redline | hxxps://yuqucheats[.]com/cheat/kiddons-mod-menu[.]html

Analysis

max time kernel
110s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://yuqucheats.com/cheat/kiddons-mod-menu.html

Score

10^/10

redline zgrat discovery infostealer rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/5424-461-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/5424-461-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6432 set thread context of 5424	6432	Yuqu v_7.98.exe	154
PID 2468 set thread context of 1540	2468	Yuqu v_7.98.exe	157

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
2452	msedge.exe
2452	msedge.exe
1568	identity_helper.exe
1568	identity_helper.exe
6736	msedge.exe
6736	msedge.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe
5424	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6480	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
5588	chrome.exe
5588	chrome.exe
5588	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	6480	taskmgr.exe
Token: SeSystemProfilePrivilege	6480	taskmgr.exe
Token: SeCreateGlobalPrivilege	6480	taskmgr.exe
Token: SeDebugPrivilege	5424	RegAsm.exe
Token: SeDebugPrivilege	1540	RegAsm.exe
Token: SeShutdownPrivilege	5588	chrome.exe
Token: SeCreatePagefilePrivilege	5588	chrome.exe
Token: SeShutdownPrivilege	5588	chrome.exe
Token: SeCreatePagefilePrivilege	5588	chrome.exe
Token: SeShutdownPrivilege	5588	chrome.exe
Token: SeCreatePagefilePrivilege	5588	chrome.exe
Token: 33	6480	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6480	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe
6480	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 3560	2452	msedge.exe	82
PID 2452 wrote to memory of 3560	2452	msedge.exe	82
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 3620	2452	msedge.exe	83
PID 2452 wrote to memory of 628	2452	msedge.exe	84
PID 2452 wrote to memory of 628	2452	msedge.exe	84
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85
PID 2452 wrote to memory of 3400	2452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yuqucheats.com/cheat/kiddons-mod-menu.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8728 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8736 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:6384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9456 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9600 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9912 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10256 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10436 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10576 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13727978403980741642,14221524568729063688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9636 /prefetch:1
  2⤵
  PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7056

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:6480

C:\Users\Admin\AppData\Local\Temp\Temp1_Yuqu v_7.98.zip\Yuqu v_7.98.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Yuqu v_7.98.zip\Yuqu v_7.98.exe"
1⤵
- Suspicious use of SetThreadContext
PID:6432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5424

C:\Users\Admin\AppData\Local\Temp\Temp1_Yuqu v_7.98.zip\Yuqu v_7.98.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Yuqu v_7.98.zip\Yuqu v_7.98.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83e0fab58,0x7ff83e0fab68,0x7ff83e0fab78
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3132 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:1
  2⤵
  PID:6404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1956,i,12630777432113215278,2508272006101557068,131072 /prefetch:8
  2⤵
  PID:4740

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c23268e32d91e78a43811bb522b22e50

SHA1
f04e6d0badbca977d2436226379d17dcc1df25cc

SHA256
84c31f32a194206970d9e0958ce00c64e2d654f7de2f3ab9a816ff39ee745dc5

SHA512
8f827689927440c280b5116763456cec6400cb7ad347a4c77d6fc8a68a113fe6cffbef5136ec77435a400d8cae3c7f90e7685bf7729764cca0312174e9b7018e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
2317b34c3db8793590168fad32ea9cbc

SHA1
dc97a02fdeecdbf23fb1ff391ce1ec05425705b8

SHA256
f8fef32b8d80b2b7669bbc07552d0f4a28184cd85b5925d728c82c5675d4cba8

SHA512
af4d453e69ead1f81e5c72945245d241596e8146460811c7f0c71d68d44fa556240ab8f5cdb4eab0952e3409e2680688d214db410d60889a53c2831037d1f515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
73286569a614b32a0cfd3d2cc59f6731

SHA1
a959efe77880d85c52b068657e071566118bb294

SHA256
32e9ff06fa3f77e1ea85eb2c9032140177e0a1f90d6c9f898894070238441656

SHA512
4f6ec250db9acefc51f96c33c6e905bd5f53bc6a9e9845d0ce9eb54c1eff46afd853ea58840a73470a787443791dad1d9996a3ff3ae8d7e0222cea6652b977b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
fe0bc02a884bb85cf58968fa03d3490b

SHA1
ecc2b358a6541735649622a95c7b833b0442b5c7

SHA256
a68ec14acfa7ecbf59706951befb953c2e63690c76d0bca1778af5e92f5a1ef9

SHA512
d3b98a1a4488494717088b1219fe0c9b2a4ebbe81258797cb649f68577559ec7f5f6c99041aff9d959d6c2ea0b11c546f7d0f0aed54e58e0dcdd38b1a60ca1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
2KB

