hxxp://discord[.]com

Analysis

max time kernel
1799s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
5	discord.com
10	discord.com
266	discord.com
269	discord.com
270	discord.com

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553321679944932"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Applications\crashreporter.exe	crashreporter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Applications\crashreporter.exe\NoStartPage = "0"	crashreporter.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Applications	crashreporter.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Applications	crashreporter.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{FEA499FE-7405-40B9-9B62-799129F9CBB5}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
5076	chrome.exe
5076	chrome.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4580	msedge.exe
4580	msedge.exe
2832	msedge.exe
2832	msedge.exe
2656	identity_helper.exe
2656	identity_helper.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
644	firefox.exe
644	firefox.exe
644	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
644	firefox.exe
644	firefox.exe
4360	firefox.exe
4360	firefox.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
224	SearchApp.exe
3896	SearchApp.exe
3412	SearchApp.exe
1092	SearchApp.exe
3196	SearchApp.exe
1080	SearchApp.exe
644	firefox.exe
4360	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2188	4556	chrome.exe	86
PID 4556 wrote to memory of 2188	4556	chrome.exe	86
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 4112	4556	chrome.exe	88
PID 4556 wrote to memory of 3740	4556	chrome.exe	89
PID 4556 wrote to memory of 3740	4556	chrome.exe	89
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90
PID 4556 wrote to memory of 3136	4556	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbf589758,0x7ffcbf589768,0x7ffcbf589778
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4732 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5656 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5780 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6004 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1796 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6016 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4012 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 --field-trial-handle=1836,i,3117111117640932305,15217345665781201461,131072 /prefetch:8
  2⤵
  PID:2252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1328

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:224

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3896

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1580
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.0.207115403\1267435075" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3c8efd9-01f2-4ae2-b32c-07c536d0e918} 644 "\\.\pipe\gecko-crash-server-pipe.644" 1964 22bb8d05e58 gpu
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.1.44136561\1175278194" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9ba391e-5ab0-4d58-b9f3-0965ba0c6965} 644 "\\.\pipe\gecko-crash-server-pipe.644" 2368 22bb7740358 socket
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.2.286557251\1945855930" -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 2988 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f1e784a-75aa-4c7c-90f3-1048010e7d85} 644 "\\.\pipe\gecko-crash-server-pipe.644" 3196 22bbbe27858 tab
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\crashreporter.exe
    "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\189dc395-2a93-413f-bdbf-fd690610d7e9.dmp"
    3⤵
    - Modifies registry class
    PID:4020
  - - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
      "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\189dc395-2a93-413f-bdbf-fd690610d7e9.dmp"
      4⤵
      PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.0.183566806\2027724838" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20749 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e743fbee-3ba4-48dd-b688-cdc07cf3e32b} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 1944 29d556f5b58 gpu
    3⤵
    PID:496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.1.376819092\770674030" -parentBuildID 20221007134813 -prefsHandle 2332 -prefMapHandle 2320 -prefsLen 20785 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {007307e8-94bc-4532-98e1-cb394bab972c} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 2344 29d549f0258 socket
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\crashreporter.exe
    "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\db6b77b3-203a-43d5-ba6d-d653083523cc.dmp"
    3⤵
    - Modifies registry class
    PID:4356
  - - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
      "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\db6b77b3-203a-43d5-ba6d-d653083523cc.dmp"
      4⤵
      PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcbf7846f8,0x7ffcbf784708,0x7ffcbf784718
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15415358033810590074,18119592102826247044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
88KB

MD5
2789ae67329e5746d75a956edafb5b6a

SHA1
09db13c9f41a3f950ff86b1db09535d15f798a3b

SHA256
d5355b33e43b02b556c657657d8c10c4816af27a5157a53440e3dcf85d44c876

SHA512
5d759cdaa59e79b70d2b55c2c6a33be39f64dab325c200f982b4a21f7be05372b8def81df7bfbdfbc21d89683c45dd9b71b46cd06848ae2c091dde39f6b64268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
408KB

MD5
7c7e28930da3ff26ca3ffaeaad4d09ea

SHA1
24fd9a1f645af9835c17a1c4af11e09fc9b1e0c6

SHA256
57085740f3d6fb8d7fd829adc4305415cb99d651bf17baea13568262f450b189

SHA512
a5bdcece7432bfebe409be6d39ad45b3d844fc6d05b92b0e15b422d0a5c677ec1219c5bba20aa2d7e0d3be5e39ed1ef7d10b25cd229410ef3b170436132a76b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a

