dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VencordInstaller.exe
Size

9.9MB
MD5

1b8ee61ddcfd1d425821d76ea54ca829
SHA1

f8daf2bea3d4a6bfc99455d69c3754054de3baa5
SHA256

dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871
SHA512

75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a
SSDEEP

98304:jmPUf5A91QP5oToUsbeRwcyHekFeSpc12EKw+KVktWHBLmpTN5huJd3kMerGpNTt:SqqQP5oKswpLi3gOW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609032298590175"	chrome.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{BC326123-4BB3-4F39-81F1-350410774AC3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

chrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3704	chrome.exe
3704	chrome.exe
3204	msedge.exe
3204	msedge.exe
4536	msedge.exe
4536	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
1992	msedge.exe
1992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

VencordInstaller.exe

pid process

1832 VencordInstaller.exe

pid	process
1832	VencordInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3704 wrote to memory of 4992	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4992	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 920	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 1936	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 1936	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe
PID 3704 wrote to memory of 4172	3704	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb95a6ab58,0x7ffb95a6ab68,0x7ffb95a6ab78
2⤵
PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:2
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:1936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:4172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:1
2⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:1
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3576 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:1
2⤵
PID:528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:3344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:2140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:3040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:8
2⤵
PID:1752

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:1600

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f284ae48,0x7ff7f284ae58,0x7ff7f284ae68
3⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4944 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:1
2⤵
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4540 --field-trial-handle=1936,i,4987953214672238448,11164310057971757619,131072 /prefetch:1
2⤵
PID:516

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb969b46f8,0x7ffb969b4708,0x7ffb969b4718
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
2⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8100122431048290789,4898426929543076986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
2⤵
PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
89b7db0aed4e079e1452dd148f8d9bc6

SHA1
635eca67670c7f2a2cf3ad60d57d00026e388564

SHA256
676a69efc79c776d3dfffff110195e8bce64dd5385a986b0e2678351fcc6d7b2

SHA512
4202ef7a2583f95774ce87bb4c140717add0fd4aba398a2cd2d5b7d1265881b49b1dd66611e3764cf1e384ce43b8f8208c9e154d39fa66fab63967b520acf1dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
61f8c7fa99dda1e332489315ab9dbc07

SHA1
c8e2ef732cf147dea5ad1edee67e699a878c487c

SHA256
34897437cb1f40d203cc3a2172c297a9d64074fbdd76704b061575aaf0e3527a

SHA512
598356727c6be94a536ef58ad139d6cf53560d45db3d9324045f90ef54f6aefe68310a9ea98c8ad8f0dc8f7441c788baf86d9d587e67f078fb3e785834817127

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
5b0dee672fb15383e16078b6f2a716c7

SHA1
9dc40898155cc2dca2c887e8f44cb39a70dc4940

SHA256
c8b8430da205061d09c8e7a4ffe29ba8977c3e690e4429ae4fdc2a07a12b2945

SHA512
25c622cd21565759166d1f5b1c7de272d0431b70eabddf3d3239f401a0fbc08090896c197bbacfeb9dc57b3647aaab2e30190de29f82f65087bdec25c3ef17e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
7cb2082fb327a0bf4c8dfd488ecf1e0e

SHA1
87c73b957724fb9291e3e0bb897856ce121e95a7

SHA256
aa57a28593a20cbc969550ce82d7c21471cfdf4ef9f73487976dd7db863d0295

SHA512
c885a0f641671b367b07796da4f24b647d4b910fa35975e5ec068bd0cd861c987ff89eded9fbca7644ea8e71fb127a0471e391e756ae74658f87f60d9d2b3749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f02d51c1fc8240da6d32c14e6ba7c346

SHA1
d898b8c854e87ec0b059acf405d2ae1eb9b60041

SHA256
8f5283bfa314006f2d2a9ed07983ec47c582fa0baccfb4b7902c9b02a5d30d18

SHA512
bf992f2ddbb61bc7214c65da02bf704d29c52d1e6491089cfb9dd4c8ed6632efd67222c8ffcdb9eb6ab28a02de76f36358c1b411825fd03bd701f01467f57982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
be2b8033e49f43761176f07664d0b4cf

SHA1
682f7863cacca6292f9ce2e20d257df1c096fa1e

SHA256
d915de46a0b4e14135d9e8842df165f82a206d2a7fb75a142078d805c6ebd78b

SHA512
a46d2b9b4951089f9a7838f80cd55393149a152aca0746f621b36092e2ba22a440fe126af35d943dbadf7d2430278a93e31df58ab61fc3c4d99f6598fe273101

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8474a1d1fecd5134f2d9c9ca0e64c765

SHA1
0a93db9072aca1ec9038c092d717af18559ff625

SHA256
c37d45df22dbb424f4f1b09aae22fff05eea3dec76cb90f9d28cd280eafd0139

SHA512
4edf26bdcf5fd94c0c7cb3ef7909ceec0b2df28f2c34c0efe82892b3fc23167a7f217e9f5780a58fe75744f23ab693df7bb3561385b18ca4a1e2c0ea113e4b98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
22fcc8ee590a9ec4c5b21bec7c8f14e3

