0a411e6a7f0499422b355db020dbc65be2cd2ef1fa297b752587080e66cac8d5

Resubmissions

17/04/2024, 12:21

240417-pjjbwaga8s 3

19/03/2024, 10:24

19/03/2024, 10:24

19/03/2024, 10:21

19/03/2024, 10:18

19/03/2024, 10:07

19/03/2024, 10:03

Analysis

max time kernel
184s
max time network
186s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EEEE.webp
Size

29KB
MD5

9485ce793d80b28b1f1a5041df199f36
SHA1

cc6ef9708c3d31f6285e6172745f3af032d8342c
SHA256

0a411e6a7f0499422b355db020dbc65be2cd2ef1fa297b752587080e66cac8d5
SHA512

e547b8ff6d1b5c54740426ad387530acedb1778b2d79f10ce793eb4adc8b85b02078622a188dfa0428e500918773095a60faef4285059ed43418872e555c478e
SSDEEP

768:iHv2vZr2itn04pqNFiFe3QCtVJ1b/7z8Vi7lo:F2Kek4QC7J1b/H8Co

Score

8^/10

discovery persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\122.0.6261.129\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Executes dropped EXE 15 IoCs

pid	Process
3816	ChromeSetup.exe
3800	GoogleUpdate.exe
4396	GoogleUpdate.exe
2332	GoogleUpdate.exe
4180	GoogleUpdateComRegisterShell64.exe
1608	GoogleUpdateComRegisterShell64.exe
4732	GoogleUpdateComRegisterShell64.exe
1964	GoogleUpdate.exe
4764	GoogleUpdate.exe
1620	GoogleUpdate.exe
2004	122.0.6261.129_chrome_installer.exe
1876	setup.exe
1132	setup.exe
844	setup.exe
4532	setup.exe

Loads dropped DLL 14 IoCs

pid	Process
3800	GoogleUpdate.exe
4396	GoogleUpdate.exe
2332	GoogleUpdate.exe
4180	GoogleUpdateComRegisterShell64.exe
2332	GoogleUpdate.exe
1608	GoogleUpdateComRegisterShell64.exe
2332	GoogleUpdate.exe
4732	GoogleUpdateComRegisterShell64.exe
2332	GoogleUpdate.exe
1964	GoogleUpdate.exe
4764	GoogleUpdate.exe
1620	GoogleUpdate.exe
1620	GoogleUpdate.exe
4764	GoogleUpdate.exe

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\122.0.6261.129\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.372\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\122.0.6261.129\\notification_helper.exe\""	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe	122.0.6261.129_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_fil.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\CHROME.PACKED.7Z	122.0.6261.129_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_hr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\uk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\chrome_elf.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\ta.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_bn.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\122.0.6261.129\122.0.6261.129_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\sr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\notification_helper.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Application\new_chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_pt-PT.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\resources.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\chrome.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\122.0.6261.129.manifest	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\kn.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_zh-TW.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\chrome_200_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\122.0.6261.129\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1876_1828675020\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_mr.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\122.0.6261.129_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.372\goopdateres_sr.dll	GoogleUpdate.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_cs.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_en.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_sw.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_tr.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_sv.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateComRegisterShell64.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_am.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_lv.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_pt-PT.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ro.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\psuser_64.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateCore.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_pt-BR.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_zh-TW.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateSetup.exe\:Zone.Identifier:$DATA	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_el.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_is.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ml.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_vi.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_hi.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ja.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_kn.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ko.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_no.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_zh-CN.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdate.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_id.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateBroker.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateOnDemand.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_sk.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateSetup.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\psmachine.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\psuser.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_fi.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_fil.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_uk.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_sl.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_es-419.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_fa.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_hu.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_lt.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ru.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_en-GB.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_gu.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_pl.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp\GUT8351.tmp	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleCrashHandler.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\psmachine_64.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ar.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ca.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_te.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_bg.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_mr.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ms.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_ta.dll	ChromeSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdate.dll	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\goopdateres_de.dll	ChromeSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553162584478862"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LOCALSERVER32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback.1.0\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32\ = "C:\\Program Files\\Google\\Chrome\\Application\\122.0.6261.129\\elevation_service.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ = "IProgressWndEvents"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer\ = "GoogleUpdate.OnDemandCOMClassSvc.1.0"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\PROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\ = "{B50B3FA2-B519-4C16-A932-46E9FFD1D910}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VersionIndependentProgID\ = "GoogleUpdate.CoreMachineClass"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ = "IGoogleUpdateCore"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B50B3FA2-B519-4C16-A932-46E9FFD1D910}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\GOOGLEUPDATE.EXE	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ = "IApp"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods\ = "13"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\ = "7"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ChromeSetup.exe:Zone.Identifier	msedge.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateSetup.exe\:SmartScreen:$DATA	ChromeSetup.exe
File created	C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdateSetup.exe\:Zone.Identifier:$DATA	ChromeSetup.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 633939.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
3860	msedge.exe
3860	msedge.exe
1968	msedge.exe
1968	msedge.exe
2464	msedge.exe
2464	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
4932	msedge.exe
4932	msedge.exe
1088	msedge.exe
1088	msedge.exe
1776	msedge.exe
1776	msedge.exe
3176	msedge.exe
3176	msedge.exe
3056	identity_helper.exe
3056	identity_helper.exe
2320	msedge.exe
2320	msedge.exe
3624	msedge.exe
3624	msedge.exe
3800	GoogleUpdate.exe
3800	GoogleUpdate.exe
3800	GoogleUpdate.exe
3800	GoogleUpdate.exe
3800	GoogleUpdate.exe
3800	GoogleUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeDebugPrivilege	3800	GoogleUpdate.exe
Token: SeDebugPrivilege	3800	GoogleUpdate.exe
Token: SeDebugPrivilege	3800	GoogleUpdate.exe
Token: 33	2004	122.0.6261.129_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	2004	122.0.6261.129_chrome_installer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
248	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 460	4216	cmd.exe	81
PID 4216 wrote to memory of 460	4216	cmd.exe	81
PID 460 wrote to memory of 4348	460	chrome.exe	84
PID 460 wrote to memory of 4348	460	chrome.exe	84
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 3160	460	chrome.exe	87
PID 460 wrote to memory of 1564	460	chrome.exe	88
PID 460 wrote to memory of 1564	460	chrome.exe	88
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89
PID 460 wrote to memory of 1272	460	chrome.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EEEE.webp
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\EEEE.webp
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xe4,0xdc,0x10c,0xe0,0x110,0x7ffcfb9c9758,0x7ffcfb9c9768,0x7ffcfb9c9778
    3⤵
    PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:2
    3⤵
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:8
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:1
    3⤵
    PID:1188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4760 --field-trial-handle=1828,i,12284220927577362673,13585718659282833501,131072 /prefetch:8
    3⤵
    PID:1556