Filesize
196KB

MD5
813c1b41e435242e7365a4bcd7adcf23

SHA1
2d25e1564eaf93455640413b95646b3f88f9075b

SHA256
70cb2151ee4ef83195855d29819491a23c5eafee2e72b7ffd9041b35363d1542

SHA512
268c4fa1797700a205e37e716c1472592ad6242344645c703ab1ab8d4d68452c3ccce7cdc4d56a0b42d4061bdc793f1c79dffc397f038133387b94b2a1f4051e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2e4386209e828980_0

Filesize
18KB

MD5
f45c96659afda51fd9f21cb69233970c

SHA1
44a60616b09509463c4332b94f5f017b732bf20f

SHA256
4116ba3212b2fcc49c591f7dde65c49017e70ad95c4325d217941b783848000c

SHA512
5f9a70cebe655feb05de70c28da5417223f3dc6961266f173c6ec3233992d74e42386c7a5e8dbc7cd86455ae6abed29c5e52ae3e7eb4b11ec52c275a26cee932

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\69e32e79d89cd4ea_0

Filesize
280B

MD5
5f48a420864fd60dfb2962c5a5b2dec5

SHA1
eb55bdee5cb406df57390842e022d2c2407da52a

SHA256
fc68908394d619ee97d5dcbae130228beb167db6a508d07203469c4769de95be

SHA512
b6cd80d21bf182719f2571f0e69588abfdc3aac60c3396ad5b6f5aa538576c0b6a7c813c087bf758b419b5ba72371b9e4056be41dae71709c50d9d8cef355065

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6a7fd4b4fb4c47b7_0

Filesize
289B

MD5
92605c1ad1e26963c82a25b5cca0cf56

SHA1
fef202dc63b4ba433da7071358d3e046263ab119

SHA256
2b02d4e1d84190261ddc6fd0b0c284171cb009973e5568af9e838624f574bc26

SHA512
ed0347d9a0d5bf1d8af50caf1ed6d13d800db337b95bd264bc4f47e42ba35a763779904e233ea4e5bb4a7817fc63751cf1ebe5610c8f4c5228f1db40e851557c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e8fa16c3bd7dddf8_0

Filesize
327KB

MD5
f2e672633b8bf46d48abd4f257e8438f

SHA1
ea6db59e8150738fd1b577533ec99e49604f166f

SHA256
a08146f08a9d24f5b7a51ed0af44aad5c14f473ef5f2d740ba65f189023199ce

SHA512
41de6fb873b83d9d4c22a43aaa1d17e95bbcf97558fe32768082ff0c69c53928ad38341954da9bde63151ff9efb6fc0d3ff4839bbc983677230dfa108334709f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
737e875a41c82f103386e1c2ded4f65d

SHA1
49bdb3ceceffb005c61d813bf98e93f7c08bfd72

SHA256
5540dfe9c79d485b1ff0fe57e842cfe318d47974f327e08eaeecde1658fea7f2

SHA512
21597ef8379fd36e724113940012468c708d47a39e69e6291bb84f357bb68491af47df191d7cbf4aba29c978e60aec2a75704c87ede7fd91bb1110f2a7877f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c569351bb19d0f9f196db1cc3d840c84

SHA1
b311df634ece45822363c76524bab2d2c83139d3

SHA256
f6c519df1e24f71c8a446d8f2902c5adab5cd91907547d21bd16b3769716db53

SHA512
e6822389552bd69a58cc6b13e7610a0bc2e1b9a065af04df33f7b3b185585ef801740ddf680c9cfc5d497528b74e980af0c603a314850baf07ed03e9e8e07e16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5e5bf99813416adad121783d0d669fea

SHA1
50c259af5044557940cea1bbef99340347b53aef

SHA256
fc3c8dca48ef18a63c05a395b38dccf0f8e16df337e5597a6a40be24d0418292

SHA512
1ca9e08a9ecbb528895581168efd6744a3911e29dc1f4b8225a1a971b8cfa0da4f66ae9a0008297ebdeddc107cd0ea63c0f5125ec81ba1a34da0ea5a7e65178b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
15de589b2af20f4e9b8d88dda6ceb5bd

