a7c90093e472d234feb011738baafc00b902be8f8e6bb714564bdcdbb47b9ea5

Resubmissions

29-02-2024 07:13

240229-h2jxsshh5z 10

29-02-2024 07:06

240229-hxkzashg51 1

Analysis

max time kernel
397s
max time network
403s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

645B
MD5

0e42af5ebfa6cdfd249f2abdb123497d
SHA1

cf41a6c23a8ec81bde87b284a1d558cfb4421059
SHA256

a7c90093e472d234feb011738baafc00b902be8f8e6bb714564bdcdbb47b9ea5
SHA512

f8813bf232f1e4805ebe6b6df817e9a33fdadbc72af71ae0d123f3970b198e7b689003484758687f5fe6dcfe2a6a4ad6a58207246c90e57f89af89cfa7377b76

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133536640397202217"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{EA85E5AB-110D-4E9D-91C9-027E3D62F202}	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1284	chrome.exe
1284	chrome.exe
4028	chrome.exe
4028	chrome.exe
1108	msedge.exe
1108	msedge.exe
1316	msedge.exe
1316	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exemsedge.exe

pid	process
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe
Token: SeShutdownPrivilege	1284	chrome.exe
Token: SeCreatePagefilePrivilege	1284	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsedge.exe

pid	process
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exemsedge.exe

pid	process
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1284	chrome.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1284 wrote to memory of 208	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 208	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 4480	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3152	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3152	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe
PID 1284 wrote to memory of 3820	1284	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd84d9758,0x7ffcd84d9768,0x7ffcd84d9778
2⤵
PID:208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:2
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:3820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:3152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4720 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5248 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4804 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=748 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2112 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5184 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4720 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
PID:2768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:8
2⤵
- Modifies registry class
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2808 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5248 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=212 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5212 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3444 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4940 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3412 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5600 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4644 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5536 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5508 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3464 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4664 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5876 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5552 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3360 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5500 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5468 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5948 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6092 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5716 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=3428 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5680 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=6036 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:2548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5832 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=2232 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5964 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=5792 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=5952 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5840 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5800 --field-trial-handle=1892,i,6402918595463819367,7343172623445766157,131072 /prefetch:1
2⤵
PID:3648

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcd7f346f8,0x7ffcd7f34708,0x7ffcd7f34718
2⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
2⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5392 /prefetch:8
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
2⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
2⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
2⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7164 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
2⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14294440737456265973,15064788460928929626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5cb7e215-d253-4361-80f2-42443a642d2b.tmp
Filesize
128KB

MD5
7658011d81176b368d716604e569d1b4

SHA1
2c725c886aba7b8513d356cd02a1ec40e8f213cd

SHA256
3d879a0f80a9326d28508b6df55d95eb467969c9b31742e019372fdfbd5fbe92

SHA512
a395b8b93a0b9c3cff71b7779f8dc80edef9dc1397d06cae916e1e5a30c0ead618ca07d2e6e467bc2c6ef636c332a4f2bef8c81c180ddcde74825a9300abddd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
Filesize
195KB

MD5
89d79dbf26a3c2e22ddd95766fe3173d

SHA1
f38fd066eef4cf4e72a934548eafb5f6abb00b53

SHA256
367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

SHA512
ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
d7c1aff205928b4583e41a060bac9240

SHA1
72804623741df80ce7ba9141b04b0ebbb3b7ca28

SHA256
eef4b81ac84992901e7755ef81ea613d8dbbb13fc9b743194f8ad7fc26c67190

SHA512
8e4e796b0a03a8c8e29270c9f35fced7955004b0eb779d20840c6629f9098a499314ddc199b8233b7468ab1c5bc5b59f735cdd0937aad7044c168488474f5199

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
1996845f2b6b1a811c0ac9e02636b590

SHA1
377981070c7701cc5acfed72a3679e4be134e774

SHA256
808592a763aa79ed641312a802f595c455071db4ab0d916d3573a90fee6ece90

SHA512
93c167637ed20e3464ac494a57f87e0388860a102015818758cc2a108743d00e6773361db8e3eeb7720a41e32e728699871652be46ced7caf7594f09733d4d20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
1b391497fc4f4a344d9799fb83596d71

