d102caf395bf0a2ae66375a8f0c2b6f6ad30d18df04c6141e23032d
TLSH
T1FC718EE7C3E8876DC80592F06B547E2FCE2D0A1543283D6A89D9EF4B93E2471D24164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 37c2d2366e0c80610e78dec36b17fed26fa5d3c281d979da8bf7323ba7c64a5d
MD5 f2403c2c014f467f4085f362f79873f1
SHA1 7a4c8acf0bb3caba9b1caa360bd44c5787cc6422
SHA512 2807c0a2db96bd5d186ea25762951fec5b902701e6db0bf494d6825d7bf4f21a28cc7e998c7306c5c2a39d2f72a1bc313e1017cfad5e7f14f241181c31e32fb0
SSDEEP 192:sxZ1RGyM/jK1Ml8MLd/fFs1rrLIdpaH/W6+WNlNmj/zB0aKfBxIg4J:sxZ1ojd/fFs18Y/bI/Wpc
TLSH
T19752D705AA34A977CCDBE309BA54BF53D6F5557292900E449AFCCA1C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4d06e284da09e3edc64c06c8161533caba5f9ea6f8dcb979cbb9b364dc460d99
MD5 14db8195c407915ae0014b55ea61ef64
SHA1 db2b289688c6d6fb7e814837c6f275c46e1250b3
SHA512 5ddb5027537cab654928b7d94b64eef0e2e7c2669380485f5ae51e9758357d96271c330f0e6c1ba784ca0b3f03181f43f9b85d905ec07db62e587d7b5aed2bcd
SSDEEP 192:sxZ1RGyM/jK1Ml8UQILd/fFslrrLIdpkH/W6+WNlNmj/zB0a3++xIg50J:sxZ1oqud/fFsl8+/bI/WmS
TLSH
T1AA52D705AA346977DCDBE309BA54BF53D6F5557291900E44AAFCCA1C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 89380a324e96c480443703d88165da15cab643b15cee039961e182387a5c0c01
MD5 0937f3664dc3fdfa7afdfeb944ff352d
SHA1 179ad482d9c00d7c0bb505db5f672f54a5ad1e4c
SHA512 fd0de30173ee89c1676930f2c1dc0793cb7f15dd4836eb62227e65daa8285a5f1270fc5571a265bd63fee382bd9fac4b1e87f4cc6f3a44b333a3a95224d581e3
SSDEEP 768:7C/zh8dF2Ga7pLuLbEkWRmEcQhw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kgJjLlM:7C/zh8dF2GyEbEkWRmEcQhwu1jaKkgJS
TLSH
T1A0031C3F280CCB7E4F804E9CED2A7E9A6EE8028B6698895447FA444C03C66DF55175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b525acaed3afda8a142c05bf7d28af72a291d484dbaeb414cc8bc29ef1591fa0
MD5 bc1a6e636c8a82ab80252a2694ecd5e6
SHA1 6448861e1ccae8d6c861fc4730f8f1c38600cf7b
SHA512 eba1e87766e9e1a98520c43e69cb6e8a9cd2cc2ff1104026e76c255791f519c891bf9b4483d10831f49e151089151e5a53f6354981684f7fb1e9b68d10fc7419
SSDEEP 48:KEWIHKvDAIfK12cryReIvKfK07yn32jXltt+X9UlIS3+KNLVB+5fucsx6:KEWgKvDAgK12ayeYKfKKSsgKxmd
TLSH
T196B16B9231FA06423D3D270DA661975B6A41B2633219B52F77E845720E2BE304DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22a7f43c-2c98-454e-8794-9175086f9bd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\22a7f43c-2c98-454e-8794-9175086f9bd7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e51f33b9ac52eeeb47a92d9eef9abf1d65e472b8a735bbe0f83c58487114460c
MD5 d4a51074981ee4e42ca35dfb996597cb
SHA1 10c0c1cce27731f309795e802df01d1709219c24
SHA512 cadfa957fa4aa6b4e7e43152e7ab8cd81c44c3a039da76fabf1d9708221df074b6bf3ab293869f9683507ac02a8ada589d9a7bcf906c4b5a80fff3556ee025ec
SSDEEP 384:n7iFiZcId8Nt8TUNTUlIlyYuAQ+NtDf4Hs3vXLUxuvzxV+MhdpwfHo8:WFQdgwgLREHsPLU4184pwfHD
TLSH
T195D2B3F198D79976E8AE5383A77D6E428EBCC063B4885980F7D55E4CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c109adb956549984e86fcc939a5273f385d3e0fb3f98ef2e4faee5ee439600c
MD5 f35fe95baf06026c8366e5b3290109e8
SHA1 f1175b450763234a0e5f04ba7a7dc6b41e30cb3b
SHA512 3e45b5029b477c5d0c6bf97049831446d10a9f83b62aded75c9578a868de443b544bf194d826ba40b3358792f46d34d884cbdedfd8d0f1c50316e9565cb63fd4
SSDEEP 384:nQZcIh8NTyYuAt+Nns3vCLUxuvzxV+MhdpwfHo8:uhcOhs6LU4184pwfHD
TLSH
T189828E702C786DB788EAF105F98633039FB850B799D85F40D5E99F1E009B65D271BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b8efbeacb40a4008094e56291208763c6cb2a26626aebea78751178a0a6e7c7
MD5 77d1ace0659130574435117e90bcd0bd
SHA1 ae4ecda7efe30b9a2b2eeea6949487e64d8210aa
SHA512 202257e5ed8582dd40c1240a0d4d8264ac346de22e57b42c7caea018d872cd8ce3f8754b0f69ad5707174fae7963a05bb92004a6998cedcc2b2b9ca7d50eb3b4
SSDEEP 192:BGNz6P2UOcQmiUy5IUQqGv0W4zwSLPyU6:BGNz6eXsqI3qGs3DL6U6
TLSH
T10B02F9796C786CBB8EB2AE45B98637135FE4107BDA952F40DAE41F1C00DB65C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c68a509e3a3fb25e2bacc7510f6c8b98969931d193adf1495313fcc8cae6906
MD5 b133efa9c47de8438640fa4a6fd88f3e
SHA1 a07b8a1bce3eed3b3d4643fb7826def9a94dfb64
SHA512 3977855a943135d619a6b1e15bfabae33fe9b3ee2b285f371f4a15c69fe896f571c9e0f10f34a1a3ef3ae4061b4f71eeb2b9850041778b8d9bb129b9ef0ed866
SSDEEP 192:PGN26P2UjQmiUy6EQPGv0W4vS6HtL0BLMq27U6:PGN26eixnPGs3vwLUU6
TLSH
T1B11218756868AC7B4EE7B100B8C633539FA810B7DD866F40E5E91F1D00DBA5C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 040dc015c6be9a6e85dc62e5f028924a539e7006856af4844a1c9907fec5a442
MD5 e849c4ce5c57a0103ec26630fe30c236
SHA1 16318273214936975f7b93916665450c19a04f4b
SHA512 90c09360bc835966e47bd7d7f42ec926ecd5eb275f750e88792f80e3ad6e5b16418ad17b37668bf6d1b848f60673bc2bbbe5a463214ef80607ad5d2286412caa
SSDEEP 384:nVZcIh8NT3YuAt+Nns3vCLUxuvzxV+MhdpwfHo8:thDOhs6LU4184pwfHD
TLSH
T18F828E702C786CB788EBE101F88A33038FB850B799D86F40D5E9AF1D009B65D271BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

