9c18487789f2ce2bd6ce583c890d1ad2415edcde4b486fb592bff6f697be6451

Analysis

max time kernel
118s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CheatPractice1.0.4.1/Microsoft.Bcl.AsyncInterfaces.xml
Size 29KB
Sample261024-pxtprsbx9l
SHA256 9c18487789f2ce2bd6ce583c890d1ad2415edcde4b486fb592bff6f697be6451
MD5 7a9752588d37b3196e163ed63da803c9
SHA1 ffe0d8ca1ebb78843b899920c3f0391ec3324046
SHA512 fe69915755b5d8f369a963f13dc037658db2ed9113023a61308c2f5c5161cc28f4bc4b0a25794c2053d410f3a48f5177a8ba49fe2e2aa7b831120b2b8aac8931
SSDEEP 384:XgOpngSae6jWuTPP/xM2fB8qnmltJ5XZzRzgqW81Fu3DRmfCh7sE+siDBQsFaIsS:0FQa+TK7TIcXI
TLSH
T154D2002477C99B220CB6121A8D18F0C4EE221E37655D983834CD6D679F7B8A663FF4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_493359315\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1452_780515061\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_493359315\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_493359315\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_2079472945\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_249843377\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1701973987"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31286204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{427906DB-D4E8-4AE5-98D1-E68D28ED53D7}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1200	5048	MSOXMLED.EXE	81
PID 1200 wrote to memory of 1452	1200	iexplore.exe	82
PID 1452 wrote to memory of 3836	1452	msedge.exe	84
PID 1452 wrote to memory of 2264	1452	msedge.exe	85
PID 1452 wrote to memory of 4784	1452	msedge.exe	87
PID 1452 wrote to memory of 4784	1452	msedge.exe	87
PID 1452 wrote to memory of 5692	1452	msedge.exe	86
PID 1452 wrote to memory of 5692	1452	msedge.exe	86
PID 1452 wrote to memory of 5692	1452	msedge.exe	86
PID 1452 wrote to memory of 1512	1452	msedge.exe	89
PID 1452 wrote to memory of 1512	1452	msedge.exe	89
PID 1452 wrote to memory of 1512	1452	msedge.exe	89
PID 1452 wrote to memory of 3868	1452	msedge.exe	90
PID 1452 wrote to memory of 3868	1452	msedge.exe	90
PID 1452 wrote to memory of 3868	1452	msedge.exe	90
PID 1452 wrote to memory of 3008	1452	msedge.exe	92
PID 1452 wrote to memory of 3008	1452	msedge.exe	92
PID 1452 wrote to memory of 4008	1452	msedge.exe	93
PID 1452 wrote to memory of 4008	1452	msedge.exe	93
PID 1452 wrote to memory of 4004	1452	msedge.exe	95
PID 1452 wrote to memory of 3768	1452	msedge.exe	96
PID 4004 wrote to memory of 4996	4004	msedge.exe	97
PID 1452 wrote to memory of 5576	1452	msedge.exe	100
PID 1452 wrote to memory of 5444	1452	msedge.exe	101
PID 1452 wrote to memory of 4488	1452	msedge.exe	102
PID 1452 wrote to memory of 4164	1452	msedge.exe	103
PID 1452 wrote to memory of 4164	1452	msedge.exe	103
PID 1452 wrote to memory of 2496	1452	msedge.exe	104
PID 1452 wrote to memory of 2496	1452	msedge.exe	104
PID 1452 wrote to memory of 3948	1452	msedge.exe	105
PID 1452 wrote to memory of 3948	1452	msedge.exe	105
PID 1452 wrote to memory of 2248	1452	msedge.exe	108
PID 1452 wrote to memory of 2248	1452	msedge.exe	108
PID 1452 wrote to memory of 3416	1452	msedge.exe	109
PID 1452 wrote to memory of 3416	1452	msedge.exe	109
PID 1452 wrote to memory of 6100	1452	msedge.exe	110
PID 1452 wrote to memory of 6100	1452	msedge.exe	110