SHA1
92cbc0f90e38e11f559ae34816c4e314667bb773

SHA256
cc8603c2474921abec4600a6a952ce77014c4c0583cf7ee60deb3f7cb9077b89

SHA512
7ed5a915731966eb251f5fc63f82658b3a12b6fc7aac1b6ab56955448663f9bd885d0745ad23648879973d9b3852cf67e26a89b3c8a1e22fc31ada9ce9b82729

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
7751dea2f9e334d26e8c9e847326e0f2

SHA1
43da01fdd703ef250b8165bacf5c148b5af769b8

SHA256
6dc7d494188aeb26b1b3f3769b89cff7b881b89945a5764d1bc77ddd121c3831

SHA512
061f75dd7535b9f9862313a3641195afc55c33fa109ebae6fa442525a5e66e92ba1f3ea6cd24a1ea77d33ee3cf65cf01ad57ad1d6c3fc1627e7c3cc4159023be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
3f79cbb2bc36c8187657680d49bfa69b

SHA1
87f02c8529767782f8baf07d54ccfc3f1b8aa876

SHA256
fb2c8a20da7be6e482b3c562de33a8abce85ca13d6ea677d14add0b0cd6ca5b6

SHA512
a9f8bcb57f46a4d06d248a5bd20f8beadea8c0cc227150435ccf8f34630bf05c1c541fd41d8b9cb8941364edaa258b98ee100bf1427d1a0c7dc33d7582f08164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7681ff2b1d04cc9960c243cb6607b0be

SHA1
0b6c80b078d1dd9306004f007cb9f0da9c462edf

SHA256
116e82d0ecc17262389a185f4c41a5e258189d9a21c2178e8cdf0db68de34fdc

SHA512
210c47561db379b562f841c3a3fd0b2dde4c3991ed0d941ad317ba4704cf0e905920072ec8c6e93cd323507fce23dd7e4db2f6fde5af19aa8a39f8b0ef90934b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2631a1edb0c278a60e192713c783cda3

SHA1
63720350c5d41bd554fcf2c722a6a62dc28578b6

SHA256
5b8c16716011125764a4fdba42cd70dd2355be75b9c45db4b2e901b9d593a8f2

SHA512
86821677eb84ba835e62d08d6126f25bc92a26e32700f14febd647743ea327c13ac38a9dc0c737ae60c373527a2a44f7570501b27012ad69be5ae362c79676aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1377856fe83dac4d73599a3babe5867c

SHA1
1b597efd5b16bb5c3ba9487b614431e305720d59

SHA256
c945acb5f9a0d641bb31aeb2f0219f604532a7f70a113c4180c06ed53534ca13

SHA512
059f0e4f2e9ea02cffbe05088f6610dc81a622451ba79dc37b4f228d438521f84150b607c12b6723a8c9629e2d8da6cfe6af2522fa046e75b209f30d78ff43ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9764adc2479f59ab326af836458cb02b

SHA1
b4c933583c509bb8719053604d3ca8560c01c900

SHA256
2a25cbd6ade781f5102c8a5e7e0d6bdcdea29132e7ac8f200342a9496964d886

SHA512
48d1a4ea5bc6301aa07ac32fafd6c0c5c27090497753ad96fb34633f79781940c5affdad6fe3bfc1a874490d1593ea54c54cc5179a9c18271dcca001b4354525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cdb41a68b2f2e1c935cd674b5c407de

SHA1
6a3123fcd5e35786cd4db5d0296dc2a09990a716

SHA256
27767dfd2fb1872ddba9350f540526d78275cab0a7d6a953ccd39265b4fb6352

SHA512
ac9690bcb33f0ff42c170bbb9822560d6d0b3d5625e83b877b0498ecbd3d13c0b7f6354977f242cca705391de2d9b44d664d5c7412d91de86a173356317f3dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8490635be5abf973e3d7f0fea018613a

SHA1
89404cd1554ee320df4d55a0547a4eb0e1714988

SHA256
c5501b98b2f995826daee51ba74af20ace0e7e7865325ccac450128a804bf1e9

SHA512
5afc63fd839dd0024cfcbcc1d2bcf409b01cb20526db5469daf7a73b6dcbcd3f1d72a8875e5674d6801db14859147926ffac746270ae9c0efaa2689951826fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3475e666a7432f68a152f47ca722c48

SHA1
3cd32752a3608ea36da27d53a0b9a550beb77234

SHA256
1e55aebad9b01078eef04885cc477e7c42bf70bb16d27039c449421de79d40a4

SHA512
795686abbfb8d663f9ef0bf8f76be8d5ad53eef9f5e177c47ce24e13b37fef065138188b905a7db00b16d94504c77c890614980dada7fd6c91e5e8dbafe63264

Download Submit
\??\pipe\crashpad_3704_SHNIVSUFLPYBPNTE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1832-0-0x00007FF7C99F0000-0x00007FF7CAC69000-memory.dmp

Filesize
18.5MB

Download