SHA1
dc96c2b0288ec105c855394b78d7bd90cdc8f221

SHA256
5b2eed6178c20e3386cab83d270a4b4e636843eab0a85ee7355e407af386f474

SHA512
1922c6f50a973f2ba966c79209968a6162018fb431ae87f9fb9e7ccb6661cb3c487a2c4f89988416410dbaad13ca213be0532bb614f3f054b383e54b5ed794cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
ec3aeed09f70bef097539b8e76639ce7

SHA1
9b6fbd0cf63162e6d4ce03d0eaad9aa405c77c60

SHA256
c16ab35b265b57c20ac89f43604af70d23e885fd6356119bc17c0c1338acfb61

SHA512
32978ead3ffb02ec7fbc20789c695960bdea44785eed3204440e0d07f69ed0f2f747ebe61963916ccfebf5966be5a111bf422651d996cc99957ad8bc771ead6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
6c09e71b0e611fc89deb6ac2b3147c2e

SHA1
ecbb62403cff70e11aa258ea8855b151311f6351

SHA256
db035d5aef41e97fccda9f2aa8e1763b720be76364387ff80d856f695e7556ed

SHA512
0402a84459875eaed09178c476d813f3dff25fe6ab80fae56d4a11c449c6b76eb86543bce1fa6f31a81bcb4b8dab031ed3342b1bba9e5b797f156165789445f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
61ffa327d7d0e1b13df25d06aab3a474

SHA1
7ed76aa1def01958abf69aa7209e7f16ded2be65

SHA256
54ae23697a0e7c90cc9a302fff1b51f3cdeecf2d42ff46822d81d821e14ca035

SHA512
5e892b0e78cba648531fc8359718d9665167c72d0c4b412bb41b24415a0018caa57cc00823a1cd43c166f27fb6fb07a6834894ebc27eadcb69ac5f1808334c98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
86fd56970bd223a3108c33142308b3cd

SHA1
98a0ddb4ed18265b4819710a4047af15308e5569

SHA256
c9edb956f1437962f584ea301b0ca9a066cde9f536199bc2722abcbe21ba1386

SHA512
37b1e526444487699e53a67b3ac1233c53ce23f5973ae7908ee9c4348fe96150922218423203a542bc95047dc9318ffbe1ce0cc036d112f1b43b856201639afb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
369B

MD5
2ccb1c56afbf1068307fa45168f30c30

SHA1
2cf2f1c83240af1e3f9184a25f7dba9e852f72b0

SHA256
525d93a91c3c7bdec8904078c3d1f34413dd26c2e02254bc486531e760bb29cd

SHA512
a37d3ac8d0c8802b8ed73eb0e4894d44c288af323068547e52577e39ec4feb286d80af1a2550acbbaac8fa82f4617728947802f26a012f93af9415c82e3ae56e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
489fe51e07cdf9038a853b34b6124545

SHA1
9ba6379c7f292d62ee21bd5aa02aa2ba37b25929

SHA256
8c98d24f8011b3da793cb30ec9e8539fe503982a1c6158b71b3d7107ff07b66c

SHA512
93539cc33dc6054a6c78a2dbff92f7a393d2059074424112b67bf5abb5235389f6c30289dfe6e9736078150c7b83af24be01eaa581433bf5553f0b83d341ea22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c742bbb4afec56cdee39ed155c173e54

SHA1
951c0ae7830de969046cfab2bbe985594e82fd65

SHA256
ea699f6e753111af6d81fe0237648e44999c56493a077da16508fb453ff67e1e

SHA512
6eaf929526df75851329756ca68b15250f408abe4b483ab31d78bb5cb8747dbcf1401b7f0afae432d30162c47359deeadc91863f00535c0c9b7829c8f0e86805

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
86b67694ad39949cdf87d28dba6df3df

