bf74bb4fe1c3fc2b765fe724d28ee861484a51003af6a145a79e7c84044fbffb

Resubmissions

01-02-2023 08:57

230201-kwvhfsee4x 10

28-01-2023 12:04

230128-n82zvagb9t 8

28-01-2023 11:55

230128-n3khlsgb7y 8

Analysis

max time kernel
161s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

onetap v3.exe
Size

7.2MB
MD5

103e516c943ad845c789ea01c751ec06
SHA1

949d2e33507a0096e889a8f14f743f717862d925
SHA256

5af08c95cdab3ec15519685b4a5d543ab5bff7ac9fdc6d5fc54de2f32fdc0914
SHA512

56c2ae4e264bbb2d41d07e8fddeae07d16b5a074d6c1ca1ec2e4ce58642de9541f24740904f83486bb28ea4043cf8c32f21974ad98fad981baa68ed830e2c05f
SSDEEP

196608:HsGgBjriZeOm0+qvG1eRi7U7g2iFoIHcsvNvK:J6jrOA0trklA

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2172-132-0x0000000000400000-0x0000000000FEE000-memory.dmp	upx
behavioral1/memory/2172-147-0x0000000000400000-0x0000000000FEE000-memory.dmp	upx
behavioral1/memory/2172-244-0x0000000000400000-0x0000000000FEE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exemsedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exeonetap v3.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	onetap v3.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeonetap v3.exemsedge.exemsedge.exetaskmgr.exe

pid	process
216	msedge.exe
216	msedge.exe
4648	msedge.exe
4648	msedge.exe
2172	onetap v3.exe
2172	onetap v3.exe
628	msedge.exe
628	msedge.exe
3192	msedge.exe
3192	msedge.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exeonetap v3.exe

pid process

4704 taskmgr.exe
2172 onetap v3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exemsedge.exechrome.exemsedge.exe

pid	process
4648	msedge.exe
4648	msedge.exe
628	msedge.exe
628	msedge.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

taskmgr.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	4704	taskmgr.exe
Token: SeSystemProfilePrivilege	4704	taskmgr.exe
Token: SeCreateGlobalPrivilege	4704	taskmgr.exe
Token: 33	4704	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4704	taskmgr.exe
Token: SeDebugPrivilege	5640	taskmgr.exe
Token: SeSystemProfilePrivilege	5640	taskmgr.exe
Token: SeCreateGlobalPrivilege	5640	taskmgr.exe
Token: 33	5640	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5640	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exetaskmgr.exe

pid	process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
628	msedge.exe
628	msedge.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

onetap v3.exeOpenWith.exeOpenWith.exe

pid process

2172 onetap v3.exe
2172 onetap v3.exe
1208 OpenWith.exe
5076 OpenWith.exe

pid	process
2172	onetap v3.exe
2172	onetap v3.exe
1208	OpenWith.exe
5076	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

onetap v3.exemsedge.exe

description	pid	process	target process
PID 2172 wrote to memory of 4648	2172	onetap v3.exe	msedge.exe
PID 2172 wrote to memory of 4648	2172	onetap v3.exe	msedge.exe
PID 4648 wrote to memory of 2184	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 2184	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 320	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 216	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 216	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe
PID 4648 wrote to memory of 4644	4648	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\onetap v3.exe
"C:\Users\Admin\AppData\Local\Temp\onetap v3.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wuyong.fun/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff99d3e46f8,0x7ff99d3e4708,0x7ff99d3e4718
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,4998333455925301633,13428360391586375411,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wuyong.fun/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d3e46f8,0x7ff99d3e4708,0x7ff99d3e4718
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10518247350797155953,15180466416171225723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wuyong.fun/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d3e46f8,0x7ff99d3e4708,0x7ff99d3e4718
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
    3⤵
    PID:520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4248 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2056,17455999175887802208,7403268202438183114,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4604