c252521e-510f-4daa-8a5b-ca0db96ba1cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c252521e-510f-4daa-8a5b-ca0db96ba1cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

423349d9-6e96-4f56-bae5-8731d761fcd4.tmp

Path C:\Users\Admin\AppData\Local\Temp\423349d9-6e96-4f56-bae5-8731d761fcd4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e51a36aa-d4d6-4c56-9cd7-05de3bb8259d.tmp

Path C:\Users\Admin\AppData\Local\Temp\e51a36aa-d4d6-4c56-9cd7-05de3bb8259d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3268_1037167329\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3d1f1d4-c499-4a6f-a02b-f6bde0327bcb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3268_70566914\f3d1f1d4-c499-4a6f-a02b-f6bde0327bcb.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_1674288438\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_198276669\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_319532973\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3268_972417601\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3488-6-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-5-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/3488-11-0x00007FF973BD0000-0x00007FF973BE0000-memory.dmp

Download

memory/3488-10-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-8-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-0-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/3488-9-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-7-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-12-0x00007FF973BD0000-0x00007FF973BE0000-memory.dmp

Download

memory/3488-103-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-108-0x00007FF9B5E04000-0x00007FF9B5E05000-memory.dmp

Download

memory/3488-4-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/3488-2-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/3488-3-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/3488-109-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/3488-1-0x00007FF9B5E04000-0x00007FF9B5E05000-memory.dmp

Download