SHA1
caf5d89cf890485338324b262ff9dec929e1e485

SHA256
13423656181c65ebfd1b07a387a3cf0d9dd334734b9a64c34503d81e4c315d15

SHA512
a183ce3eb851ac6441de6a82c7fda3c37ee3133add5cdabb7d4fabc0bdfcf2d4639361ed369affbb2f50f59eefad1e1fae2a7fe521b3c3bb576fd71e85d6ee63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0192ec109a351d91625008df70096a14

SHA1
0479cde86b7dec537b94ef992e229e2a5ec1c997

SHA256
05f6d0895b2f00fe45de3596e16f14dc37f4922b6de8367448e8effa2f75a1c6

SHA512
149eff46cebdf0a2bf98bcaa94bf803536e534d2dcb0dee71502b688f63fa8626665cb873e5e115d2cf56832a18f1da8bff7e625d0101ae785ca774567c3e0e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
48291fc886a36f129302c5c2c91444af

SHA1
890c3ad3d7286df2685890085a393e73d86cf572

SHA256
9cfcb34006a1818eeaa0f77e6690a76a9e959b2f68fb191f6619a58a515be016

SHA512
c91dbd2cc928bf5a909923b62792e78e20a53fdd75aba94b06864ef0ab6d7df73fad163835519b8033e02e2032cc8b6c0022c46fb9d4481554732af2f97533a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
454c6ad9321bfc6270be9a32f856d7f6

SHA1
99ebd45de88f28b128aba1f3b2f95cb52324226b

SHA256
0e0460f7fe4198a2412cdde4e666ab13b3e42fbd155339363a0ed554997872db

SHA512
7805a9c62c773c39bc9880a5ac3cb4f76ffd63f7b2625473068f75ff3c87ba8a829376a25232cc11351ff92c737df0c796a6154f10ee5d0e44f2f292152927e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0ccb4096a56d3d4b12f3ad3501aaade7

SHA1
a422dfe2c892f27739dc04ffafc7fb8284b30ab4

SHA256
c75eb575709ed9214770f88ee6be15141ee273eaeecaf6f399a13ae9d7811c5d

SHA512
f85871aab3473715cfc569dfe1395dc4f24623db2eca3fc5e6b05ca3e6ee61820c69c3515f75ba5a3ac69cafd96e33b9b97b8ffcb605b6a95fc1ffecba9a21ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
626b3984ebc9de53e2b6fb9335b0acb6

SHA1
1147529f9aa07c5528caf5e77e24a8ad1705aa3a

SHA256
6013133fed9000d353432cd293c8513fe051f4464a7adca5e3461109f813d681

SHA512
b6b1e34c54f14570c9b66516610d5ba0313d77cbbe01a32c695fea9d2d8aeeea183fee1aae9875b6d0d8bfae94a8ca1e65a36336d7addc9a304c37d0fac2fba4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
582865fc5881c0050b6b281a75522b4f

SHA1
7acefd3dd1da56fdbe9d5fc3d0b18187acb9b7d3

SHA256
13ac3d9ccdbd909af4e812b632444b0bbcdc7a097f3dfcb669121dabe0e54e7f

SHA512
d057276b2e0f358b502e15b3486ca2f3d5fe70adb6e33582f2cdd47c3909e257606bc5e473e696ab997d9ded5c8e3195e316603e8c4c7a42b16c2c3076b86a2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d2f7b3c10a9d6511eefdb764d3598701

SHA1
892b95a87f9ffd6593dc8491cbb4dfa9a045ac70

SHA256
65d42be3452a7bb63fcad7423ec0e626b4ee959486011837ed062a7c80c42d5c

SHA512
a75e9f552413a0e9c0367c2007b047978178728ecb13e8577c3050b565cfbf3458a0463a7d06a49187572babbf501c33fd91092c208880666b50317c5d9ce9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f9a4f5ba41cbf858b7ac6ad10cfb01cf

SHA1
e834586c030fdf84902fb2e61974c4f31291fc18

SHA256
e10f42d2fe74758e0aa4b04f1573633982f920f23ca9953d9e2189010c824280

SHA512
7113a3ac786ba419a546a067596a2f5cc992d7033a48fa4b86ae570741442c7d1e4cdc53b86ab5687c8e60adb26127e7a167009e7b2343122b3e58b4aef0dd0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6b68edbaa30d730e428435da212d834c