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfc043cb8,0x7ffcfc043cc8,0x7ffcfc043cd8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,14721682574304514716,5136985395073953197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:1
  2⤵
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x0000000000000478
1⤵
PID:4924

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfc043cb8,0x7ffcfc043cc8,0x7ffcfc043cd8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,2700213692901693920,5608503365197256177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Users\Admin\Downloads\ChromeSetup.exe
  "C:\Users\Admin\Downloads\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - NTFS ADS
  PID:3816
- - C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdate.exe
    C:\Windows\SystemTemp\GUM8350.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F520D964-3488-9298-EDE4-3DD7FEEB6DB7}&lang=en-GB&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4396
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2332
    - - C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4180
    - - C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1608
    - - C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4732
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjBFQzJBRDUtOTVEQS00MDQxLTlBNjgtNUMwRUM4MjRERTk2fSIgdXNlcmlkPSJ7MzcxOThFQ0UtQTcwRC00QzI0LTg5QjQtNzk3MDA0NkJBOUExfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezRDQ0Q5RDhBLTYwODEtNDFEMS1BOTU0LTY0NEJEMjYzMzJCRn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTUxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjM3MiIgbGFuZz0iZW4tR0IiIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9IntGNTIwRDk2NC0zNDg4LTkyOTgtRURFNC0zREQ3RkVFQjZEQjd9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjY3NiIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1964
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F520D964-3488-9298-EDE4-3DD7FEEB6DB7}&lang=en-GB&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{60EC2AD5-95DA-4041-9A68-5C0EC824DE96}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1620
- C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\122.0.6261.129_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\122.0.6261.129_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\guiD1A0.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- - C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\guiD1A0.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:1876
  - - C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.129 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75bc227e8,0x7ff75bc227f4,0x7ff75bc22800
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1132
  - - C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:844
    - - C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{AA4C7D1A-3FF2-480B-87B5-4E59F0175E2A}\CR_BF5E1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.129 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75bc227e8,0x7ff75bc227f4,0x7ff75bc22800
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\122.0.6261.129\122.0.6261.129_chrome_installer.exe

Filesize
36.0MB

MD5
8483ee03cf494c088c84a83cf3ef6621

SHA1
b5eb81e2b75c56dd554135224871b86c26b89bff

SHA256
455edf85c32faf58593f3e7411fbd5b85844f3e3e9271222fcd6fc8d4648cca9

SHA512
2f0ae50a50a330d382f4d004147964be0f6c9680abcd71f886e00e811f097d76a775cc2e3b814555dd61e98819e84b17810a4e08eeb673eaba7cc268a71b4835

Download Submit
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Filesize
158KB

MD5
baf0b64af9fceab44942506f3af21c87

SHA1
e78fb7c2db9c1b1f9949f4fcd4b23596c1372e05

SHA256
581edeca339bb8c5ebc1d0193ad77f5cafa329c5a9adf8f5299b1afabed6623b

SHA512
ee590e4d5ccdd1ab6131e19806ffd0c12731dd12cf7bfb562dd8f5896d84a88eb7901c6196c85a0b7d60aee28f8cfbba62f8438d501eabd1bb01ec0b4f8d8004