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CheatPractice1.0.4.1\Microsoft.Bcl.AsyncInterfaces.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CheatPractice1.0.4.1\Microsoft.Bcl.AsyncInterfaces.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/CheatPractice1.0.4.1/Microsoft.Bcl.AsyncInterfaces.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ff9adfac188,0x7ff9adfac194,0x7ff9adfac1a0
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,6978870091681348674,7670089839851120186,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,4967433821029356923,14522647170072234377,262144 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,14551421409654210276,14507411998033784471,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:13
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,15116636671009538490,10919614071077050289,2097152 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,17548899772609154050,7061345073690822886,2097152 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11428354591194046309,12729245743935002919,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,8264583063647419274,8730401918499306249,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,6727532090414755869,2548672062981727384,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,3823140073924664818,15775008949621762493,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,6727532090414755869,2548672062981727384,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15023358811454938362,15570817103332328764,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,2776096850400446722,18136329682689456543,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,3601996335237365496,13106777717910016540,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,35920827544127028,5564552656961443876,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15787821314744565745,947904794277386014,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13352358013126478462,12088319259968180461,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,650024501565234359,5030306936195429425,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17444637079324189692,11226688780469214519,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9021667362801819392,11628143620752785355,524288 --field-trial-handle=2264,i,11247547751152207549,8821942517797165236,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0cc97f4f-b4d9-4ece-a7c5-c74e7da9d9d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cc97f4f-b4d9-4ece-a7c5-c74e7da9d9d6.tmp
Size 27KB
SHA256 8bbc88fec1bf39c5a5d958285c83fe26edba89b82a31dc7b42adfafdd73e13b9
MD5 23a3f4fca99896fb8509b737201ddac2
SHA1 150c059dbcc43d415fb3f93bc785797a9201b2f1
SHA512 e940ae054bb07116d2ae78a8e6607dd00b1bebb77df88aa83ee7a366755b4ed95f1691c6c9ba5261c976210a25c2e7f84596e60c203c2a4def4a16ca21b5a0fe
SSDEEP 384:n/iFEQkUSvH38Nb8TUNTUlIRMQnhxg2otzTfoBiFNLNJD6jwN+XfLJ00E2IYgL/w:KF0H3EwgNh9qUBs8bXfpE5qL5
TLSH
T1C9C24B36EC58DABBECEA8E95A7597613EDE04213C98C9AD8DAC91D1C00CB1DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31f80fee-de81-4c44-8cb0-7bddf34b337c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31f80fee-de81-4c44-8cb0-7bddf34b337c.tmp
Size 27KB
SHA256 f3ccc97379cf18e3db0e2205a8f8f1caff19c077aba827c3d36ad123abd42e2d
MD5 9585bebf25de0725b19b78f9005bdd50
SHA1 4f74ec58386c725280dc4b8a2e02a4037bbd0a87
SHA512 314ae8b9bbc75736bd1fb883f92eeb84da92812a89d0ab2c6a2a9e8aa3b987d79014884468a95ae95ac0717533dd29cca650ddb46b1cbb6856991a6e172a08e0
SSDEEP 384:n9iFEQkUSvH38Nb8TUNTUlIRMQnhxg2otzTfoBiFNLNJD6jwN+XfLJ00E2IYgL/w:0F0H3EwgNh9qUBs8bXfpE5qL5
TLSH
T1D9C24B36EC58DABBECEA8E95A7597613EDE04213C98C9AD8DAC91D1C00CB1DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69f70cdd-c669-45a4-adb8-7eff4628a3a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69f70cdd-c669-45a4-adb8-7eff4628a3a6.tmp
Size 25KB
SHA256 052c015c970df11f3f4deba9461e90d5e7d3b5a494a29cc2f93965658abd04a2
MD5 a7981fdc1cdcd7fb11925e8cb47afba3
SHA1 e3ef7579574e4d97572d928389b02dd077ea5f88
SHA512 9ed58e70816b8f29ac0c642f94e2eda2913785a18334972d3da6d8d471abebb185d74d2b6424c1ec055304302aec24729ae6b7209114c1ac502459e6ec40d798
SSDEEP 384:zBiFiZcI638NL8TUNTUlIxBQnhxqkRitzTfoBiFNLNJD6jwN+XW2sa+VYB4gL/7t:sFQ63owg2hzR8UBs8bXW2hgiX
TLSH
T18DC25A32EC94C9BBECEA8FD5AB8A7616DDF04163C5CCAAD8D5D85D0D009A19D0707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88cc4fb7-6441-45fe-8d97-cb5ac57ead12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88cc4fb7-6441-45fe-8d97-cb5ac57ead12.tmp
Size 27KB
SHA256 5284e4953b7666f32b97bb1da27e69a19bd263639e28add3436c691859cedf33
MD5 8f176c98ff33a302e082bc19b90602f1
SHA1 2c45866771486af166c9484b090bae9cd7dcee20
SHA512 996b4d29a074310ce8dbb6449e8f6b917af166ecd9e5908bafa746ce5e5c68572213ccff25b8efdb92a73d63e45ff77499b5fb167c35131a1443623bded401ae
SSDEEP 384:noiFEQkUSvo38Nb8TUNTUlIRMQnhxg2otzTfoBiFNLNJD6jwN+XfLJ0dE2IYgL/w:zF0o3EwgNh9qUBs8bXfCE5qL5
TLSH
T111C24B36DC68DABBECEA8E95A7597613EDE04213C58C9AD8DAC91D1C00CB1DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65e1509a-8547-43e7-a380-55884fe7dca2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\65e1509a-8547-43e7-a380-55884fe7dca2.tmp
Size 105KB
SHA256 9260436c94a1833abca9dcb8131c4cccc5ad060d971912bea100bd9a1f921659
MD5 af61b6d65ba3a3316e74e463b5701b5a
SHA1 6eb4c6b1f52ab93bd585b83e03db2052e8d9313d
SHA512 eb387117515b996bd2a3e1182f8a70e62ac5ce6630decd079365c2ee3e53d58b3e9e3b2cb9655230ce60582101fdeae974849f5c45568c2a24be3d96cdd59fea
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T1E1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