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff99d9f4f50,0x7ff99d9f4f60,0x7ff99d9f4f70
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:2
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1248
- - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff66b2da890,0x7ff66b2da8a0,0x7ff66b2da8b0
    3⤵
    PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1180 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1803280292451844400,404060017164748758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
f29009ea952a6c2110125b837ea03d2a

SHA1
298a46f1a856d984b231ad359a768c8cae5b54df

SHA256
a3ff81d9e28adcbfdf776d8881dfeef43757a067eb5dfe5e975286f0076d31ac

SHA512
b44741aff5d727c43ee5fc235489cb74be971c05a0dad7754cac01ba3fa29a04267f9fae2e3592c71d64f30da3ce89febf87140a5240a21d1b9baa0430593e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
412B

MD5
b762953f392468827c80728dbb1fac89

SHA1
35ea337c5198fd172ebc01b4ef63f8e55bcd7191

SHA256
face8530714dc26484a21b7d40e48c8b6ab818dcc91bb053c92d213855c5867f

SHA512
7a6249be9634cd30c8bc0b642f4c42bb87ce2de328369a8e6a9be35bcc6c8518d75654444f85850d7ad884ea7fae7c53267c493829ea9671d9a4bf5e63b9cefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c671a6a3920cf5a5a7b5641546564b1

SHA1
a32dc7eb5fbcabfd80bd3cc83feb61cb439f3049

SHA256
88d8dd693b6f739068b9aff5c6cc8b036af8cd00f0f4df07fe339393045ec417

SHA512
10f63235b9b1d7bc0935ad1fbfd1dcf3d3fb25adba141d951f4fb99f1d01c870de7ed34cfc447598295fc8f051050e949f4eb663a435d3315f953a5896ef7c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
4de6e57402995c38f45b9490c04ec303

SHA1
a852e778b23d7962d1c6755fc615d315928ba1f7

SHA256
f957240e377e50abe6dda81033a0287e538785733c53c2265ae15f3035ff9a16

SHA512
0eddbd3ee3d10ad3a188f761eeed52c11c7562d37d1de0a37808fdf11768c8a93c02801ba3f24ec9c07cac6890b7d9a0584c81f41bfce03ef703fb165f774ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
5d817310b1eeb44033c8df6c7252a1a4

SHA1
14961b45be07710a96c4856c37d2d715cdc7aa3e

SHA256
92d5c91bb40357f85930043d7d9b32b7444d90f06f30520ad9d343a07cea6e55

SHA512
21b4630c8ae4aba2871fd9f097c6d033de33fd2ff87ae764408686abbcfced6775c8fc9405dc08eafc7ff809bb44902e1868f85968d13470dbdbc8afc845b21d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
db41270e60544b25be285a2c03405da8

SHA1
40b022fee42f6d0b887ac58ad166256a1937cf6c

SHA256
260fb180c80c994299ae3d3d20ea9971738187620a04ca39da7b5177e3f7dcc5

SHA512
33275209c9115d7ea4f9692916a8e786d6071dde747c3f1815631a081d7b8431f08a4bb18f771a3e263cfe0aad9bc3f4f94e21fa26606843cd134a71485b5330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
2698cbfb23f8303d17f071b03350bec2

SHA1
99629de61eaa1e06ca0e46af2b32e1dc92adfa91

SHA256
3cede7be7326cf43ee92316da700e52fdc7c2329028c6221e627ec210e2ad1bf

SHA512
5819eefbec5b349c163cc988ed6c29090f289199dc3de9d83c1d07beb5358c731741c96a54396ce4ad81e535da20e8a90705153cd9a36602a3c0d581c3bbcf95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
55KB

MD5
2d8fcbb9f29f719084d3435cd344c824

SHA1
062f704f0b190ee9058935eb7e768d7c146901c8

SHA256
897e49a30133fc49216a2035c3faf1b66b0e48e28a2cf45fc74863d608af8e8a

SHA512
edab9f3835e9b9370ed32ec8c6aeb0d90d123c9734a927ffe035b7a62f64ed7676f744bc3a5164391519bd871a49638dcc362784c0f1d647d5419854d6680eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
60b4759af15d9cacebfeee9d0d2ef66f