Download Submit
C:\Program Files\Google\Chrome\Application\122.0.6261.129\Installer\setup.exe

Filesize
4.0MB

MD5
a42df874e4507a6cd9c58af18501e078

SHA1
5b489d74acbfe2fd706cddc61dd11d60863fd53d

SHA256
6595f5168fd5686311e1b43cfbabe6be57f79b102686081a64ff839730bd762f

SHA512
9d47c4d9d6b8faa0e74908dcaf02f8c09eb025be3d46f91677672472ba1a07b64b9ec4c3899bfd76bdb071923605efeb7e686f16dbdaaeeb7242693cbfa73b30

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\20240319100705.pma

Filesize
2KB

MD5
41c6ccb7a059ce7594a223ed7ba54ad7

SHA1
1812def571a95c7b654bc53d0d23a2b74c2b17fd

SHA256
4204e0768f2b49680f4caa8d1be68c121cdfb75591da4698ebd6c0e7f3a5b618

SHA512
5fe7c0bed2d820260b7959c9b420144d456d960d9fd684427f52c3a39fcf19fec006d5fb863ef60d35028dc8f59b3a09949d7199ddf705baa7b4607f0fcf1f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
be3db4f2a0d0d5610887c26324536283

SHA1
43a7983d93c03c820183b5fc1bf63747f90ace89

SHA256
1d9bdc1c7c87ce540b19b4959affd280030d58b80bab8ddaf83d1d3129f6fdbb

SHA512
eb847020528257ed57f8464e0c73eb0c8e27e8d8e5465c446f525150c7ea6d061159431492cf92cbcbf070dd0edc6d5757baa95c2c3cbb4a23d1b7c78133db22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
831be53a3f616af9e24c7f2e754aea75

SHA1
094f7cef4b5d3abcf861175798c9cfb4f238b489

SHA256
5fb07ac81fcdf966ba9a30f2aaa2d89064ac5e4e4233ee1cd6c039dfa3a5f84e

SHA512
b077de0026afb853c4905194131e873eee23aa81630b64c98e7a65abb550e7857692b3da3e4ba4b0fa09dbdf565022e4704720c52d0f3a8bb1ea295545afe40e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
4199a26566d658b3a09aed6c3277652c

SHA1
3c911cf5733ccbe99026f0f72d351d418cdb58e6

SHA256
f5a3d305c2cccc72a8e59d9f57168f799de2de0008ef723e94fbacf4ca937ff6

SHA512
96fbc1f0182f30a91c4f6f7c8289f747896746465fc53df2dacc68ed0a0b763726d2f7459869e9f35e5783e9cd1409c9932484f2dd5e21614f86f889fc06af8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
88532ae444d027422998e0c4df6b0e43

SHA1
272c24885b862813af1179ff8cf369b3902858f6

SHA256
98fbc8cc64d5811d3cdfdfe39e99e49bc96f8c717a4b57d278afef7465909840

SHA512
952ffbb3b3d0809f390b87039ef4b73bcd24b2eb3337db117a4c0e8a9a6edf74c3fd93c684694f0ef67b7cc2e42522d5ff0c93969863ec23e19766994ee92289

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63707d94fa97e708598c2357f2a43691

SHA1
b7b31905c612ffb7e4fc89469adb3e513286e366

SHA256
97af0badb4296a79fe7503633604c7ea33328d335bc137050f35100637628e7e

SHA512
c6380a89e8025e55a3b86c36e55017241efee9c9e0237a89d3d85c58a9c9ce71e7e305b18d82983af8255657f26f71e7bab36b4845f9cbb6cff4d66be330d173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f998a68afedea7139e122f8f471f990d

SHA1
605214730094a6ef6fc5539699a4366a3b08f265

SHA256
92260ddea827afa0adcffa2ed7cd00d799427cce3dbf52191a026b14d7799868

SHA512
6fbc9b66c422f107b8311ddadf3f5aa7b63707bef4c77defe98bb2201cf3474df5a5b2d7913bbd15b70250e7584d2ef66046d9b60ae8ecc46dba34a9a2061ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f55fd04-4273-422f-b763-b93080011ba7.tmp

Filesize
3KB

MD5
ce46264af5a87b05571a08d79472c7d6

SHA1
7c4999d78ca988d95ef210406641c215970b224b

SHA256
77c192feeb128c234287423f13b37032107ee6edace898a1a4e29a9c4dd0eb06

SHA512
d5cc6d19ff680a6d43d86943edbe43d6bd13c8d4a409f89f0ff272c6038f19810beb3a4b020417aaff49a78cea369e27e1edf3aaf08788567022b0de05743e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93fff714-9ac5-4b7e-91a8-c86c1b340b05.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
32KB