SHA1
b85f51a76664fc4e86f9f46d065237996be4e9a1

SHA256
5aa8a845cc67bbcd62e3efaacf14d3bde118b563353ad716f86780205da02cbf

SHA512
403079cd897543b91c9f66a46d7ed155a5bb0dd30e5cf6486833f021d300103fd9a4f797312d226db529a80620d95bb2489af605368bdcec176eb61458d1ec51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e1290658b16423e64781d3ba78aab5ba

SHA1
7c1329dc1440ab0d6f2ddf519edc07472f657441

SHA256
9d7ed77a8e8a5c2a309d6b3570cb8ee53123f4d64506157c2e7865ed60697db1

SHA512
1650f1822b5e533ab455cdc921eaa112ee9adf005b5e90ea7977a2c37d300463f57a956e6b48ac3b89975eb112cb5b5db1bcb4f14a4f0aa8b6699875650b9aa7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9d07985bd5ed50c4c554e75b710f8b58

SHA1
3e1043ff3d168e49db4095ebe0fb68f4baaf5643

SHA256
7281c331ffcbe1579a899bebccc472fbf4aabab65e5d437023c062829daba47b

SHA512
2d1f9ebb1b0c24fadbdc2589160c3fa9dece4ba7fe1ede5d886d640d0f1c428a76e04489493a8f6adc292c429b029847f0074fc01b91eeb08bfd20dd99c1bdee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4913888848496278ace1536197d0727f

SHA1
93264243ee6b6cb65166ac0c38cb542e89bcd2e0

SHA256
00d711737dc2c845829eb986f3c9cd928cab2c226c12399d215b8735739f267d

SHA512
3221aa904ceb105c1940dc3bbf9675ef0d2313890d26f0ceec1a4a20db158f89866ece95e8cf268db6e5efc3e575b1191dee505bc96df7e0a626e5e00341c47c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a336481ad8b556b529ef2597463074fa

SHA1
f8ff5c0572ca71955e7bbbc659b134d5fbf00b1e

SHA256
2aa842d36ba798b89dd714a134c27cfe07543a594035f0d11159d119d0a2fb03

SHA512
5979dfc472b2049ef7be601024acce1c5016d5296f3c9f8b38cbeb56f3a96fd772227170bf50fbce752f16d91a25caef6d7f597cf435861901ecf908f555b3b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e1b29ef63cd1c9172e07833f54e0e1e6

SHA1
749b45f5733230b5134fcbe6ec4d2fbe6a89065f

SHA256
764ce5b2894514727e722c2c8222d7501730b292513510a3f85db3f8fe38d230

SHA512
87a1da89e4062bbeea6a21a5eccd97621d43a3e9014663d037cc6c1fe92976f941af7bc4d5f4becfcc56fe752bc57105f6a492f4c6da3dff40aea6be076289e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6184276df131e3f032170ca4e2d93e66

SHA1
6bc05e35cb7013c66475597f19fb9a8112ca8846

SHA256
0a8cb37587b0dc28a2561eaf5eed24ab2347e0136d87cc3507e0d8822e1ec5ac

SHA512
c123f3c405ebc28afd88df02d5dd5c5802b06e601057d36b7d84f5f05387b710a5f518b0d8d3933b24e8ec635bd64c9962ebf6a3bf3d6826b24315b038c0e842

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b6af50d1fa45aec7bd27a562c1342bcd

SHA1
12d3abc2b954cb5b00f367647e5811bd3be1738a

SHA256
05475446023492f501d7c1024cc8f5efed69c7e362dc426911999d4db58548df

SHA512
644ab538204bf589f59e842a18ca14b6c1fc0f3fb6d3b2f32009f5c82726998a060408619d60bc7c5dba3a3c99d10ce7ede5bc2a25a9c06c433e99953d35b7f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
18a4ac9614ca05f5262f7ed910d5bc36

SHA1
a31e6d04bc77c13900e9ad7b5c3e1d8ba89963bd

SHA256
9e91fa7859c89ee459cfc6a94e1d721e2c433565f83a225da6d303907d136c1c

SHA512
14781a12a5c92e1f99dbf3cb7fc3eb5d804c229fe682e2448eca7ae0aec30b8039127aa0a1d3e157c4081e55c52d027f941ba78ff73ac1f4169d73b9178bbe71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae22007e-bd2c-48fd-916f-ec9ae8b4ba43.tmp

Filesize
6KB

MD5
d7bd21a1e5c034660a2cc00b77b239db

SHA1
002cebcf941c2be2b5c480e54d73b66422a70560

SHA256
7f93e27524a74333808a2cd6e24b33822ac217f8dc548576b2cb86951f97ea6f

SHA512
996312530543cb4fc18fc261072f00324f51982a05c2ee33c7f0e392e7e8fc3c0b72b62f3af523a3d88b1efc007a07e41b8b4598987b3133e98bf022ce49424b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
c9f02d6924ec620cc504ccca92161dcd

SHA1
646c538120f63be216913e62c3e7de2eaec581e4

SHA256
0b32b168073197db29d7c05cc44d4bfcbf49df89b1d73a4e20964a6b3f8ebcc7

SHA512
b411a670bea9cc774211cc93ea77a98ea2a6e156839184c3902d9c4b02bb8ad09609033dffdb3c15c9c2fbcac12e35782120bcf9bcb53252bc2f61b0261dc7cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
92d23ac68b5473a9e3369f5a55b837b5

SHA1
64ff8218918e1d4305e70c1d6b367edf514dbe2c

SHA256
f54313b83415729356df4af85ff69aa756894d268a72624a4a14bcf2999c3733

SHA512
b045465b5b4efdd398626880ff3ce1769d39690bb176d1c101ee3aab498d9610339560639488560ea0c54c9e060fc5a00117dd837a4f0a15baf18f8c012ff270

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5acb2777d93671057b59cf2878bc86d4

SHA1
c45c18e8ed846b0db0564eeb28e6f9e83b30f358

SHA256
6ec904de5ac8e79707f03b7b64a490e81814cf20c6f9e905668ef40bb342f220

SHA512
f331216f1e05a88fa861df12567c98fc8d9f0731af2c1a8d048aa32feb83689fd36130cf67c57fd9842334f5ca187d762880487d8a6b98a8d9b1994ad49e662e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81c5376b58fda0c4f96870c333d96237

SHA1
9cbb172e7a09df9ae70fc2c45cef3acc832a643d

SHA256
5e1eafbf4224dd2185e2a682b1d2400b28837185c9850337e10a430822250e9f

SHA512
e56520f22d015c1337053fe2d8709a1b19f4430c51d406aae93e4afa3e31b5c488a1e11584546293ff2521046b49cf8f2d9faa61ed1c597494fef2110928b3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4efde564a51523ba61e6088180ef219

SHA1
1956352758f74c0733446a77164b7a39d90703e9

SHA256
5fc2300d559d9daff098ce8cc5d6028eecaeb2b4ab6522bbe3ac53990506511b

SHA512
6e06b285f55b7d9791ffc435609cb61c4b9aa7f1a4cbac274e5543aae7cd7dab53a8e54aa9216bb5bce762ca2a22e2daef966f38a6ec73b45001009cb2951c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7bb594e4c928ba88ea333fa8347de0d

SHA1
4f4adae3a33baa1a498c2bac7d43163436ca654e

SHA256
3e22eef6a9e284cfcd5e96881a9f6b5d597333ac28c72a32c1e9b96ccc3cf184

SHA512
fcf3014e57f09044734706a6ead805c42ac4a0e3e05d4d47bb96a13a3c2b86e0b0c2cc14df2a578f5e0ef4e013a6b2e7b79eb4655f673121ed96ecfd9b860655

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

Filesize
36KB

MD5
0e2a09c8b94747fa78ec836b5711c0c0

SHA1
92495421ad887f27f53784c470884802797025ad

SHA256
0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

SHA512
61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

Filesize
36KB

MD5
fb5f8866e1f4c9c1c7f4d377934ff4b2

SHA1
d0a329e387fb7bcba205364938417a67dbb4118a

SHA256
1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

SHA512
0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDDM1QX5\microsoft.windows[1].xml

Filesize
96B

MD5
2415f1b0b1e5150e9f1e871081fd1fad

SHA1
a79e4bfddc3daf75f059fda3547bd18282d993f7

SHA256
3eff25035403aba506d0dbf69c76a22fa90ec66d2094cbf39bc5267a850902ae

SHA512
5d05da9ec1471dbf91f0c474c8db3897130543ff3c4da70724ce3a36adc38f628264c3dae4f54caef493f7593a0986a944dda0e19e947f3dfc34fc16fbd3e6bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\LastCrash

Filesize
10B

MD5
4ed681ce3eab4fb622ad9098b62e5ef7

SHA1
182e3e5c3ff0d696c5f72bfee608191b68d6ea35

SHA256
03fa23d7303f705575324eb24aed0aa778229d8460b8ed6ce1c5868801205dd3

SHA512
7ca5e7c85313cdee35b7f6060b6c6b67944a4b5a336fb6abc5a7ffcd7794ef52d93df4ce0d08971e78f45a28e07003dfa4a93704218d06766d04a1254a0bdc5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\crashes\events\189dc395-2a93-413f-bdbf-fd690610d7e9

Filesize
10KB

MD5
039f1744719ca67131f684e83cc97dc9

SHA1
bc05aadb816f895eb30595e533392523eebe5b16

SHA256
3aa9b0dd669533a81ca229e012d083134cd79662ef04cd3c0d5ead9489eb8a1e

SHA512
ee74abdb52c967282ff412c9416552d5b1c724bf0a3cf69d3b0b1777a69908c9bca4232f62a26b4b88ee7be118580cbf4ec1cf6ccda81809e8474e3169f6c9e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\crashes\events\db6b77b3-203a-43d5-ba6d-d653083523cc

Filesize
8KB

MD5
09e85833ae021f18cf649e2582b56108

SHA1
1e7ee2644245ecc01a38a1840dd6e452060e8f28

SHA256
e3133d245ae2c92a63cdac4ecdd2908dd72875263dfe03181517bdc8a1a11a12

SHA512
060834d4f6f5bb3e04eca5e0fe85941b76ef84c7a9c89a86b09c4a48dfbfab63bfaf827c0efff60432aa9dc3b9baf736176ed5c4205328dc6cd0d3eb56dc9611

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\189dc395-2a93-413f-bdbf-fd690610d7e9.dmp

Filesize
447KB

MD5
13dc79d61f2365fa65b95a817fd46e39

SHA1
50ebe302cbb1650e1c4744c2ddaa58257314e461

SHA256
a1b48af2cef027f493d8662f4fadf415b47fd23feb461f74a547e225b8d49223

SHA512
5dafbb1b9141f94e6580bda2d11e1079659e07585c396a4ceefae8caaa9ab15036f02ab3e8e280943ff1020fe80e3a34fe54b418c17d490247907823d9112068

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\189dc395-2a93-413f-bdbf-fd690610d7e9.extra

Filesize
8KB

MD5
c8478d634c36728abd51bfcc4e9b8720

SHA1
3f991789ab93db72f4ff5aac71f3a1a14eb8a66e

SHA256
a99ea26ed90fece1aa40b7c1921a06d2593e61cc247443cf66baa22c2783cab1

SHA512
fce7ab7c448ac5b052fdee58cb53778d9f7226c2813f4266bc5a5ba77d217eaddd222ea12d1c77483865e35f280d1314a81641d266afd98b625de95c5b6b7182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\189dc395-2a93-413f-bdbf-fd690610d7e9.extra

Filesize
12KB

MD5
63fa73ebf0a32a08a61309ce55c30f97

SHA1
1da287d77ca8cf5206939a0db3767703570a2f0e

SHA256
6172cf86ef097a44b20273eec709c3e7a698f2d7642e4e71d22c47062e32ea6c

SHA512
a32b9bfb3302757e9bf1e9425a1e0befc5783b3bbf4f07e94c4a783332a25716de2c66d3a91d2fda6236aec1832f303a259a14ef163e5da95afcc222926c24e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\db6b77b3-203a-43d5-ba6d-d653083523cc.dmp

Filesize
432KB

MD5
8b52760f6dc2ce33d8ebc80ec9661fb1

SHA1
7fccffb7c99cc211c302a7cf1dbb0a934fd1c523

SHA256
7aa75e30ff5f3f037a5b96210d7e309ca6e361ed28517a72a4cb824b2390e738

SHA512
e53b39978cb91be177f661b4cbb27d651c406a643a4548ceacf58c89fb2b8ffc0454e888de1797e8a883d8aedf61bd5761e892186e36aa640c1d0c85e041cb6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\db6b77b3-203a-43d5-ba6d-d653083523cc.extra

Filesize
8KB

MD5
d5890e13933d2b9968486c5aea429528

SHA1
ff7f8ca150cc4bb17363f5a62f106bdb384ea127

SHA256
eb26c50cc8a9ed98a2371ae1cce8d13040c425aabc78d904bf709baece5b1764

SHA512
38de3d9dfcbb77549dfd4acd2b36484e8124a128eced7fb37b579f1e26368f81cfedeaee4bb8701c641b0dd8eb96781be998740ad6bdc0bc68cdb2b4fcd6346f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\minidumps\db6b77b3-203a-43d5-ba6d-d653083523cc.extra

Filesize
12KB

MD5
a930df634697f1679ec69184f3e0c812

SHA1
ee5b612404e41aed0466a430645a1cbaf9e2cf48

SHA256
f8f5bdc8eedd97c075dcd1af0e61053f284b146a9f98b25f92a8de6f309ef116

SHA512
5a64b167f5678958a53562cc23939cbfd969bc0bb53112b4066a967401d11b055be5827cb25b3ee85294f91ae1ee28fef7aaff76b0f5b9ef6257d8cc3e89a0d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
a510497a026eb84f56d9152ba5c19d8c

SHA1
18d98bca9f24461134d652d8e50feb37768ab407

SHA256
f516fb8ef7e9b1d46eaa21521c296f9b32341bd3a3d25f989f56bf9cf46c5661

SHA512
cefd625d0affa7ba00732e316122a0d68fb2741506a205af33776d60b956446d3d20c94da3ab26e6e0b6eb9e1ba2ed164a8d58ab9ad1a27eb8dae53e691f27f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
cdbe0343c1297ea407f1670e1ff278a7

SHA1
61cff4d314e6cc95ed98078d17f386edc4ab22bf

SHA256
badd75471ed2c3b8397a41cd857d0e7f4ccdede59bcdb54054a4497dcbedb785

SHA512
fbe4ff41239171b733679b20278ad8ce66e35f056d00125c81894b18dbe14a47c3f13588e86a05f21da9e47092ef2600aa181603f0a22258aa17f0d46a89c849

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
memory/224-744-0x0000014AC56E0000-0x0000014AC5700000-memory.dmp

Filesize
128KB

Download
memory/224-742-0x0000014AC5290000-0x0000014AC52B0000-memory.dmp

Filesize
128KB

Download
memory/224-740-0x0000014AC52D0000-0x0000014AC52F0000-memory.dmp

Filesize
128KB

Download
memory/1080-841-0x000002C3F05E0000-0x000002C3F0600000-memory.dmp

Filesize
128KB

Download
memory/1080-843-0x000002C3F05A0000-0x000002C3F05C0000-memory.dmp

Filesize
128KB

Download
memory/1080-845-0x000002C3F0CB0000-0x000002C3F0CD0000-memory.dmp

Filesize
128KB

Download
memory/1092-806-0x000001F48D330000-0x000001F48D350000-memory.dmp

Filesize
128KB

Download
memory/1092-804-0x000001F48CF20000-0x000001F48CF40000-memory.dmp

Filesize
128KB

Download
memory/1092-802-0x000001F48CF60000-0x000001F48CF80000-memory.dmp

Filesize
128KB

Download
memory/3196-820-0x0000022D16D60000-0x0000022D16D80000-memory.dmp

Filesize
128KB

Download
memory/3196-822-0x0000022D16D20000-0x0000022D16D40000-memory.dmp

Filesize
128KB

Download
memory/3196-825-0x0000022D17130000-0x0000022D17150000-memory.dmp

Filesize
128KB

Download
memory/3412-783-0x00000180E9990000-0x00000180E99B0000-memory.dmp

Filesize
128KB

Download
memory/3412-781-0x00000180E99D0000-0x00000180E99F0000-memory.dmp

Filesize
128KB

Download
memory/3412-786-0x00000180E9DA0000-0x00000180E9DC0000-memory.dmp

Filesize
128KB

Download
memory/3896-767-0x000002D683100000-0x000002D683120000-memory.dmp

Filesize
128KB

Download
memory/3896-765-0x000002D682AE0000-0x000002D682B00000-memory.dmp

Filesize
128KB

Download
memory/3896-763-0x000002D682B20000-0x000002D682B40000-memory.dmp

Filesize
128KB

Download