MD5
60ad21e008a8447fc1130a9c9c155148

SHA1
5dfa21d14dc33de3cc93a463688fe1d640b01730

SHA256
bb65e24fd8681e7af464e115fba42ff7713e933683cbd654a124c0e564530bb9

SHA512
42a2753f717a4984967907fa69200e8a464068a6d4a226803cf9503ffb7fee540ffc611b4c905cc84f3623639a6aa93003b390f9c38e601b59f171a9e90bd9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83bc77f8-b30e-4ecf-9ff8-e09ec32d9782.tmp

Filesize
11KB

MD5
c108c5c80b0a56b747eb6c570547d77a

SHA1
8e31769d49e3f752aed8a07bb33b3bb6d589dd94

SHA256
86713256b495607495ffad8550353e0bab7a1f1e4f5c9d53f246bff1293aad04

SHA512
a6caceafc67974b1377d16562e07e2eadccebfec8160b9c929f0e02072b9b679d7d83a0119a02beb6625b81c24480b7b193de3a5889621a837dfcea678f9f299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
62KB

MD5
e2f5339567cadf1f367ae23c6ba2fe2e

SHA1
7b44030002c1b97bd95912ff696ec34d2335017c

SHA256
cb3c31fd9cb4a76d2a6b2d5c8177d121ad4c0bd1e3c0434d5eaacefa141c3ec2

SHA512
f6310fc1f14dc9067875cc67ddc57bb34a59b4772def6b355f0e23d951489361e4e732904ed7fbdded0a2dd0414e4fbdc74ad4c3287946113b956fd7246817b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ceecdfb28afa0013c5fd57b7a659f054

SHA1
956c10e0f44b159cf0ef39975144164421914be3

SHA256
770c21deb33454631135c93284547abc86ca1b728c035684fe1cfc8c21fb1b75

SHA512
942e70d0c9e5c15e867f8fba4de0e2f2bd93d2183cc95247039b58315363c169776e8da67c2b4f8b7b22c04f111789ee56ad3a46e453af639f39096b55d4c42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5632717376509d5684aca4f4b6ee0f9e

SHA1
44822868a49276cbd801d57173410d2c1481e411

SHA256
ddc926b30430d4cb6af9d8deb35f83d19f99c8c2c0ad1fbfbbc975b3f45d9895

SHA512
ddbdccd84eea6d3d1c146d3ec401556f3af7b051db19cb3dcc57559614563bc2b328c2cfa945430f074285b9c4ca7cf8125219db833f23043ee0eba90b124878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
36KB

MD5
786177a1355c5fe959581931c8ed40f1

SHA1
82205739f5dd8b4c4d19fc30aba621eaa5dda742

SHA256
fbb31d261c9c95c323decf5d1f8ebeea48c70702f2b6373702fe99a046cf5475

SHA512
e8fc68a60afb4d7ad92727e4a003029805f730662ad5ecfb5f0d3889f4e0372b8a09ecba7b1995716bc7eb1893b879bd65dc735181038f8b032ceade36a96726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
941dbbd2b43b2153eefa9b23e3e8b355

SHA1
bb54d74f4ad92dc42809ea9d73bf50295f9ec7fe

SHA256
6d975facb0a318b86fa58997220b39048d3111e8b7c7d2b2b391841cc00a3e6e

SHA512
a7da170a507a5737a1e78e4096da1f4a9b860d3f748c921c74808bb4bc6ba805c3f8dd344a52da17efbe7b3a53fca5858074d6586534b01f83ab9fc0e0201522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b23071d7c636d73f8e20db057d6840aa

SHA1
5684b00af7fd04dc7bccb6ec65baecd50e147e23

SHA256
092bcceffca13ebeb2a1cfe7101aef85bc074002e36c30b99fc63db7f6a5d708

SHA512
8c30e380349131cedb0bc41775b224604361b743994bc30747206a18fc29d0bd792e102f151e8e1c62032218bd269be2c47cd0c401d0ef1dbcf4fbb3919e3fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
609a7046ee70e4168209665a6065648e

SHA1
d95c396cebc4a5189d19fde8b48bc3677a61541d

SHA256
4278f290bdc824a205ac4fd4ec1217edbdcc8aa2255589be36a93915a865d4c4

SHA512
73e5008897d48c8dc3e9fcfe71b08a716544e31022e9785bdcce77fa8d3e05d1519d15f29606bdd1a50bc11df9b3b95ed095345328f4c31e7b81d9253703b5a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
eae69bcd17f27dec0d50b59b71160178