SHA1
bc6b219e70bae01a14ec3cf38d7e5d1e1c0395c2

SHA256
38c707bf8d92312fe8fb41830a897cab6d2e50abc009877285f133835dd1bc5a

SHA512
07ea2e67cbab0c6fdc3851e1085e58ab015f5918ea21924cdd6adf8f6ec5518ac6df54129b732a8f7ea1db0b3c60d0fe4a4da240d4aaf27b3852f8d03cf968a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
68416612845614bedfc81554382048fd

SHA1
6e001dccb574379a2d30db196c6d17b22dd8752c

SHA256
ee68fdbcdeb6ddfd193b82e8309e847646b581051d82ea6d8c9bc2cbb50b1b79

SHA512
dda05455bd927fd84d8b2b65680fef0d382a4a04f138eb165ed22ac8c413701ef392ec59a4058fd140ab2bfc4a4d955bd752dcde3cb5bf372c598cd968a6cdff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
9fc5d93225f55c468c5d9c3c94b35ce1

SHA1
52a6f51e0af4b369ff625d9c1c29e056904c1cb4

SHA256
73916b58b04d0ce472f00ab764035ca9a8f649cc2ef307604af65f617b3f2a7e

SHA512
76359f1fdfb90a7afaa93f30d6ec6c91e8668c00d460eb8fa839c29b10aa58227941b30d3bbc16121c14b1a150559a571a05d15cc3d286dc777e75eeb0b7f786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7ab94b48eacb7ab0d198adfe9d76c295

SHA1
7a26fca1af96b09a646d9179ba5835a096638bc2

SHA256
41025df46afa422b088031efa809c02325e4868fe26ab8358b75f508df7ef509

SHA512
e731de005d4aa83ca71b07f6db07179a9b2ed32ec750d96f4ed3e2f2a4472ca605a00c12db0ef72c227ccdb3d58ed87226ff07f9584f48f5b6439b9109e48be8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2b183283386b1c529aca24186b53d0b3

SHA1
2bb774ac51044d2f9369fcfbf4a4065c7de4fde3

SHA256
765c5557eb1e9c3d9ead37eabcea142ca691c2d7cd06c6900825cf73f1e8c432

SHA512
3787c2a5b51697b3afaa2e95edd85203dd0156f0ff5b562ee9f2e9df61ffad99d34bc23efdbf3c02ce8001302c0e4b77341cf2ac9e12c4ff0617c8fe424ca3ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
fb19b6f5a25b78b954b4123c979c39a6

SHA1
659d41631c1a83c3e827a924dbfb8b59d450adff

SHA256
8da62053641ecdd6ad7d2f681a0d2cffef81a1f3db21f105d7f14db918f5b0fe

SHA512
a4514b46149219823e9dda24a86e0eaec4d68d4dc49172c3ebd2c26b2b968e3bfbc9ced7f510ad9818bd583f3c556906f810ebd18d3d6d0443a8ad15e267e665

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
141c6dc60d3aea7477f0656f785461ee

SHA1
218ed252e6c6d1addc95fa0910fa55645f55e7fb

SHA256
90bee0f79457b09c45521ba3e79d9f1f1bcfdd1c218f7a35eec28fec5ce28f21

SHA512
f098b93a5de872485f990e152d8dd98cf80309fd4c499e728b4ca87776150fe0b1edef4507c5a57638a33cdf53c3e189263610a00546a765de291f298bfb1bad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
24e762e36b06828d051a193a7087d04c

SHA1
b87f36ce710a8dc4e29543d5eac3c77d62fcd85d

SHA256
d311b1e1ed0335276b08062e79b1cdabb0cd4bca89f7e79e7c994a09e9f47a43

SHA512
21306e0be13369c0f0d6fa36853ed5e5f4c9a1d345360a464b7209021be93b444f2483771e7f8f9be2c54ac4ba76fa3b49e2ab91b62884fa99da9d75fd9c5d95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
45dc0aaa1da368637d984b9e1dbc46b1

SHA1
9f9931d33c116428beead8a971d307b2d23a5438

SHA256
b69b2b7e2eca27f036c69738bc4060dcdbe6d016d2f310b2a216b8989504f9bb

SHA512
86a17a65161379506a4e7f270ff7aec11c877ade0c617dced89bba74aa44a9f9dc1f43733fbc497764d34fbf400a2d745c7c7c30d5187f3d926904dc4a769242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
98KB