SHA1
7f763b2738cf265bfb2d125baba2262c8cc9f918

SHA256
528afa9e42a063abd089a98740ba00042b940e088931ee8e3ca437005b071a1c

SHA512
e6ac293cb25803a7f329124ad82c5364f68ce3a8b1ac0e7516448552530f25f2a57437a0b069b740b9514cfb4e96725bd939498b1f16f4ce1da1c511a008de02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
0a12617923b881a7163fb6c4315becc3

SHA1
ae6078cddfd49715c6fc9d0dc9dc4861164ed9da

SHA256
5ce776b74956b004ba60056698bc03250320eee2664851c4dd4c5ae7c9de9f34

SHA512
c61e22ff81e8021f5afb7a50ab189a631a726a88aceb9723dfbfd09c1b2d58da591cf0201c748ebc7071b0447a1cda09e356d13e1f55d612439410d1dcdf4d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\index

Filesize
256KB

MD5
61bf1e981f7b7ad957327ac216366b21

SHA1
a384509368089581de23c1e74574c163243d7b4b

SHA256
54cc2b558c953e407206a25a1c1864b5b067874c7d4cbf8f7e2b468cca2328eb

SHA512
1ad04d5523b67e31e5bd748d088b20ca01cb462fc09632d78613476bc2d007ee06bd454ef70bffc14b528085c43ba0455e1ff6ae465806e05acef7ba16e5c5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ad904b2e17d3e45604727e9a14a4a6d3

SHA1
a9176fde496d5254a57420d5e65629d2548facfa

SHA256
40e6ccfb266311a3e8cf9babfcb9a38430f3e6dbdbdd8552d2d8af6bf0116fcd

SHA512
13297ae5bcf9fae1c60ec257f5eca596fa6504daceef35b255854bc286fcc5bfc2907205b78474230bf315c290208af4aa6e09539984b8307f6cf0c0f655c0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
0ed6b86ce63a54bcee0b157242275510

SHA1
ab77d1d631bdafc4deb0e6b2cbcc6b5af4053c8b

SHA256
d90ca96b8d0480047768ca0bf9eb625ca302ff0c02f20ed7bfb0aa10f51d105c

SHA512
a9f23edffad77d886e99f8564cb274d1e0349a3eb794908b213ee8f5a9925015b5342a2e82c8e4e758a8ba704d8a2a16b5024aff1c03081285c476d7976fec03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
279B

MD5
8c79ec1c5fc636c45a19745b6db97045

SHA1
d9480a3e1e1eb1a1757843e15cc362522c9f1962

SHA256
3159aa4a0f2866eafc69c4585f503283b50dad7bfc5bf0a54ec98e6c6fe98189

SHA512
771018a6893b2682a4c7d85fe27f7512608cf7c0f0bd193438ccec9318dab1df430ba59c031d69fa9705bef22e759550787ce0a68e1b90e4c18e19299d11fc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
3607f7ba1ab5c05279d1791f789192c5

SHA1
29eb97310618069d62261872bec0d0cac0ab1a51

SHA256
4c33633d50d2c5473bb81cb04258d778f9ac3d18799000ac6c5f75eeb93f987d

SHA512
772517c9dbda94819cfcd5fe878b1173108c9004e665aee08489fe412904f396ca44e974fcd63c7d911277396193d74da6e238852e1e2cb724f38272f9f4738b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
24756ace16a53dfe65870a7c7c78e5f1

SHA1
88a7f67f6f2551f579773fc26dcc7749c20d0061

SHA256
a5948262341f11185b9bada76dde5d0bbe166536fd715aa5486604950d4131fc

SHA512
683d4a4fb8feaa8b12de75b7c816964be262cbc47135853a93e7c4cc5f13fe840c738cbf5ec599b52a26816d76f9075657baece65b81db17557adc6feddf0262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
450B

MD5
cc219d966677f7611a1e5e64558676e6

SHA1
2ebdd9eae59c4bad3839e8f4f03f7e5de0384c43

SHA256
4ae7199fd7c956a3f7762cabf626ac9073ffd431bac3f3c468b2769109cf6bd6

SHA512
3cb02529da8ecc802fb64e83ec9aa54305ef4849d5d873d7af7fc464ee8ed2dd1947090570c9a36975dfb9294bf59a7e5673536e7077d783c67c7d9141124781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
20KB

MD5
19953c591b51bfcd533775b197c9ba06

SHA1
a9b63b791f2c20067299b8a020960de8c5375a13

SHA256
d8bbdf9387e78637dddc0a04bc8206f81f852ed675a49b325b98a94c38c6c21e

SHA512
7c014d40b1443b9f59cd9ddf28d2f88ff5502ace366bfc7a6e9d8be96244ad76c823af478f48ae45197e9c39bf2af16bdc808c94791da1d54010d071a8c7ab41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
87767521e0e55aeab02c2132d2ef62fa

SHA1
bfb0c9a8fb0031db77d8ce857b782aa2923b751b

SHA256
f879afb4ac215dfb199912ddc099f0d9ff41de67c93b7c06397f093bb6c3c4e2

SHA512
f3e58e62f4c9ecf134ce446e12acc0c55d9269d4f43dd58789bee4f9297f4414d7cfd875c3390a108204961e8ef0867739c75a01d8700c537c24254c27cf6928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
870B

MD5
2e0c5ecc5fd944d46f0ce5a521156b8d

SHA1
5a2218c0343d4e217ec6f4f78b25c7f649171df0

SHA256
bd4afd5a9b6d4219828cfc1e39b8348425a1d88a8c80f58060dab71b0f2e5ce1

SHA512
a6a6c4953ab4f88929fa01f21f20de2014f42e229cc460b10cdf51414b85b2cce3f0a5bbcaa45441f511a1de93d1ad69eb40e53cf762a13626ff9b96a57444c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44a0e6e885a2b0c01468bf24073e8e7b

SHA1
a9ad8c825bed915ede6391070f5df5b151f407af

SHA256
e1523da87a488ec865f1c06cb143865cc1cddcfe29be27d2809141829873e234

SHA512
7414e23f5c2a5b1279bb0d8e00154474bd2c6fb37d89c571b302ae20c59dabc10556121a6e14ff71957e4415e3482e7ccb0a5b96782da932d56ce1c08983b03c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
0247e46de79b6cd1bf08caf7782f7793

SHA1
b3a63ed5be3d8ec6e3949fc5e2d21d97acc873a6

SHA256
aad0053186875205e014ab98ae8c18a6233cb715dd3af44e7e8eb259aeab5eea

SHA512
148804598d2a9ea182bd2adc71663d481f88683ce3d672ce12a43e53b0d34fd70458be5aaa781b20833e963804e7f4562855f2d18f7731b7c2eaea5d6d52fbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2c1f1f96d7da6cde8d1ae5f597cc9568

SHA1
8407aceda55cca117f09a7a989e21b8be38d8801

SHA256
a5437473afec1d89a50bdc7e28544537e118069c122a46281e4e2ad358986f86

SHA512
42fc46773d47573ccf40bac6cafb8de9c0b9d183fbefbf4bf006970d53d3c86bef221e4d98a09f4badb4db003963f06567802384898885ec3d95543b6b93864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
99B

MD5
ba92e5bbca79ea378c3376187ae43eae

SHA1
f0947098577f6d0fe07422acbe3d71510289e2fc

SHA256
ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f

SHA512
aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
279B

MD5
e7d91089698a36c814842d6db6e87295

SHA1
4d44ad992bb85017cd5062e802f24136c1272425

SHA256
68b39713db3e8c6c41b07040bc6f40d12a3c97c498c1bd97560feb1774c90a86

SHA512
893221c23341b68f3f13045f97c57fc2fe6fec6fccf638f9aed1a1d2dff23a5a8ce16fa7710e35445551a37e69c74f35dfb628b8114f2b30631bcc08ce63d198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13319384719988125

Filesize
801B

MD5
9492af29515bc99f93e0d41b64e00e31

SHA1
2b9db1f046d0050e218f7e073791fd466b5b442d

SHA256
cabfee61af3731fcbb5587d515f32590eedfaf53216b5ee8c668376fa688de97

SHA512
e3515cc9a963b3f184011225ebca3357fd20a3ae22c0ed46ed4cf0ff6ab069d9136ade97a4b01856c4543c5c14d41850cc04686a07ed901bb06808d3eee4e0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
c75a4e7d6cd0b9e25858033149fcd4c7

SHA1
dc23f35073d36584ee446b5a3e1326a1c2eccd48

SHA256
b6c9a047c1506ed02fa7a6dcd3a43c8e14a36e2b31f7411d8c39a5db32571199

SHA512
6f1008d3326dfdfad386a036688a11b59b472058784cd895c3575d9f2c8891011ad720bb7017dd2d79fc7788fed83539c21b0887d48a06042a738889be1e6119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ec7cfb34f4cfb1db0798928e6a4a5db1

SHA1
315248f823fe9ca69ee91cb63d2cb8d85ce17bc5

SHA256
b51363aa65d71def161d29fbc57ee142dec49902680957780031a80b57d41dc3

SHA512
36292e4cb13191b9d873845228ab177bf2f3abb4307abf72bfd9e3e36efdb6837bf94db4328a0b156e06a5587fe098c0116a3f18180a044ade170d1d1eaf2792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
a6a43baea439c5ef3bc9609cdfb3bd8d

SHA1
d9dde564fc9875423b0748b887a3c3fde99a091a

SHA256
b728faed0aa7a35005b511b77d01d7d5840c7b8641b0eb812020aa720cd283b5

SHA512
6a037060a30dc05c6986067b499aa229bf90c195ffdf7e4169239e6f161b346ec682345d400923a96b5d5547fd70b4faed9666a73405858fb2aa2b2525bbc28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
7b155404e0eb950cd90158eea379ff6e

SHA1
1bea51a39b9d9be47efb354c5330ee2c66fba81c

SHA256
d7ba5e7b78e5269bf68984f22b937d11f7a36433833989d01a352d0b06f95557

SHA512
3f6de3f88a6f1cb7e5ad135c52f82f30064b58f726bced32ada5b79b4cf149825d853a8564ba9c2ae3444814223cb96bf351798541906294c0ac0d660fd9d384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
c6f1d314a35dc9eaadc62697dd3312e8

SHA1
5f014cda4f5f4670bf21691c47d746a278d91487

SHA256
6c11e25abfc224a9a166500fd5a585ac0cfe7a6b9d987d3ade13705889141098

SHA512
700370ce7d161a5cd13b0656908d2a2bd9d7f9baac9a74e64d9c9e69810580f30b2f86b170b11a55fbe89e3bcc94757a91757631c74cccd33f61e9b65dea706e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
279B

MD5
894d25ad07c9aef4cce359fd38b776b4

SHA1
5abf066fe8f5bdf0de16e20d38e812a111fb4e13

SHA256
744611004ee40ef12df8733f57ecd444b07ba7db39d5280f87e143a3b17e1bd9

SHA512
f5122ee7aadf440c77983e811bd5f0ccc62caa3cb022f62732e4c15e1dee0094371dc84185ffb9c2cb06449b357087bbe78afea2e6f5ed9b233081162d9ee8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
160B

MD5
2e19a9040ed4a0c3ed82996607736b8f

SHA1
5a78ac2b74f385a12b019c420a681fd13e7b6013

SHA256
2eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce

SHA512
86669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
297B

MD5
74ac0a416a54f5f81d210b3ca9b59f63

SHA1
ba8ed5f879f56c0d71d10c21b6ebcad4fd08fb6e

SHA256
2bdf96860d8ebbdfa3a241850e98ef8f9552bc041e2ef72d1ab00debe78cf41b

SHA512
34d95df9d635124954e6a8129e2e5abce2ac9abedde28eeba15cd65d30406f3c1a2a1f056fdd53bb752c1febb6a93944545f974c82390245112533432e53a64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
5bc56748e41d88cad65b59fdf4e31706

SHA1
d6eb15dbb506dc4ff9943c1cd502151884a573ff

SHA256
713d436bc3b0d9490065c644be3b0f85289c5777a080d1f7f4322f5780c7369a

SHA512
4075c4559404f1924f25c15dc8843bf44bdf943374590eefc521bfddb9d0b52b7f16140848f8f04d2e1aa412502f0d784be2359e2a9ee0d4ec3dc5be18af4ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
\??\pipe\LOCAL\crashpad_4648_KPUKWEUIDHXMONJS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_628_OSWKQIYEDHPTOWEN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/216-137-0x0000000000000000-mapping.dmp

Download
memory/320-136-0x0000000000000000-mapping.dmp

Download
memory/520-221-0x0000000000000000-mapping.dmp

Download
memory/624-149-0x0000000000000000-mapping.dmp

Download
memory/628-148-0x0000000000000000-mapping.dmp

Download
memory/1088-142-0x0000000000000000-mapping.dmp

Download
memory/1248-215-0x0000000000000000-mapping.dmp

Download
memory/1468-237-0x0000000000000000-mapping.dmp

Download
memory/2000-175-0x0000000000000000-mapping.dmp

Download
memory/2044-207-0x0000000000000000-mapping.dmp

Download
memory/2172-132-0x0000000000400000-0x0000000000FEE000-memory.dmp

Filesize
11.9MB

Download
memory/2172-147-0x0000000000400000-0x0000000000FEE000-memory.dmp

Filesize
11.9MB

Download
memory/2172-244-0x0000000000400000-0x0000000000FEE000-memory.dmp

Filesize
11.9MB

Download
memory/2184-134-0x0000000000000000-mapping.dmp

Download
memory/2312-144-0x0000000000000000-mapping.dmp

Download
memory/2604-146-0x0000000000000000-mapping.dmp

Download
memory/2684-190-0x0000000000000000-mapping.dmp

Download
memory/2784-227-0x0000000000000000-mapping.dmp

Download
memory/2916-162-0x0000000000000000-mapping.dmp

Download
memory/3124-223-0x0000000000000000-mapping.dmp

Download
memory/3140-235-0x0000000000000000-mapping.dmp

Download
memory/3192-164-0x0000000000000000-mapping.dmp

Download
memory/3300-225-0x0000000000000000-mapping.dmp

Download
memory/3528-217-0x0000000000000000-mapping.dmp

Download
memory/3668-231-0x0000000000000000-mapping.dmp

Download
memory/4200-233-0x0000000000000000-mapping.dmp

Download
memory/4644-140-0x0000000000000000-mapping.dmp

Download
memory/4648-133-0x0000000000000000-mapping.dmp

Download
memory/4712-218-0x0000000000000000-mapping.dmp

Download
memory/4776-220-0x0000000000000000-mapping.dmp

Download
memory/4784-198-0x0000000000000000-mapping.dmp

Download
memory/4796-229-0x0000000000000000-mapping.dmp

Download
memory/4932-216-0x0000000000000000-mapping.dmp

Download
memory/5208-239-0x0000000000000000-mapping.dmp

Download
memory/5400-241-0x0000000000000000-mapping.dmp

Download
memory/5476-243-0x0000000000000000-mapping.dmp

Download