SHA1
f856a3db2aaf43e4a3e6b3041b9d5daa6b9666f2

SHA256
df265c94ad9f35fb475276f8c5c11e2ed978f394cbc2a39a15909d9abc14d99a

SHA512
9269f6a1cf566c1dc5311a85186555cade4dc5c00a7b52479d24d69b4ef85a30faa40fe8cf7654b1cce2dd577223143fbe858a6bf2f97914b563ff53248566ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2e340cfd5207c0402db336748921634c

SHA1
4e49e088073d4513e21283104fd88d6bc1a55e32

SHA256
1b0e8ce951031cba25dc488f2152cb79749c6544cc5161d125f3dcbdedd68668

SHA512
2b7bbe788633b928df2996e6c2a2b012f11b92f3567d2d61599ac2d2161d51056e52d5e7c6ccc21e0b895ee181c5fad257729b04c0dd12b3386614aeba88d993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0642e41d72f94b9300b705736531964e

SHA1
9dc7429a9b918e80544a4f917c347bb904ca8420

SHA256
ef17b723363148baec3386086df6ce2e82cae056259c030b270203bd68aff5f2

SHA512
ac5e7d9d48f43a7890e8cdd21bb11071817e5853c021fafb15805e1b9165e87ccb9355a3f64ca44aff05f1549554ada3eeec6c30f085637df3ebc9defd470de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579fda.TMP

Filesize
2KB

MD5
13eebdb96d24a86fe10127e73a9207a6

SHA1
dfcdcbe254a3053b0367d9534511d925a5528b0e

SHA256
cca3a912360c16b5ab0060f2517454d7a554b657f4bc79e51dff580ea6f7f217

SHA512
42c9448b3838dad8056c3eb5c87fc1393ba6e81b44d1cff73b3be4e10f7b55b38467ace7af1df44fb007f3d65dec5baf1902fb01f23b86116e81f5ca91f97f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f34dbb05e86388e8b7e469b3b8a2d1f8

SHA1
14f7a450db93f21a7f5bc33e5e6cda055f1f0f15

SHA256
6f93f5b19698ffe24380c4a3def95da7e66d1e9e12bd41cd19991ac46c95fed2

SHA512
2de3a66aa7d75a26c30ae8ca72c76d2879284abf495d4dbb78a1696f1bcc6964b2df9ce4e04fc55aa024d5f737070d75dff967cda0b25df13fbdf5a11ea96326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
554eefbaae73ed502d0a38657c08e654

SHA1
62a0b12cbf2fd4c87587d6fc6bae837cc216f7dd

SHA256
e0f553c90a8b9b1943862f9735581aa5e1fc78a4bb7b838741e49ad2cce9f056

SHA512
33ed738b0cf145595a8701d62f7e4df8ec3fa102267a44cab70088ab8a57f7f72795de6d17e708f410643b35c76ba920ff472fe6d279e325a81d360857f307ad

Download Submit
memory/2468-481-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/5424-473-0x0000000006E00000-0x0000000006E1E000-memory.dmp

Filesize
120KB

Download
memory/5424-467-0x0000000006A00000-0x0000000006B0A000-memory.dmp

Filesize
1.0MB

Download
memory/5424-475-0x0000000009590000-0x0000000009ABC000-memory.dmp

Filesize
5.2MB

Download
memory/5424-463-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/5424-464-0x0000000005880000-0x0000000005912000-memory.dmp

Filesize
584KB

Download
memory/5424-465-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/5424-466-0x0000000006EB0000-0x00000000074C8000-memory.dmp

Filesize
6.1MB

Download
memory/5424-474-0x0000000008E90000-0x0000000009052000-memory.dmp

Filesize
1.8MB

Download
memory/5424-468-0x0000000006930000-0x0000000006942000-memory.dmp

Filesize
72KB

Download
memory/5424-469-0x0000000006990000-0x00000000069CC000-memory.dmp

Filesize
240KB

Download
memory/5424-470-0x0000000006B10000-0x0000000006B5C000-memory.dmp

Filesize
304KB

Download
memory/5424-471-0x0000000006C90000-0x0000000006CF6000-memory.dmp

Filesize
408KB

Download
memory/5424-472-0x00000000075D0000-0x0000000007646000-memory.dmp

Filesize
472KB

Download
memory/5424-461-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/6432-460-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/6432-462-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/6480-399-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-400-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-401-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-402-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-403-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-404-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-405-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-395-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-394-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download
memory/6480-393-0x000002964FAC0000-0x000002964FAC1000-memory.dmp

Filesize
4KB

Download