MD5
b1a07d9e036191d1df2367c7a040c279

SHA1
897d0f8cb6791c5755e004f82d309fa9c666778c

SHA256
37e5249134fa4f4b4646b1b3053302c60edba896564e63f85b9f0f976db95a49

SHA512
171f6afe06e2dddc9ed3221a6d74f0c3976d42f33e155c69016b81ac5fd813a899d5716539e81c00205e0ef942edecb0c54158a7cb75422ee10c887cb31afa0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe598320.TMP
Filesize
97KB

MD5
cdc49139869e560c6c66da65f8ffe79b

SHA1
62e7d15c12481792b5c697a05b2d60ee6f0676d0

SHA256
a5e194ff611c90110836c4c2c1c3148bb0032190ac766d2c39ff4234d0cf0be5

SHA512
ec314793446c112ab3328669544995e4a324777a36fe61f4ed111c67230de3de671f758ba1f5d97dabf9b6c702794ab41de085322462c8c5c700582192d83f39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
3878f38e32eaccaa52d5ed15dba1ca76

SHA1
26303b6cd8183a66c3d8b5086cc5b2cf39713ab0

SHA256
d05e6833728b8f75df4bbc7b4261fee7403ef927e3cf758e0af1134bdd840fa4

SHA512
9b38d7f20550daa6c517087040503936f33eabfbbf31921006b75a945e7cfcc063e255c4ec91b453fa79615e5c4fde9ba7836ae83cc480036c60d19a45db014e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
a0a9d735d1c5aa441173026537914df8

SHA1
13e65dfbe85a4b9fe2cd73fef477ebe561a2fc91

SHA256
c35c5edacff8ee589f6e48830a5c8533f8b8aa845abd0e6fb6123ffa5f463190

SHA512
be26db1b57c0e728f340199ea4099aab9fc3332748f0c8244ea051516ba4991701057c9a2fbb0ee6afc172af391f2adca1b0524b407578945ba7413aa1ba3547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
320B

MD5
5da30248c0dd91b3ef95cb30b6aab5cf

SHA1
643ae98d5f26d0adb0f9f78b1c71991e36734372

SHA256
ecced9258638c2a5ca515b604f4ec7d4c5b28951019ec6208fc70639a1fd6357

SHA512
fb3c4ddf503f2f5abde052f7fb82cab6151701c0539fad0f16591762f99683f6959442698937756e6d5f0cd4a7df1fe18a9bb425012db6c35d5e7d2de739862d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
402B

MD5
cd89a57b58a297baa8b0ff05ba25039a

SHA1
d3ff4c858bc4879073eef3a4b1edeeb9c2a0432d

SHA256
1e34c5ee858ddf8e63dd2e8f5ebf0b8c8ce99ddd3fe7c4296bae22c1889d42ac

SHA512
4f6f16b49b19ca4d0ffa3bbcebc0d22f69fed75e53623e18e8d7d9040ec25bb5179755cf018fddc2fec7fce18b9c64d5b0f8ad5c4d050e4acbe1b3a455b6917b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4700d607dab0a0e41fac72bdba99f585

SHA1
14f8d94002f782e2b879324e5b7291d950e16896

SHA256
69e7dbd360bd834be9bf4a3818f3740b2cf08242883f74018f9ea1336ca2dd2c

SHA512
11e04144b6663cd7cba384ff6ef76cf0127641f5e8cd5d7a7cf4b3734935f4deb86814f5c3596f2f720534f0948098b4a15d2baa5d2c27d202d41bcd23f06cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bc1e692cba13804163670a9ad704567e

SHA1
cacfd3f1bc0cf7e8d07d45fdca0342d8c37911e5

SHA256
1851404d18096f28ea042b25a5247b6568ad9ac0764787b7dd21b9982a2cdda7

SHA512
bfd28f66bcd262e5871464f322012966cd0b34a46fe7903c1e3769651f1695b5b156044c0ff9c395b438a3087ecad4181be4022a738703cae26d7a81aa1f4653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
cbbaf9f7291e13b2bd78bfbf21c76d15