1db630be-ff52-4af3-aa6f-88e4f856361c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1db630be-ff52-4af3-aa6f-88e4f856361c.tmp
Size 12KB
SHA256 d672a1e679e9d32d9dc694386ff083c8f5378cb599c36bbb86a75766eb653831
MD5 4ee040675ab34b997dea0abf4f079857
SHA1 bc5f2f5fadc70f1a029c6e089d07a388f42a3006
SHA512 f2d7c9fa81abfbe715e23545eb78a6e8f64bcc18648b5bfb5848fbcd558b86020370e41f6b820b6c9352f8cdcb048e84a6bf5f272b520fbeab4bc427995f7bc8
SSDEEP 192:sxZkRAcs/f5sVQ705sGUQQPsfyzodpEe/W6+WNGY0RJBvnnqIgjSJ:sxZkBs/f5sV35sdZwb/bG55nqju
TLSH
T1A842D855AD24A93B9CD7E219FB55BB53E2F92132D0C01E44A6FCDA1C01EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

326b2042-6b9f-4a19-8829-aaaa2966be32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\326b2042-6b9f-4a19-8829-aaaa2966be32.tmp
Size 33KB
SHA256 3e380b2b38ac2e9df65d10fa354e36581f89778f7e430cdf47b9e5f945eb4ce5
MD5 59bc756c941e1261bacd005217da6987
SHA1 f32d43ab4f9142679aa91980691504efd1e27902
SHA512 345bdeaa39b0cd4e8ffc51d35fcbff9f12a402ceda52b45b64e9556900a110878fb70dc34d9c7c7332f6ce78481553d073f438117d69e90d456a4cbf809e9fbd
SSDEEP 768:WJ6E28xO2dF7pLuLMV5WRmp3QX/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV36C8sLll:WJ6E28xO2dTEMV5WRmp3QX/u1jaK6C8W
TLSH
T15CF20A7B380CCB7E4FC04A9DDD667F9A6DA8028B9698C94047F9885C02C7BEE51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ef3f466-e7cb-406b-a853-06e3dbd70f51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ef3f466-e7cb-406b-a853-06e3dbd70f51.tmp
Size 414B
SHA256 d62042bcaa5e3e0a2cab69b553dc4d007939f20b02c00f92f8278070e816bc0d
MD5 8b7bdcb00426ea206667d391923e5702
SHA1 299bf09c748cc3073d8a0c14b7dff226346f3bbb
SHA512 8b4a1a83684e9575bf98bea18cb4bce1361e402c8d4bc800bbf908c7e7fd0cc7654b40ba9f082996bce7d0cd3093d9b15aaa05d48d323870c0c1f18df2e7d8ea
TLSH
T1D5E02BE6D871EC2719FD1B1910111B4AE71013573640591F363D8228CFF0936128AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

73fda127-f1f1-4d37-a2e3-4c4f80077a9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73fda127-f1f1-4d37-a2e3-4c4f80077a9b.tmp
Size 12KB
SHA256 a29277fe84fc544d93aaa7d497f7ddbb4fe686ed0faa0e761e07d9ba80f6171e
MD5 4fb95223e4454eab7abdfaa4157da3c2
SHA1 b95cb6345ec8e7f92db450de79cca11151dc4200
SHA512 c60abca1b344a4455b1fef0f20bb0f7d1e1c6023e8fbc5dbc2114ad58df139c3c8932dc17f2f78dadb5e271dfeae62a1fd9bf5e90d3698a0d4ee6cf5de2a6ddc
SSDEEP 192:sxZkRAcs/f5sDQ705sGUQQPsfyzodpEe/W6+WNGY0R0ovnnqIg5zEpNKJ:sxZkBs/f5sD35sdZwb/bG5XnqJWNG
TLSH
T1ED42E855AE24993B9CC7E219FA557F53E2F92132D0C01E48A6FC9A1C01EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91752990-5615-4bbb-821b-9917700f20df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91752990-5615-4bbb-821b-9917700f20df.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a769f020-b1a4-4d64-8fd5-8d0824fe91e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a769f020-b1a4-4d64-8fd5-8d0824fe91e2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