MD5
3baf7c2e036abf00bf52d8e4a918e970

SHA1
0eb5406e14050dc41227ba74b64a38da778fe5d6

SHA256
d30dcb199ca26a9664a46c01b4eccb26f5b8682f04480d0a9d2beffab7d0a049

SHA512
c12875c0e5085f534496ca9f1f43bc4d5097f6d4d969f70ad1651bf01bdd4e9f5e27c93413ef0589c06c647c0a22d8c4b7a2ffbda2fe61bdeb84657f53a6a429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
f5c0f13a6a7bef91d6eb9201967ebb39

SHA1
7266af416beca8cf9094aba9ca0b40e079507774

SHA256
6e4a5bff509e5c73aed316cb16906e0bb17d9ffe0e5a5442fa54207c1da52b93

SHA512
974dcf39306570b5058d3b0f5db474843d6341d86d23c021fd0fc68991bbd067c9fb2231a9741a485d04b77e711cb4338cb79e868ecd81d28cc779ab87659484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
196KB

MD5
813c1b41e435242e7365a4bcd7adcf23

SHA1
2d25e1564eaf93455640413b95646b3f88f9075b

SHA256
70cb2151ee4ef83195855d29819491a23c5eafee2e72b7ffd9041b35363d1542

SHA512
268c4fa1797700a205e37e716c1472592ad6242344645c703ab1ab8d4d68452c3ccce7cdc4d56a0b42d4061bdc793f1c79dffc397f038133387b94b2a1f4051e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
47KB

MD5
ad2c8560882d764eaeaff58b0b891c87

SHA1
155c320400e20083e74e368ec03a4ad4db4a4ead

SHA256
ed9c0a264d737801dd0c983fafe87cf3644f4b9351779ba1580a5a06fe39f999

SHA512
2be122c72ecdef9a4b50e8bfca0218da4aa577afde773ec51b35ebf79f01f98d1b0040bcb947cb351780911683d844de4cea05e4b147ca56f22a6440ec59f9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
72KB

MD5
dfd25dfa986a2c9dcd30ebeed4eb77f6

SHA1
c57fcb13f28326b5bd0833cf97328704491b3865

SHA256
01c2ee9020b54dec58db11d1714c61bdfcadc36048cbfa47f637c91a373ec236

SHA512
f9e21909c8b5bfd73d81eac2a70bb7064e46d7af240d423af3fd6e7c6cc0e18c6e5c86f41b9d45af5afc529a01dbd68c5047c969403997051d06eec206c010de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
103KB

MD5
44cdf9957ddc72578dbaee547291f98c

SHA1
0acd4d7473db90c0e0d4a42115b95e97247b0c19

SHA256
78fbfaeca0c5dabf50cf055f57f4722b6187275997d4afc118b6699629ce9c36

SHA512
f654478c7c4239f110b13f9a0f1266def5a838cea26d0ecb1e3c91560d819a068a00f4aaa7daa8d2b03e759bb63d5db54be727b01bcbb7a614afe9903c578298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
82KB

MD5
f572d6ade647b26953bed2f788b7ee7a

SHA1
7b2afaff3d8db47a51782456a7e3f24f8836ff28

SHA256
1d38b264e860d2612f885be82f7d338f9ac63c3c5f0c2fda85f6a28936c0747a

SHA512
878111446767b1c898e4731ebdb0f7c317a90d119470ed7c6c351d871f1eedb5e1e13db2c55cc9afa86771c599b0412597b97ff24eb5bf579781b139b34fde1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b575c7471f10b47b64a8a0d409794e5a

SHA1
f63c1fdcd31531b1449772e5e0ec52739ef96cce

SHA256
99d6a3309bf6e7d2c8415710110cec0941212057afcdcb8d73413521798bea73

SHA512
efff60aa65c13b38a102686212abdc4c60c4546661d150e5abf63180e03d565772cb01d5228d6d094bf53788915798b1f106dc2426db03fc821ad4d6b9b0a270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d204e99c65d88c32da77e0a4e689cd91

SHA1
a075c0d28a37029f5b092ce51cfaaf23cb435583

SHA256
2cd3b08219ece22bfa60e9faa84cf852b2405f746e70f069ad203ff335cd6a7b

SHA512
321bb632dd063f7a40a749714a3f88cd65228dfcc45b8e6a8d25c5d235c65057b88b186eb34bff4fd44ee04728e33bb6f6324c4f988443398b6f716279aabf46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
32KB

MD5
47f228cb1532cd35f35e6bfcc8ec404c

SHA1
c2eb4908f57da609a555bf4ff64a6c4dfd5787d6

SHA256
c15cd0983a3180991168921c73c38d5e329c7a1bbc467dd562a42163b5b5ee70

SHA512
a7e9430370f0d63e7eb2a533337e9f5343c54b81efe5d195cdf90cc23566bbad43892b8d2a2810c300a920a9342a969bcc2b1296c29e22c2fdb141c0c3ad3ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
80e1b7fa10695bc418b4b66648464067

SHA1
97babe6b3a8231ef4bb1b1ef8e6d2cf720fef58f

SHA256
d5ac1d54018d738ae50809b8eb703b411fa054f2fa99e6ec4a5c1bc8ef97334c

SHA512
1ba772f6dcdc4679caa7230c86fbc786d2212212189f4d066e93e5211f303463877ac56d315111c89a91f658b8ec3e0f7e15c0757449294adeabddc2b9df205c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
27ac0f57ee5df92088d70c7c6a513858

SHA1
2ec8d1fec0fc723a1a59ed563cbeb75caccd0811

SHA256
d8edb85b3837a042fbd08f4abb4aef729c9c0008fa1ac2eae8e7160f27196cc3

SHA512
8eaeb06ac4f12f922d607faf83849c9073c3392c4e37d8ac9a7c6f6df72a02bca22554bef9350166bdc2ba477ec8ca73ac1b6f32fd5664d1f9d06e0e633bb227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
93d49084a6c0bb4070d516d290d82310

SHA1
64c7de747c82b09e1511ed0a8201e410efe92116

SHA256
ebad4f7510c4deca398d1d16a7c5951437256078bfcfca42a68b74e313a8d471

SHA512
15b089a716b99ee2b96a869049fd2afeba8e492e74af403931e0fb0331c5e8f83e01a47d75ced7d528dba3bd9c8f04081e82e9f756e21b77aa4249428526f131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6KB

MD5
04e4ccde8bad134d235f36abfd4226ef

SHA1
a3fcccbaa37fe5ec5c597200809c9bd4cca83bc1

SHA256
88751da30bebca86b115a4c19c489e32ef1b556810000a4693e85674e3924bbd

SHA512
da33a2c759fd29faeb95d617266310c2e247aefb86c397b26973c4cabcf0c07bfc3359420fbf58e4e3f6bcb011bc5639041f0b0db20f02513c41576a2fa7e10b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
8KB

MD5
d90b7821e6b2b60a6325797253a0f540

SHA1
fdfce59df737ee48f690b006a5df7f7e7dd30734

SHA256
2c595099d7bba450692c5ddf2c58cdca7064287898039054553dc90a74a4cd8d

SHA512
fb06995424ea8f4b920d17941824b8dc8a2f63c7607efc16f76b3aee088cf44604a77e2107730321ed0d4fde6f35de9bb04b9de59e0ed84100e47814a597bcf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
ce91247dc5552f96fae3d3d6b5ef10f8

SHA1
22664f0ffe8a219d4f62f2f095325af82ec39bfb

SHA256
fda830638259d6e19d15eaf6b3dfa3421ca2f0f0af77f4b5afaf0db477216f0e

SHA512
3c21151b0a9aff1124d92814e05c88dbdbcc920fbf6cabec1f2b2721d23bb7773a8ea323031866f54293aa44c204f76a1d749e9b4d3a9a92cf1d87b5c79a975f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f27fab1c8012634642955d8a0f350bf6

SHA1
bb7e3121e396ec437d4c7c7520955dd11b012503

SHA256
623b8107ef3f5af5075be5df8102eedd886a936f7157b46dbb4fb8072c7e840e

SHA512
fb3fa3421f31add3c3bb636c627ee54993ad1f5c180b263c256d70439eaa823c4eea9548bacdd84dfabdc741bb70632d30317645a4ff9c004bfd3d5109fc31f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3d46e7e1c057f4a8193a20db7698983c

SHA1
0406829c7469bf2f13242889732b7a5dcaf36830

SHA256
180284f6b30c0082e1d7da768bc995458ac97c58bf88ceeefc8bf675a9385368

SHA512
f2c6ea7d2beed09d15f4c40841ba380f2e5322b3545e4d1fd45c031c88604b22ca5c10a2c6d602fb9d430ec7f3b30072f7a0cb376762f67a1f55b15e0311fe7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7ec3af81e4a298c85a7eb798e6179180

SHA1
d3deb1979649452aa0c70adba4deff80dd0f4235

SHA256
55780c26b33ecfa8a187a6cae7c75fe41f4ad6ea04036fc134cc6ef24448d4b2

SHA512
362923d661a51e1c29e1b78c7a7b1b2cac915e4f7e0ef82c805800ce656f8b39ace1391e1848ddc0248d02e486e7e4d79c49c3adead2fb7aa90480ad47dde6aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
30e774f9c5162f86663e5badfcbd67bb

SHA1
307c521b9c3b9a22e7267b5c03b1d91137136ec1

SHA256
f0684f481a3e4d50de4e76b25c5e621f09ac8fd016c3a6be77b660e2c23801bd

SHA512
4b6a21e7f3db4df1117df40300d232da8942873cbbf95d656bba11043475fb21aeec173acf108f7b8c01065a32fd3bb64320345e97fc37ab86d4040a28e98f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b2cc557b4520a1f605a0fb35e10192e5

SHA1
cd915bb9e5e22b3d10e69a2f8eeef540a98842e6

SHA256
a322b819672705b236beab880f7f93df70fc86e1ed0c48dc547d7264615b4602

SHA512
f1cb894669eb9c3e0cba807a65e9ac2a96f3706413ebf3401a7e90c89b2115073c0e40697510d7fbe715d9358adfccae01cd3f073852bf90da65ce42cd214ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0c11d628d41b730e4167eae21064bdec

SHA1
09f031d39651fae647c54e991084ca2e4c9c4968

SHA256
bb9c3b71895fd63acdb86ddd342deafcf11706f57e063801f5944d2d9a9d8dbb

SHA512
ab553846b91c841853ce25ed7f056c35a1e849ff93b015a6eeb7e093d20466d7617fb844a15004612bc155b5929ece4401a36f620a131a590b29bac107dd173b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71ab4ae4a8f16124483fb314e8f4d451

SHA1
4f7425c0eb62a52051fb5a162a746bdecb7d755d

SHA256
b5cfb05bd49c95d60caa9f9256e42c8fd05353229455a62bb620bfbdc33f8471

SHA512
09bcb7ac24a20c480acc950ce73bfbb07f60801c06e81b0f376cc0497f65009a7d0e8c878650f3a0831714055990dc1f95721c95c4cc44c3366877debdad29ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
200adc5c9f2fc68507d670e9fe0505d4

SHA1
e5f76b3f28457f35b69b9940065dfa649fc8afb5

SHA256
6f8b66c4f0383572a97e1b835044d9fe24e55b9d5e4334b0e835d9d7bbf1b559

SHA512
61234cbb1e0af2f21f6f8b01204392554e2eef8c21af686bfdbc8d1bfd1235bbae9d237400e4431a2ddaebf4b0def52c981dbb72f6bfde7b23faa854a30e84ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
562ef3fe362defc6ec6a19efe5ae6641

SHA1
d4b1ed82eb558cc203da70f0841f84915c578967

SHA256
371c40b02d25ae73ee9959454c90a0d47e781a09faf525368198daea1f88c04d

SHA512
5ac027f5b33db8db6727323645ff4df433909f94e640088bccf77d5827ad359526c8317fc483edec78d08af6f430015d453386fb403b438809a23e1447f1271f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
3KB

MD5
72c1edad93c7a22b4c9503f91c748351

SHA1
28c6c9b099a0caf94c9a80ab509716a9bd4ffc8b

SHA256
507e98df64f16368c9387a07e482657d14d7a41e7a5ae579afc3deb7fc196464

SHA512
288762cf0f05c7025c915b9e80ad60b30a4ad1d1b6849bce08448b5dd416ba999d728c9dc99813ce4da7677dcd3ba48f32f2be3b3808e4cecb2d038c1f7bdaae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
2d7a1443fbd8f4a2bb726e06a8d7d622

SHA1
813c7bba21f42f8c5b314f8767ae20b5973a72c5

SHA256
8c114a82b462f8481f3daf1e799e69a931ea2e56b7584f20d4c10ec48a3922d5

SHA512
fdbd01cdcb47b851aa2e38bf9488a4b3dcf6d48ca829d6bf720ff7af9709f037ad31b87703179c25a0cde263710cc75192d79184f3ab28ac0799d2224ec63064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355316264682026

Filesize
40KB

MD5
fd719475342e4c14fa4455b19169b8c5

SHA1
280a8a5634b577dede3114681ab82b2c03009427

SHA256
4216768cba51ed9995dcaf5f2c938e59f24dd2d6e4b8c20364bbc73a39e7c853

SHA512
d61f6f42df0f11a31fd26a3689a18d2a79f6f6efcc545ecf81864174fe724a9417a4356b2c1f2f4aea6960c3f53621aafde466472e92d21cbb317c135187654a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
244B

MD5
4623e9c432e2e6946659ccbf18bdc23a

SHA1
d780fa25bb956bfde2da0cca0d6a7acff8f71835

SHA256
9add9b2afc64a20d61d584d4380d206e5ce7950ad6130899736e1a8c43cb7893

SHA512
11286d87b4d1e77d843bf505fcedcf0e592baac5f7052ad2f93554ef790cbae2a7b4627860bcea3aecab57516bbdd77dafff2ea79f0f6b0eb9d4cb354584d1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
46fc344ce8335ed1913f9c3942e75bc7

SHA1
b80aacd11fa3c2dff4985acff3d0c6485d825a42

SHA256
055bcf63c2164db1a80e53a02c0e8a3ca04861945ce7fccfd38f7b7d63395f90

SHA512
fb4b06debe1ca0c8ee80c6ae91e7c552c98a70e0307d4c395a6730d9d6d1649632eab70155bb4504ed86f1c2729cc49a41a8ac8c247a9a9aeb60fc2b5582c5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ad4fe7f0640e365c21fbc98280fc27b1

SHA1
b7e95c9ec33fa807dbd52fbb749cec6e38b6510a

SHA256
2ccea32b4329990dcb7434e098824561de33b334feb74fed838fb730f4b96d0c

SHA512
03a4ed839727131cd4ab2e9beddf7747ce81ef8195e817e9cdf98e910b79c0fbca460525924758b9e39a7c98bb76f9bcc37ccf21b57ab4fbacb4a42c9347db18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9f9c024903eb34fc6f547ad713df3f46

SHA1
3b75a9809261ae38dd8c84cec6f7ffe45f72afbd

SHA256
791817810158405341f27c5c546265fd413566ecffa24a18e008211f6f4379b5

SHA512
2a4675b27bc0425fea656c61d1acb56f0700f732bc949eee442bf6d271efcfc5177f1c6021d0ad346823e42789823c147393e674fae9ad113f586053507a9084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0aeb1eb58bf1a36bb245306fc7681ef6

SHA1
b2a485e3ae4bc26dffcbb202479d2d208d4f9af2

SHA256
31f3e7add59808ab75a30a14929ae7e693e17a08de2abe4f81ab0449518077a8

SHA512
b872cc764f58ffeb591dc21de4260096aeaef02ec0620b8c9212b3c124d6d0baed44fee718fd16b13cc14ff210b6ed1050d9b92fb0bb80c6fe8e977aa7b1fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b13116d5fde08b0cab37431a82d3af73

SHA1
129e20b8f1d54838a7630934893829d5936bbc20

SHA256
34d07145cbd215fa3a561d296e4233065bd33b74abe08e9942e24ef1d8348814

SHA512
7651202b4c0e531491b1058e121059d41ed93bcb2d90faea0780ced28804bfe952af1090ce2e9c3ab88fe4f7503b579166e9f1681fedcec010b9c5d61fde600e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
224b792804a6131382914d8c875cc256

SHA1
f8410cde8c679b6674aa92f467b37b98b757bc37

SHA256
bec9a67e316e8754a72a9692088fe58397e23f247e55de1653f5b74f233dd1de

SHA512
69a5739dc0e2f38e20bc51e1cb12b47a10bab36bca0fa597bec8fa2f26e1636dbfd3ded034de66a6968dc0b3e7112ba854109e6bb919b39e1f35ea2f28402311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e56e.TMP

Filesize
1KB

MD5
4860fb3ea30f453e693ee17c2ab4bacf

SHA1
d43382f0b640ec78621ad8293e5da69aefc3ec34

SHA256
2495baddf9385568cefafa4b5dcde1726512e8f11b0c112d3604b9150335aa80

SHA512
17f44efcd8d5e11b0999e75eea5e522e8cc0666783c60d842a7cc178ff52443ac85de9bde5603d7700b9655e758d533ba72a2e25a38e21ac748b5e9ed2caca0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
9482b0fc61ed41d14fb8112919364432

SHA1
f738f279d312f8bfe3dc33dde4161558aa4f1ecb

SHA256
690aebb7692b872dc05273b724c94d068e87d4d0d8cb528fc2313e166cc98816

SHA512
0ca5458dc4127fa37b9c10d06454412d5238fd18de83e57d2f3c592ebba5821c1c8663ec5531aca0343c0067d00d7259472efd60b54c683d2029f0db0df2e81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
c957c30416b2def5dd328fdfaf01374d

SHA1
b81e106fddda97d727a0e79849588f89ab3964ec

SHA256
b4c444fb48c9a7d4443fa335e127095ff8fe06b8e2f5ebb7bcc7925c18b10f28

SHA512
87ca8e2d1f946cbe3beb3c88a604d0c8b909f7a27a5299692fdeb490f06e49ad86ada49a08931565b98f10f995e997025122172f1c517f707f409ea12e6976b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c57aee92-9698-49cd-a6ff-5dfe795644bb.tmp

Filesize
5KB

MD5
7de0457014f3ef5e0cab13e8685a9645

SHA1
e8ce79fd380b1d5a6dd1ac249af662815d2609ad

SHA256
380cd125f9e0616f4eee0b5977f80433282fb2cbac76714dec5734e92bfb735b

SHA512
d3acc0187a517f7e66a8fa8d8feff3e68a7a590b0b034d2156573c67122e08c9aa5663c39f7fa4b14017cfe8aba4dfd6e4ed5d1c344c115bc85d44327ff8ccd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3dc6b98-5c28-49f1-b574-7dfea910d0de.tmp

Filesize
8KB

MD5
d71463c5d388956d811048d32d42ad2e

SHA1
d5838cec16c8def3fc45808eab01ac82ee6d5e65

SHA256
06f2c4b007d3be796973573cbea3751fab397d02af1e6ac0c0739cff288f7cd4

SHA512
21984dde95de478d8b7e4860d8209cd89738bf118ec08e4bdca4f0219215ab9c15837c7a673f4359c3ac0704e6419504d777c2c12dfa38e276b08e1581874a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
56KB

MD5
f65e2b439a8a06c8c66be715aeaf7cd0

SHA1
e12b9a428e18f0ece60d78a77b9e846aeed0d020

SHA256
b5d4ef1021e33c068a8db1a39edf4c9b23b79907d3375333ab64682376af86e4

SHA512
eb6a32b9fc703d87000f179f3dc400ac95961ae403be5ab75ca2cff86c08e68d03601526997a8264e7a6e586934d41bc461d2a8391a555e6c0d063dedd974801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
38B

MD5
51a2cbb807f5085530dec18e45cb8569

SHA1
7ad88cd3de5844c7fc269c4500228a630016ab5b

SHA256
1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac

SHA512
b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
a05ced0628f46fa13c6304a48dba1caf

SHA1
9599332976b471be98c12e6f45f1b092a9af1064

SHA256
46fde0033ef414cca30981abc654045188ec6f9baaed6804c2f49ebe565cd8a4

SHA512
91ee8e9e920dd44296c221c7473c8a308af49174e0ab126d27c79851b1701566a5b8b4415e9f5988ddf80365912505ad02e4272c30931cc2972b75d44df7a819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
180bc13a210ce9e9d1d21a9080f47fcb

SHA1
798e40d8bf64f49f2171744c7aa2d7f335e184b9

SHA256
69f9b7ba207c3337371898564f0f46eb42ab54b3ea43b2331361a689abdd6955

SHA512
1bdfbfbe99c4a4b6b42ff8f2ec28a49b48f44bb9e08efca1ef56005b1b044747f7fcac2ef4d2205457467fff56f3bf1d105511ae05464baa55602b5d0ca4e358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
53201d948771e7d2ac8333fd2d41034a

SHA1
e0fc83a4c0a3c51ab771a3f0af1050ee789ca740

SHA256
0466919c50e8431e3b74428a5b160582d048b841a43b9b0033f3300e6188bfba

SHA512
e09704b9fb7244699645804eec08f83c7a21565bf0a83ccb5d5967f283227ff694d5a37c0ca24d5fe076ed2da00dbbaabd3f5e94d9c3bc9e576f830183d2dd6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db3af51fdc5b2fc1db37742da282f1da

SHA1
4305b57195151b10ce1d1442d6faee79d2bf07a0

SHA256
9cd5874365af97293cea9670628c1ef0886576a3b5d105fc1d1dfe99b3e6c934

SHA512
141d63c589a441ac5de907d7db601b6ef76ab958a959945bea76e6d3e8808bc0b509f234a6d64a82df8ec8bb6fe33000e6c47cd112f250ea7e877732f7a1ada2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b37c0a6babe96afd7132c8d12a74f9a

SHA1
088fa4833fcdaca7602e93d9d8acc6aa49ddffd5

SHA256
d42bb63a1c79a8da424f1aae5cc71dfa860552286cd2d94d7883dc9b526fe356

SHA512
ef4b76ba36132cf06dee2a410f0bf748fbb295b4d6cd72d9852f19d9a8cad0f6c0322e5a51279fa48baa8a6072109e9c68ae2764dfaa5a48f11a553b34bfe187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b2854cce451ff024112a0c272c2d0ed

SHA1
93b9896096a01ae9e1dd5f758ccf1d957f8528ed

SHA256
9ededef63c61ab42e54df8446be75f8abb16a76eb4f3d4d3c364bcedeb48fed3

SHA512
21de7abe4270e494c5f0db63c6f76a70a67abb01d0e7567f27929478271c0ee5a3cf49b74d1e6b82db057bbe78644cdd43500e45065ad36b1167d6e4441d9fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d22fcaa80449b530dab8651ff45db772

SHA1
eb859487802070fb9b782d1f83cbc8becb56378f

SHA256
ce505d833ee8095b9d41b6f1bb6a0e8c3c4b8c25db5b6c3c46e0a5cc4042d5d1

SHA512
460b5147b0a78e9e8d6d946d82b251c6ca98202b99b90268b578a27958a1364b25e6d897504c37ab49b9e468a09d17406445e82db9435ee7e230effaefb0bae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
7e22e2062b35cf6035ae563e57d5b566

SHA1
be04f931e68b2cb52f02bb1423ed0e3c9694762b

SHA256
b2b4f4246955e3bfa11a9d421bed8d0f5ce3703143cde4338690f76f4e58b699

SHA512
be340ad8040616504d28381b35e45dc17960a700d3dc851712b96cce17bb9f77dcb7a624c4805aeb71641303d26b222d7cb6f228a013d2356f73803146027b50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
6cf62450cc02b265262eedb0f699a28c

SHA1
88667bc69c83f8dff39c8364ecca3a881acde65a

SHA256
7d6c2ca42ab2939cd090b4d3df10e865318e1b7be4737f315e9d253107141f59

SHA512
04a5105949fd7ea28b6062ff9499590647baf8610829f4e03033f1cff705852c0f131bc3ac7c86e088af2b91ab247c5492220d6351f4b59aefa82d5accf37732

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 633939.crdownload

Filesize
1.3MB

MD5
643fb23576addff24672264b8be98e90

SHA1
8380bbc9ce4594618708155ecc7b1f4f03b9cac7

SHA256
a7ffaaae02f4278d1b286fb8c734306bca4c76bcf1c2e93cbd6c88e8383025a9

SHA512
d13cb8ea9fa4feb6a708cabedc177371261e40da51301fd91468169dadd8129e5e9d5c372bf44c029adb88ee0104a192208e5a9dd0307f0752752a1afe05fdf7

Download Submit