SHA1
d6a05cec166006daa976da3ad6aab5edd6885bfa

SHA256
e3396a69cdeef07c8cf413607f64901e12f340e6ec55e1be4477415f70a7206a

SHA512
be9576dff6011cfefad97bf4b9598a078e822ecaee095364bb5d861e16a4dd232f4c1722284f76c007415a2814af219f3df6b3f05d24d95104e9df9e43d7c1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7a421563c81fbcab9c61a30203033144

SHA1
81ef8311512c284c315ce1b385741d52eef1b4f6

SHA256
2b08426590b34f2e40642d9654a4cfff9478ea2bd006c6c942e34cb269954a79

SHA512
be3d8b06f9bfa8c70100239b8841774e09a28e384db355eec3f9d6f13332690d748a378c00d649dcc9edde09b6463c13ccb1af67a2aee98166e09e263b775bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
8002e59e813c6e44d63674efd81e6b64

SHA1
26b5fdd3a492a94bbdea50c115998e7d77fea810

SHA256
98dc08315d34c8def0868af7f4432e04cdbab5e5f5f0ce85ed53695c3abeeb8e

SHA512
fb0af37ad3fe0b9c3990ab321400f6e6f98c3fc5f02ece6f5446fc14244e7e17e5e4c25b4cb2554e3ad1f55cc44d0f42b56e60df208fab230e774681642ecdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
0a33b2f8ff50ac34a9261edeadcfb3c7

SHA1
b0b073f1b86cfff166364a2dd5d49d597cb5ea83

SHA256
4047f7f0df5fae5f6e202993a9aea799e683ba28e504c713f2093dafbb55e029

SHA512
4fb2ed987020469ed4107b881ed38ed6304860c730d49c7fbd55e322c5d8a9bb00d275a0991424dc10ad0773ae6861787fdae7af7147c9eeade212dad134c08a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2769cb86b4314f0a849e31b52fae0f09

SHA1
14dbd1c86a310586cab1df756101dbfb9b975480

SHA256
fb2d196630d03cfac9c3bf02ea1b9ccd08dcb429f6bb2bc15d58a2820209d6fb

SHA512
47dafafe0c701cd635182738cca2058c07ce550b0510cb2338720f80aa857f55e538a2447569addd072449ffd5f47da590ba99ff9eeae9f43b4e4a8ee12e8eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9aa6a42318729e258e2cccadb9630ac8

SHA1
30335f8979178ccde1d8328206581b2ed258a6ad

SHA256
fade4325df21eac490a779f2ba802f93e5f1fe50ece90ac544c9c646095ee4b9

SHA512
fb95124a78c1fce718f6bfd8b3a36e6a8d4b8653afd4c75e97c88bf1c672aff7fae30d4a3bfbe508867ab16b0718ddc50208d2ac244a67e455dedc7a6383b4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
b0c36c903c51fabc71f65dc31301379a

SHA1
726f21a908569bf50fed5da398e01d947c92f7f5

SHA256
c4c02720c683c4bb1a2a6461e52d04c0654eadd08e8b0d12cd8021def8d5b487

SHA512
ee14f6fa8345c348c0da8909c240701548bd95ca1e5d794c213269319052aee8d879ed5c6a35d5fe29b6e20071c4b8effe0569250a0cceb13af24b4c623c10c8

Download Submit
C:\Users\Admin\Downloads\86c7667d-bfd3-4a01-9a9b-aef26872a31a.tmp
Filesize
15KB

MD5
7f916978b1fb2dd20c202a067e06197d

SHA1
a3625f147229d6f6051f2b8e33d4060015fa853e

SHA256
1f8920c273d9bc818901ca22824e022379f5746a1e2b82726f61d6992fec1369

SHA512
cfae5724bbffeed2a9994efa1af0c01fd45ef570c34337cea3a2b83ad89962e864450d8f3694fbdb8a2b59da1131f2fd66e5132003cc258a0698cebf33430a93

Download Submit
\??\pipe\crashpad_1284_IQITYCAFKFWFUVDO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit