Analysis

  • max time kernel
    210s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 20:42

General

  • Target

    https://www.mediafire.com/file/qmdv4zh76ruqfox/Newtonsoft+Error+Fix.rar

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/qmdv4zh76ruqfox/Newtonsoft+Error+Fix.rar
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd463e46f8,0x7ffd463e4708,0x7ffd463e4718
      2⤵
        PID:2764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:2512
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3724
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
          2⤵
            PID:3756
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
            2⤵
              PID:816
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
              2⤵
                PID:3208
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                2⤵
                  PID:2756
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                  2⤵
                    PID:3316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                    2⤵
                      PID:4924
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                      2⤵
                        PID:4268
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
                        2⤵
                          PID:5368
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                          2⤵
                            PID:5428
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5784
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
                            2⤵
                              PID:5792
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                              2⤵
                                PID:5800
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5628 /prefetch:8
                                2⤵
                                  PID:6056
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
                                  2⤵
                                    PID:6064
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
                                    2⤵
                                      PID:5236
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
                                      2⤵
                                        PID:5248
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
                                        2⤵
                                          PID:5512
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
                                          2⤵
                                            PID:5520
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7892 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5284
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
                                            2⤵
                                              PID:2848
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                                              2⤵
                                                PID:4528
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5972 /prefetch:8
                                                2⤵
                                                  PID:3412
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6720 /prefetch:8
                                                  2⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3544
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                                  2⤵
                                                    PID:4456
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6616 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1980
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                                                    2⤵
                                                      PID:1820
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                      2⤵
                                                        PID:2820
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
                                                        2⤵
                                                          PID:5132
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4004 /prefetch:8
                                                          2⤵
                                                            PID:5684
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,2590756184802060307,2697968144870440399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:212
                                                          • C:\Users\Admin\Downloads\winrar-x64-700.exe
                                                            "C:\Users\Admin\Downloads\winrar-x64-700.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5888
                                                          • C:\Users\Admin\Downloads\winrar-x64-700.exe
                                                            "C:\Users\Admin\Downloads\winrar-x64-700.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4044
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:2332
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:1720
                                                            • C:\Windows\system32\OpenWith.exe
                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5176
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:5352
                                                              • C:\Windows\system32\werfault.exe
                                                                werfault.exe /h /shared Global\25a35f70b3954329b8cc261009df1172 /t 2916 /p 4044
                                                                1⤵
                                                                  PID:4884
                                                                • C:\Windows\system32\werfault.exe
                                                                  werfault.exe /h /shared Global\ad244d4bf5cd45089815bc67b31dd06a /t 5896 /p 5888
                                                                  1⤵
                                                                    PID:1964
                                                                  • C:\Users\Admin\Downloads\winrar-x64-700.exe
                                                                    "C:\Users\Admin\Downloads\winrar-x64-700.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1468
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                    1⤵
                                                                    • Enumerates system info in registry
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:5720
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd45f2ab58,0x7ffd45f2ab68,0x7ffd45f2ab78
                                                                      2⤵
                                                                        PID:5724
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:2
                                                                        2⤵
                                                                          PID:5492
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                          2⤵
                                                                            PID:1048
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2308 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:4828
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:4168
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:1
                                                                                2⤵
                                                                                  PID:5816
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:4360
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4436
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                      2⤵
                                                                                        PID:5376
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4584 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5340
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4172 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5676
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4340 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1628
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                              2⤵
                                                                                                PID:3024
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:4240
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3216 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4236
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5024 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:5356
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:3020
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:1716
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5076 --field-trial-handle=1940,i,3873142905659737587,14551847469971584553,131072 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5148
                                                                                                          • C:\Users\Admin\Downloads\winrar-x64-700 (1).exe
                                                                                                            "C:\Users\Admin\Downloads\winrar-x64-700 (1).exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:5060
                                                                                                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                          1⤵
                                                                                                            PID:1564
                                                                                                          • C:\Windows\system32\werfault.exe
                                                                                                            werfault.exe /h /shared Global\9364c3a290cb4f9b9512fa40a071be61 /t 5500 /p 1468
                                                                                                            1⤵
                                                                                                              PID:4396

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                    Filesize

                                                                                                                    2B

                                                                                                                    MD5

                                                                                                                    d751713988987e9331980363e24189ce

                                                                                                                    SHA1

                                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                    SHA256

                                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                    SHA512

                                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    523B

                                                                                                                    MD5

                                                                                                                    5021292df45fd72a1cfcc6e91adc9f90

                                                                                                                    SHA1

                                                                                                                    9067f7d1d692498c9dfafeb343b2715e8600e5d0

                                                                                                                    SHA256

                                                                                                                    2df8ed65339cb759822cc879fa6115f569338f49357c376b107ec2bf8c53412b

                                                                                                                    SHA512

                                                                                                                    52178394071739dcc5210eb02073abc39e5af7346f226e5a09ebe2c15d4bf670dc770b11c04d08a0143097a72e008d62cf9d7e4c02619b09f7f56d0fd58e480b

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    523B

                                                                                                                    MD5

                                                                                                                    b2f98a9574ba72566d936f5c58f4da20

                                                                                                                    SHA1

                                                                                                                    3f4e3941602a1ffde8ec669674d691bb729b5c01

                                                                                                                    SHA256

                                                                                                                    0c9bc168a81701927e1c4c948ebb593a2e9c188e8f39134d5540aaf456560fb3

                                                                                                                    SHA512

                                                                                                                    61371cd97b478c294ef299755dd1c076601805bb2111b5f56513cfbd2bbae18bf9374da328f314a0c24eff6cc720c09846b64346fcff948c4c5e814c4d57a22f

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    7KB

                                                                                                                    MD5

                                                                                                                    bf4cc96027953bebe1820eda7fdc9340

                                                                                                                    SHA1

                                                                                                                    f54593e955da60c835f01c82ff80ef16eb6a4ce9

                                                                                                                    SHA256

                                                                                                                    112b0ce423b6c4a68ec8187f1fbfb737883ffb684c77be14ab4fcc17b58cbf7e

                                                                                                                    SHA512

                                                                                                                    2edda3e8ef334660cdd0c4b9d0ddf07cdb75610a5def9fcba066473d3364d4a6bd0f5f832ae680babd6be63d94a9af39add8a06a99b6bc355a313275ec7df163

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    7KB

                                                                                                                    MD5

                                                                                                                    d7e256fc0e9e9449b19e8526ee6a8ef3

                                                                                                                    SHA1

                                                                                                                    a0a3008da99e80f64061061feba4967281c9e25e

                                                                                                                    SHA256

                                                                                                                    f4efc22231dff9a874d3272b1a48ce4ec6e2430ea9581fe77464c50475b1316e

                                                                                                                    SHA512

                                                                                                                    8e11a99d31a95012d8e5404c741ada2c3274f4d87b73233840f9b3f5c1e9429f21829600654e0c8e7349aeb5efa24f9b2ec53597a3d629164e2976e6e2005482

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                    Filesize

                                                                                                                    16KB

                                                                                                                    MD5

                                                                                                                    ae7828649e6e8dd5bcfa406a1d18a3cb

                                                                                                                    SHA1

                                                                                                                    8a4bb64a036101731736fbf80bf938db0e606194

                                                                                                                    SHA256

                                                                                                                    8bce9509cef1b722133dac60e7855f5bf1dc485df5523b986f3cb4e265051c98

                                                                                                                    SHA512

                                                                                                                    397fc7f211281d386204f13d3bcb552e6885130a52e97bb45133273e5983014abff45ecc993c724d4d826ef73c03ec16e19b8b834a6403e515fad8403875d7f5

                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    251KB

                                                                                                                    MD5

                                                                                                                    1c3adb309b8ffb2cc0e2adda2e36fb95

                                                                                                                    SHA1

                                                                                                                    fe0cc4bb5cfa0f9b098c477d391b5301b6aabc36

                                                                                                                    SHA256

                                                                                                                    9af4c211f82246407afa25202747ce7df079582d712bc2950e93c51769ddac22

                                                                                                                    SHA512

                                                                                                                    71212a647763000d2e6d8249634305fbee35911d37e81fadb8fcab8336613b87eb2cefe0c3f0e9f477ba5c2a97b65d6ffc8ede7754f27bd487fb72088b8f0cfd

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    846ce533b9e20979bf1857f1afb61925

                                                                                                                    SHA1

                                                                                                                    4c6726618d10805940dba5e6cf849448b552bf68

                                                                                                                    SHA256

                                                                                                                    b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

                                                                                                                    SHA512

                                                                                                                    8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    104aab1e178489256a1425b28119ec93

                                                                                                                    SHA1

                                                                                                                    0bcf8ad28df672c618cb832ba8de8f85bd858a6c

                                                                                                                    SHA256

                                                                                                                    b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

                                                                                                                    SHA512

                                                                                                                    b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    071dc7c55efe655ca8bec7986dd0ba76

                                                                                                                    SHA1

                                                                                                                    31e366eda6158cb6f2266f5c0f9de48b3e71cc29

                                                                                                                    SHA256

                                                                                                                    74eb561027fabf3349c32e22c41a93f6c82b6f07d5a7d23f67580a5233186260

                                                                                                                    SHA512

                                                                                                                    23db6a0167a753a0c61b042e3581c4256aafd6b09eb583bd353ff0e7e0238af3e2809e7d126096418adfed6b0dfdaaa2c43f99aa6e1d859d0b1e36d530f550d2

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                    Filesize

                                                                                                                    2KB

                                                                                                                    MD5

                                                                                                                    3d16596eadd6a044ac3410fc79548a1d

                                                                                                                    SHA1

                                                                                                                    05122765c3a9810720558b41178ad0198714a168

                                                                                                                    SHA256

                                                                                                                    7b939964f58f88c14ff22f36aaabcb0bb2e578559e9fe543e54691e0a2951cb7

                                                                                                                    SHA512

                                                                                                                    5cc99656d9a74833be7fbf9a5ce0bd431288f9f23eed19ca00f9614eb7bb37881868b0178b442270f0c18e55e25e3b5d05edaa03fefeac6515395d890e9b04a7

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                    MD5

                                                                                                                    cad2358bb31293d82f3f00b79652d3b2

                                                                                                                    SHA1

                                                                                                                    6c84e33cb55817f3a1ea48bcb3e749c575ef534c

                                                                                                                    SHA256

                                                                                                                    f33cda77e74be3a9cded57582adc9f0d9a32e9305917aebcd4fa94a7e8119361

                                                                                                                    SHA512

                                                                                                                    fd6787baf17d8cbcfb3fa0a53a06175d0cf0b64bbc4455676d4aecf542d9db69f18a181327c244c1ab83220e4f194e3440bc81adbc2460411b6a885fd250306e

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                    Filesize

                                                                                                                    7KB

                                                                                                                    MD5

                                                                                                                    1df0ed2381490066ed900459d046ce8e

                                                                                                                    SHA1

                                                                                                                    b339f274dd9b0f7644aea10e7c085254950b5e5e

                                                                                                                    SHA256

                                                                                                                    55169a0e71a9944156063fe52af6801ac5075adee6a4f1489f277be7c215447b

                                                                                                                    SHA512

                                                                                                                    f060b6c0888a11d8d1b1e2944c400f9ecc88aad1a4e824d8ea1b3c2ddb05caff8d5ad788a2c7ec5aec4c3d1529cfd8a209bbefea1182491d58fb60b1818cf188

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                    MD5

                                                                                                                    3a8b17e0158b529f2c2dda35549da869

                                                                                                                    SHA1

                                                                                                                    61567781f3e8df91bb03e290c707e14bad6f526f

                                                                                                                    SHA256

                                                                                                                    2a739f9574a332b0772072cf6ad75083917afaadb83cf86a06092bca76e96b59

                                                                                                                    SHA512

                                                                                                                    b8b05e61764e4ffe214427f1ef7a86841f782fc0b1a8073650e38cd1f86f9cfc28f74d3381267757a4fbe20a8d4e29e37d3cc3fd3e07355d04632f428480d5e5

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    6KB

                                                                                                                    MD5

                                                                                                                    6352ea2d2002bfe76ab3d96c5ee4c1e8

                                                                                                                    SHA1

                                                                                                                    faa27efc71b9f775e1dfbf82eeb03bd6a7ce18d5

                                                                                                                    SHA256

                                                                                                                    e912dcbac9c5c91cc4ea2bfd7364d67317eda743b847e708c5009b115213dc6b

                                                                                                                    SHA512

                                                                                                                    941db50e1f75c354ce54082f9ba1795c38aeb95b32cf3ce9ea33ed6a030a4d4a6be2e67b23cca3942f5982432201f70422a968b0d171f40d81932feb6d0732de

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    43d6652b0d3839652f92cfe6bc97e41c

                                                                                                                    SHA1

                                                                                                                    db0474f2469e553467323dab651022695f842c16

                                                                                                                    SHA256

                                                                                                                    0e0e16147a01ee93bc87c603abad1bb727520548e89a1fab633f8a49ec945d2f

                                                                                                                    SHA512

                                                                                                                    6c75642f1b86ddc4809b363949eebdd7f175a9b4f0f1939552a8aca7238bb5005b7eca999ddd2e0088746d174c31f0e0bb4a2335bd53e94e8323abb934fb9881

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    aa256c0d2068050257b96de8e5daa1b4

                                                                                                                    SHA1

                                                                                                                    195bcaebffd0dc2e13dd7089aec2f0d7286c7aaa

                                                                                                                    SHA256

                                                                                                                    35e805ca499ff3603aba23e02a425ed9dc463dee0432dd3a295f4fa9278dd7fa

                                                                                                                    SHA512

                                                                                                                    781fa0c75b842987139125698520b044613b085a2bfcb37d20fd507ed17db3d6fa3dd934a7fec42110a796ab0da680a182276124cf8a3c5a13e2dccd36bb878e

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    10KB

                                                                                                                    MD5

                                                                                                                    463166e3f0253e64b314bd2c752fb17b

                                                                                                                    SHA1

                                                                                                                    038615fbc3d65308aba79bbd30bd16d3967bd430

                                                                                                                    SHA256

                                                                                                                    974354c78fc40a773952ee9e0027b471533f9c4a0ce6cf79387829d614bc9a4d

                                                                                                                    SHA512

                                                                                                                    429f1a6aab3a2b77a7066bb3639861d0adca87eb49c2d10166acf07aded5ee6eaf8dee5c752362f49eca2134c2e43f646ec3eae4d4e9867ff8dac592d3248a24

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    1fd104d2544d62547a177f1e33adbcaf

                                                                                                                    SHA1

                                                                                                                    df101a340ab60af9b115621ff607a3663e388ac3

                                                                                                                    SHA256

                                                                                                                    d4e2d586d7b1d20f5b3c9fced0fa439c0f0a87a08b09083a36dee7ad906ea551

                                                                                                                    SHA512

                                                                                                                    1d1b5ae1e44e97afa4991d534a3333de2c38a3e9eb29c02a28959a83142048deb77e2646b5c439d0de5aba0fa481d4827712d485e422edfe9514f79ed675cbb5

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    2KB

                                                                                                                    MD5

                                                                                                                    16a7accea15e9073ccb3ad3e9532666d

                                                                                                                    SHA1

                                                                                                                    908dc94e8b57809f149de3a4de50a9ae0c1f0220

                                                                                                                    SHA256

                                                                                                                    eb3b2420ed3e0b4dbf085924c92cfaf1a645c51ca8cfa362fdc4c629c69615b1

                                                                                                                    SHA512

                                                                                                                    86335368027c8e0673434f34c961cf8a999183c6c71f56d21f44b7e8de1f0a175ebdd0440c4598d378ffac845ec47b60a1cebea866ec12076f222a8d7d22478d

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    3KB

                                                                                                                    MD5

                                                                                                                    779651c1e2b261186755503b34506e0b

                                                                                                                    SHA1

                                                                                                                    bc000e322ffb9e66a76ca846b9ba173af1b038b7

                                                                                                                    SHA256

                                                                                                                    a3757c2cf63d5575cb512405a984236fd0a6e29e3c015755cfd595e440267b3b

                                                                                                                    SHA512

                                                                                                                    1dbd54e3fc06a145f5af96a2cf91cc2bfd4e63a2e31060f783b8503613791ea0e5a4ecfddfd76988333621be30964c4caab122785db6eee48f40db7cdd049623

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    3KB

                                                                                                                    MD5

                                                                                                                    2905648e193782cbc3d2f88db16a7009

                                                                                                                    SHA1

                                                                                                                    b1c10a557a2f52076cab4669d41fd4937f361d54

                                                                                                                    SHA256

                                                                                                                    68469c4d863b3a12db065bd335dbb1ffe222e76684edc99933f1c050317f8053

                                                                                                                    SHA512

                                                                                                                    b501cf88fe7592f03fe767427e817cdf1f1bba2ba678a68faff3acbce9d14239bb81cd2354ec62f972ba374f483ae4fbb8cd0cff8885b7ac33086760846a9c45

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b585.TMP

                                                                                                                    Filesize

                                                                                                                    873B

                                                                                                                    MD5

                                                                                                                    e104800dc118006abf5311a1aab16e5c

                                                                                                                    SHA1

                                                                                                                    8f21ba6a23bbcd6c84a220b4d45c77860b601352

                                                                                                                    SHA256

                                                                                                                    ed6fa22760fed2f4633f8494d6b4070a62eebe7f1910bd2fc3a43b12e41ef547

                                                                                                                    SHA512

                                                                                                                    4b7102268fe2bae2f506e82b787ccdec6873ef5585674611861fc8c74ccb92fe8206cb58b6700ea8ae7bbe289e918a41b485878edea0f9b80ef0f998f559ccf5

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                                    SHA1

                                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                    SHA256

                                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                    SHA512

                                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    206702161f94c5cd39fadd03f4014d98

                                                                                                                    SHA1

                                                                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                    SHA256

                                                                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                    SHA512

                                                                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    c2a7646e2c267550e90f7dc6732d791a

                                                                                                                    SHA1

                                                                                                                    8a2f89db78a7690323195c57be9e8d6cf6106139

                                                                                                                    SHA256

                                                                                                                    9fea26686458a6664814948ed6d176ebcc690c1f5e4d730937faaa1f7b705f63

                                                                                                                    SHA512

                                                                                                                    ed4be1a7bdfbc4ca030423e3e3e52d1a84a54fdbe267cf94cccc59ca1378da5420cca10df168db67787db75ddec2bb8781c48c3ffdf562bf0b9a817f8cde1a0a

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    12KB

                                                                                                                    MD5

                                                                                                                    3652c2e4e0f26904eafe592f196107ec

                                                                                                                    SHA1

                                                                                                                    a085ff165c9720870864dbaebd0d055564f00e95

                                                                                                                    SHA256

                                                                                                                    0d8a38e5ae80213dc2e8f65eea64938985b7a9034d6b22b27ca6833c0fa8fd11

                                                                                                                    SHA512

                                                                                                                    7c15bb9610efeb5ed0798c3b1442750df34290d16db45bd51de051ab838deb1bb07cafce8b2df0891e6c79a1a8fe968d13d2e473ee94e3ed6468107364806958

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    12KB

                                                                                                                    MD5

                                                                                                                    c9c09a9bd301814b8558cabaa3afa4be

                                                                                                                    SHA1

                                                                                                                    50f91d4a2f94f20d57e3504fceaad80757ca8199

                                                                                                                    SHA256

                                                                                                                    5e02832f5e22f163d1ec7b69b786e6cdcd42b550a2e56a35665a936eadff524a

                                                                                                                    SHA512

                                                                                                                    801c8de2d748c11492580f18ad8b426f6d2b281fbc0315dfad06c4b7926d3b93c7a49f6aa3a398eb6a497e6cfa9c280ff7d77ea8929f73ebc4cfd9e809c5ec14

                                                                                                                  • C:\Users\Admin\Downloads\Newtonsoft Error Fix.rar

                                                                                                                    Filesize

                                                                                                                    10.4MB

                                                                                                                    MD5

                                                                                                                    a19144cd4cac0e3612db06fc2b817162

                                                                                                                    SHA1

                                                                                                                    4522e0d3654bf9fb0fdc4b40c4cfd71940f1f17d

                                                                                                                    SHA256

                                                                                                                    e966d263f44811528d6074eaf3e7877ef67da1b5fadbef3409036ccfd5f3e76c

                                                                                                                    SHA512

                                                                                                                    cd1adf5e046119881a2642908be8b6987e82b2d3b3fcb8651e2dbbdb0e75f48001fbded3fb4847055557da5ad4c6dc6901d4a70d4b09218b95ae52103dc15a29

                                                                                                                  • C:\Users\Admin\Downloads\winrar-x64-700 (1).exe

                                                                                                                    Filesize

                                                                                                                    3.8MB

                                                                                                                    MD5

                                                                                                                    48deabfacb5c8e88b81c7165ed4e3b0b

                                                                                                                    SHA1

                                                                                                                    de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

                                                                                                                    SHA256

                                                                                                                    ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

                                                                                                                    SHA512

                                                                                                                    d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

                                                                                                                  • C:\Users\Admin\Downloads\winrar-x64-700.exe

                                                                                                                    Filesize

                                                                                                                    3.7MB

                                                                                                                    MD5

                                                                                                                    fc7776eec30751e169e1089bc2a4c478

                                                                                                                    SHA1

                                                                                                                    99cdb78719ca97c7351aa75f1566224396d9033b

                                                                                                                    SHA256

                                                                                                                    426b7b38ca6de20f1f6535d2fa63c16e11780c7cd5f2ebc66ff9a0022e246e83

                                                                                                                    SHA512

                                                                                                                    bc94f526d4dd751a44071dd6f540f2957d96f5c6500d7e5bb41ec6581bb0a584a6bb91fe13f7a1d9c7749c4601b1fe95f2a12a204b73bdc9a37c83cff7ac35c3