220bd58e-963b-4d94-b9d2-1f1bd1be26b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\220bd58e-963b-4d94-b9d2-1f1bd1be26b9.tmp
Size 1KB
SHA256 3fe080ddaf6d628b5c26d6309b0dc4b7d1a3535f498415c6b44b8bfe3e122f4a
MD5 185505a774eac775b89a03b1e51533cb
SHA1 a375f576b87dd2a8bb28625a38edb60eadcda98e
SHA512 2fa70f0db4ab224bd4c0747a175573dfeaa71dda398e04f7e308cc07bce0ca0822bf02476c28513682e404811ef38e457de5ac7a100d56a4a0ec8af2552f9300
TLSH
T12B419FF3C7E8956E8A0196F0A618BE2BDE1D0524432C7D9AC8E4AF1BD3E3471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

733b008b-2623-485e-852e-9de5ecf46f28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\733b008b-2623-485e-852e-9de5ecf46f28.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e5c3d566-6098-4927-8416-b0c5e4239183.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5c3d566-6098-4927-8416-b0c5e4239183.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 127568b38472f1646a57b9807a5c903ddff8a6d574fe4f26c305a2003ea4f43c
MD5 4e9bc9a321cc324bb013d62d74cf86c4
SHA1 16c604e1bfab430075363139618585fd7daa75fb
SHA512 aa4facd0b864ca1726cd2fd45006b7ee4ec5b2fc7fbaf314b0ea366de68965f87e523fa61b30d2ad4b15868d40a76f9649e6924f5d412abc01cce20aae62cd29
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0B9:80Z/jH0TnaJxzh/Mrzcp3wHb6d3k
TLSH
T1C0B2351131BA12153CFE290D85B49B2F564232B37119EA3B7FBD00A68E6BE445DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db8364a4-b0fe-4593-8770-ba8c6204dec4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db8364a4-b0fe-4593-8770-ba8c6204dec4.tmp
Size 12KB
SHA256 be7d9cc3728461422def83327b81cc0719ecde05924a77a7cf2e4ea2f74d8092
MD5 d702c03365063d038baf8adc9173d4fc
SHA1 eb8723a73475739f171442a5901d589c4490ce40
SHA512 f314c580a34c5a1718d02e83892e8323f2db45b651d4c4f21cf7144d90d60e8eb137917cfa3aca48d29112e65ea8e96c8683555c028d8c463ea7fefa1636a70e
SSDEEP 192:sxZkRAcs/f5s3Q705sGUQQPsfyzodpEe/W6+WNGY0RJovnnqIg5z4SJ:sxZkBs/f5s335sdZwb/bG5snqJ4u
TLSH
T19B42D955AE24993B9CD7E219FA55BB53E2F92132D0C01E44A6FCDA1C01EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 30d9b995f244c5aef4e4a90a41d958933779bcc1777e6c8eb96e6936205ff480
MD5 204982f96c26edbcf4bd85915b9ae682
SHA1 f93ddfeae4a640f3ae912c190801cba47adae590
SHA512 08e9bfa75b284c76b4fa0da8d99e1298dce1bee387f53d486dab693eb949a9a647dd2c47ba78294b1de6ddffb12af135d904c1dd9c95f8ff6bacebe1d64a9a9c
SSDEEP 384:n9iFzQkUSvF38Nb8TUNTUlIRIQnhxz2otzTfoBiFNLNJD6jwN+XfLJ0RE2IYgL/w:0FdF3EwgNhgqUBs8bXf+E5qL5
TLSH
T1E8C24B36EC68DABBECEA8E94A7597603EDE04213C58C9AD8DAC91D1C00CB1DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.158\manifest.json
Size 177B
SHA256 976e13362933c4e9d37530c32a043728f47136ff030f249ade8210d4d1300df6
MD5 27f9a23b87cd0575e13bfd00ea13e3e1
SHA1 998b5c16a3c10772059819448dca88be1af7b84a
SHA512 3a1517e7d3f68d944fa540d52885c2e16d679358c8683997a407720cd6b4b194829017d07b451e58a78879e68cef66ac9e5a1cca3582034a70699709c6ad7f88
TLSH
T144C012DFDC509DB115EB4332156D43C4D733CF0B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

a3539d09-e2a3-4b8f-b2ef-601dc259cebf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3539d09-e2a3-4b8f-b2ef-601dc259cebf.tmp
Size 26KB
SHA256 5e3dcf681374d9d31c6c031068fb92f9714770e70e352e2248577acb82fb6bf4
MD5 2be90983d3545f1e8fe5173d0afa4c4d
SHA1 675c80a6e2e8983f20894ee174dc16f95115d7c6
SHA512 5eef955574efbfea5f63bc281314ec78af16c4f750b97b37f753e6906be3b2cbaeef892f0e5d7542e707c660d37805cf9b0ce46fa9a91447d2dc7f0f4b02f000
SSDEEP 384:zmiFiZcI638NX8TUNTUlIxBQnhxW/ltzTfoBiFNLNJD6jwN+XfLJ0REsa+VYB4gd:5FQ63Uwg2hOXUBs8bXf+EhgiX
TLSH
T1FAC24B36EC58C9BBECEA8FD5AB8A7616DDF04123C5CC9AD8D9D85D0D009A19D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40007460-b64b-41d7-9467-dc824e72e730.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\40007460-b64b-41d7-9467-dc824e72e730.tmp
Size 2KB
SHA256 05e3abee5dcaa750c53788ab4fe3fff3ffe87129177f359457af4715c0a01572
MD5 b629fef44a849ed44ca5ca013ed2b3a5
SHA1 0bd513db9f63cbf3b99dc4b111c96b5f00a328bb
SHA512 0126173301c15c1741ea351d435bf543869522d51cc952746e18b0ec99adbd8154dd6307656a97cb4fca39a77dc563e9397b591f38e1db6fecea71d8180f5f4b
TLSH
T100510EE05C795AD4D1FD0EAEA49739FC94EC9321F4A4343D3858E99C4A7A61E708183F
MD5 SHA1 SHA512 TLSH

Submit Download

8ea2632c-fbdc-4a18-be36-14220f7fff38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8ea2632c-fbdc-4a18-be36-14220f7fff38.tmp
Size 2KB
SHA256 3413a22e18b03bff57400395409d30bf045cca86a83d28f866ca48a2667f516c
MD5 a3397068a42bd400ddf3faadf4390983
SHA1 84f15b4aa20df91f49e11e8305d5b5be7c52ccfd
SHA512 4e9d51283335d4c0ad5b5218e3fd508d70580b274e6c6644d77fb2a1d72f43ceb568e7710843f31be5ef46ef42abc84a30c63ba6b99bf45a4c17b02cd0691d54
TLSH
T10D513FE04C395AD4D1FD0E7EA49735EC84E8D321F4A0343D3858E99C4A7A62E718083F
MD5 SHA1 SHA512 TLSH

Submit Download

21c81776-2bee-48bf-a19d-bd24d94344fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\21c81776-2bee-48bf-a19d-bd24d94344fd.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e3d95fb-5c25-43c5-9ef2-025f59769781.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e3d95fb-5c25-43c5-9ef2-025f59769781.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1452_159490640\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_2079472945\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_493359315\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_493359315\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_etld1_domains.list
Size 7KB
SHA256 1c999530d7fed6e4346d8cfb3933a044055544eea970efc00b114505b9cd3a86
MD5 f3249a6b4b36c4907803ec372e4d2b14
SHA1 c8ef9da8682dc8bba70ffebee0ab4d47fcd89136
SHA512 4b7860cf50fb58c32f136e578d284f9a66dc48c9335e2e45de323f8b1429ff70115032d5c7d0555f46db2ab349f8bfd8b9e24e60d9a867055518a5f4cd7ec360
SSDEEP 192:E9KyU8bqzeC/m4XqLWPgETdT/n+DEDYZHNnd:EQy8eC/m4pzpmDZZH5d
TLSH
T19FE1B0D537C7E2D2C03580B32203ABDEAA51BD40A78A3FE5FF461AC15F55AC7511E118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1452_62722301\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3768-179-0x000001B62ED00000-0x000001B62FD00000-memory.dmp

Download

memory/5048-7-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

memory/5048-0-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-3-0x00007FF9CD4C4000-0x00007FF9CD4C5000-memory.dmp

Download

memory/5048-15-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

memory/5048-4-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-14-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-5-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

memory/5048-12-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-6-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-2-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-1-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-8-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

memory/5048-11-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-10-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

memory/5048-13-0x00007FF98D4B0000-0x00007FF98D4C0000-memory.dmp

Download

memory/5048-9-0x00007FF9CD420000-0x00007FF9CD629000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads