rhadamanthys | hxxps://dl[.]dropboxusercontent[.]com/scl/fi/aihkutsoiyhu3to98rfeu/[.]rar?rlkey=a555bfxjfjyg6hq2i5bzmcndj&st=i170g4xw&dl=0

Resubmissions

06-08-2024 17:54

240806-wg178swajr 10

06-08-2024 17:17

06-08-2024 17:01

06-08-2024 08:46

06-08-2024 08:34

06-08-2024 07:19

Analysis

max time kernel
806s
max time network
878s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dl.dropboxusercontent.com/scl/fi/aihkutsoiyhu3to98rfeu/.rar?rlkey=a555bfxjfjyg6hq2i5bzmcndj&st=i170g4xw&dl=0

Score

10^/10

rhadamanthys discovery persistence privilege_escalation stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2232 created 2672	2232	תמונות של הפרת זכויות יוצרים.exe	44
PID 1224 created 2672	1224	תמונות של הפרת זכויות יוצרים.exe	44

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	notepad++.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	gup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
2664	7z2407-x64.exe
2212	7zG.exe
4408	7zG.exe
2484	npp.8.6.7.Installer.x64.exe
740	notepad++.exe
4620	gup.exe
636	notepad++.exe
5412	npp.8.6.9.Installer.x64.exe
5796	notepad++.exe
5456	7zG.exe
5168	תמונות של הפרת זכויות יוצרים.exe
2232	תמונות של הפרת זכויות יוצרים.exe
3520	7zG.exe
740	תמונות של הפרת זכויות יוצרים.exe
1424	notepad++.exe
1224	תמונות של הפרת זכויות יוצרים.exe

Loads dropped DLL 32 IoCs

pid	Process
3492	Process not Found
3492	Process not Found
2212	7zG.exe
4408	7zG.exe
2484	npp.8.6.7.Installer.x64.exe
2484	npp.8.6.7.Installer.x64.exe
2484	npp.8.6.7.Installer.x64.exe
2484	npp.8.6.7.Installer.x64.exe
2484	npp.8.6.7.Installer.x64.exe
2484	npp.8.6.7.Installer.x64.exe
3712	regsvr32.exe
3544	regsvr32.exe
3492	Process not Found
4620	gup.exe
740	notepad++.exe
740	notepad++.exe
740	notepad++.exe
740	notepad++.exe
740	notepad++.exe
740	notepad++.exe
5412	npp.8.6.9.Installer.x64.exe
5412	npp.8.6.9.Installer.x64.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5456	7zG.exe
5168	תמונות של הפרת זכויות יוצרים.exe
3520	7zG.exe
740	תמונות של הפרת זכויות יוצרים.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5168	תמונות של הפרת זכויות יוצרים.exe
740	תמונות של הפרת זכויות יוצרים.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2407-x64.exe
File created	C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cs.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\asm.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\rust.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\gdscript.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Navajo.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\uninstall.exe	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\change.log	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\HotFudgeSundae.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\functionList\xml.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\php.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\python.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\MossyLawn.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\updater\LICENSE	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Plastic Code Wrap.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\nsis.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\cpp.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\java.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\langs.model.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\javascript.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\sql.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\contextMenu.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\notepad++.exe	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\updater\libcurl.dll	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\batch.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\cs.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\coffee.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\lua.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\shortcuts.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\Hello Kitty.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2407-x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\vb.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\themes\khaki.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\autoCompletion\css.xml	npp.8.6.7.Installer.x64.exe
File created	C:\Program Files\Notepad++\functionList\powershell.xml	npp.8.6.7.Installer.x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2407-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1096	2232	WerFault.exe	178
5616	2232	WerFault.exe	178
624	1224	WerFault.exe	209
6016	1224	WerFault.exe	209

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	תמונות של הפרת זכויות יוצרים.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	תמונות של הפרת זכויות יוצרים.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2407-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.8.6.7.Installer.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	תמונות של הפרת זכויות יוצרים.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	תמונות של הפרת זכויות יוצרים.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.8.6.9.Installer.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674030908392437"	chrome.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\NeverDefault	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{EE19C659-BB06-499D-90AD-8EEB867212B1}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ = "Notepad++ Context menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ = "C:\\Program Files\\Notepad++\\contextMenu\\NppShell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shell\ANotepad++64	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ExplorerCommandHandler = "{B298D29A-A6ED-11DE-BA8C-A68E55D89593}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\ = "notepad++"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2407-x64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 990692.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 75249.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
388	msedge.exe
388	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
2260	msedge.exe
2260	msedge.exe
1416	msedge.exe
1416	msedge.exe
4284	msedge.exe
4284	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
1304	msedge.exe
1304	msedge.exe
2232	תמונות של הפרת זכויות יוצרים.exe
2232	תמונות של הפרת זכויות יוצרים.exe
2784	openwith.exe
2784	openwith.exe
2784	openwith.exe
2784	openwith.exe
6088	chrome.exe
6088	chrome.exe
1224	תמונות של הפרת זכויות יוצרים.exe
1224	תמונות של הפרת זכויות יוצרים.exe
4964	openwith.exe
4964	openwith.exe
4964	openwith.exe
4964	openwith.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2212	7zG.exe
3520	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2212	7zG.exe
Token: 35	2212	7zG.exe
Token: SeSecurityPrivilege	2212	7zG.exe
Token: SeSecurityPrivilege	2212	7zG.exe
Token: SeRestorePrivilege	4408	7zG.exe
Token: 35	4408	7zG.exe
Token: SeSecurityPrivilege	4408	7zG.exe
Token: SeSecurityPrivilege	4408	7zG.exe
Token: SeRestorePrivilege	5456	7zG.exe
Token: 35	5456	7zG.exe
Token: SeSecurityPrivilege	5456	7zG.exe
Token: SeSecurityPrivilege	5456	7zG.exe
Token: SeRestorePrivilege	3520	7zG.exe
Token: 35	3520	7zG.exe
Token: SeSecurityPrivilege	3520	7zG.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe
Token: SeCreatePagefilePrivilege	6088	chrome.exe
Token: SeShutdownPrivilege	6088	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
2212	7zG.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe
6088	chrome.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2664	7z2407-x64.exe
2484	npp.8.6.7.Installer.x64.exe
4620	gup.exe
740	notepad++.exe
636	notepad++.exe
740	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe
5796	notepad++.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3644	388	msedge.exe	84
PID 388 wrote to memory of 3644	388	msedge.exe	84
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 1448	388	msedge.exe	86
PID 388 wrote to memory of 2924	388	msedge.exe	87
PID 388 wrote to memory of 2924	388	msedge.exe	87
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88
PID 388 wrote to memory of 3688	388	msedge.exe	88

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2672
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dl.dropboxusercontent.com/scl/fi/aihkutsoiyhu3to98rfeu/.rar?rlkey=a555bfxjfjyg6hq2i5bzmcndj&st=i170g4xw&dl=0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa214d46f8,0x7ffa214d4708,0x7ffa214d4718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Users\Admin\Downloads\7z2407-x64.exe
  "C:\Users\Admin\Downloads\7z2407-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Users\Admin\Downloads\npp.8.6.7.Installer.x64.exe
  "C:\Users\Admin\Downloads\npp.8.6.7.Installer.x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2484
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3544
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"
    3⤵
    PID:2220
- - C:\Program Files\Notepad++\notepad++.exe
    "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1600 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6208038622215882814,13480770942589162121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7996 /prefetch:1
  2⤵
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2688

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17717:118:7zEvent18241
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\" -spe -an -ai#7zMap30012:118:7zEvent23580
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4540
- C:\Program Files\Notepad++\notepad++.exe
  "C:\Program Files\Notepad++\notepad++.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:740
- - C:\Program Files\Notepad++\updater\gup.exe
    "C:\Program Files\Notepad++\updater\gup.exe" -v8.67 -px64
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\npp.8.6.9.Installer.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\npp.8.6.9.Installer.x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5412

C:\Program Files\Notepad++\notepad++.exe
"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\Support2"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5796

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\Support2~\" -spe -an -ai#7zMap17919:128:7zEvent16112
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe
"C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5168
- C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe
  "C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 464
    3⤵
    - Program crash
    PID:1096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 500
    3⤵
    - Program crash
    PID:5616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2232 -ip 2232
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2232 -ip 2232
1⤵
PID:6140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap11932:176:7zEvent26863
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa1ed6cc40,0x7ffa1ed6cc4c,0x7ffa1ed6cc58
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2200,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2296 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4548,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5024,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4772,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3532,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4412,i,7297383985652029118,13035957590963141662,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5276

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5976

C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe
"C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
PID:740
- C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe
  "C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 444
    3⤵
    - Program crash
    PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 440
    3⤵
    - Program crash
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:228

C:\Program Files\Notepad++\notepad++.exe
"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Admin\Downloads\תמונות של הפרת זכויות יוצרים\תמונות של הפרת זכויות יוצרים.exe"
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1224 -ip 1224
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1224 -ip 1224
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
8af282b10fd825dc83d827c1d8d23b53

SHA1
17c08d9ad0fb1537c7e6cb125ec0acbc72f2b355

SHA256
1c0012c9785c3283556ac33a70f77a1bc6914d79218a5c4903b1c174aaa558ca

SHA512
cb6811df9597796302d33c5c138b576651a1e1f660717dd79602db669692c18844b87c68f2126d5f56ff584eee3c8710206265465583de9ec9da42a6ed2477f8

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
0009bd5e13766d11a23289734b383cbe

SHA1
913784502be52ce33078d75b97a1c1396414cf44

SHA256
3691adcefc6da67eedd02a1b1fc7a21894afd83ecf1b6216d303ed55a5f8d129

SHA512
d92cd55fcef5b15975c741f645f9c3cc53ae7cd5dffd5d5745adecf098b9957e8ed379e50f3d0855d54598e950b2dbf79094da70d94dfd7fc40bda7163a09b2b

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
ef0279a7884b9dd13a8a2b6e6f105419

SHA1
755af3328261b37426bc495c6c64bba0c18870b2

SHA256
0cee5cb3da5dc517d2283d0d5dae69e9be68f1d8d64eca65c81daef9b0b8c69b

SHA512
9376a91b8fb3f03d5a777461b1644049eccac4d77b44334d3fe292debed16b4d40601ebe9accb29b386f37eb3ccc2415b92e5cc1735bcce600618734112d6d0e

Download Submit
C:\Program Files\Notepad++\contextMenu\NppShell.dll

Filesize
375KB

MD5
201c06dc1a485f6a74b21c9b739c2eae

SHA1
96c1f31f32804db333148175224b453a28032d9e

SHA256
5b2ab24d0f1a1a9691352a467fe4aad18454408b6f7700420c578f30c46d5cbb

SHA512
74251b5a6d1474a04b8d85b14a8581670ffc662b6a14d23af84b53ff4bff9cefc7ffe850a4a230ae486dca89fdbe54e91339634917962544a05cbd7e3c7df70a

Download Submit
C:\Program Files\Notepad++\notepad++.exe

Filesize
6.9MB

MD5
013dd1c256a30cc3926b828cce0ebcc9

SHA1
1bd408453ae299385ab0b09edc84312a8379156a

SHA256
86aa89aaf2b85dd3cd9482aa90411fc9176b0dd642c54c13c0e3324518f54574

SHA512
83b57663adc290dc97f0939485b0e46f4cb90edc3542a856a394eeaaacd9e7cf66bccdfad2de2ad9bc84954d5229fc052702ca82c29e428f689125adfa196f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
7513c3be029d944579ed424b8d4d28ed

SHA1
2dc3e45f95044fc3c621d65d45fed9a17d5f43e3

SHA256
5590a3072dc040f527c83391158e8bc53e661bfd7b5d39b7bcf375c07c2c3600

SHA512
91e6fdea06da24a2241da7420df9c3472a06e1c24d8a9947e3ec0408649a00c01aee38eb85634ba68cf0f394f50a28a3f996983262fba962fa56128124f1a716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ca3d72a731042807b74483a5fa6927c5

SHA1
15bd8d58805659f034756b9957ad26cb78597893

SHA256
b0c7026f816e89b8ed0d113b521d4ccc0863b56f1c0e02f71a0b05f7c38e4d36

SHA512
1ac85bcf3dcf6f3f894e1e630614fcaf093818b0c407bbe8eb683dc616c3b8e6d9e0db2356e9c34128823df1f76d0e99ed3735d1aafdc07212b31bc3db9091fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
493194b9acd54c06b3b2372944325b30

SHA1
09db4a1cb947c478ac28375b51bbfe23b55ddc35

SHA256
bec3d1d4aa91fec524cffdb4feeab4f451df0b00e94540d8194ca4d32b50c36a

SHA512
6460783b7f3193ba8c810f68bb16f0598b86721d826a0fa17c5abb12e6ce7f0ac918112da9dc842a264237e4a5773459fddb46215eaa503ea4fe618a2913a7c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
884b46502c15357ed3574c0d177b6e39

SHA1
8c51a23128631e09f105f1af33ec94da424b99f3

SHA256
0a40ca6ee8db9466588000a14eea87a7b8a441972a36c613d50ec41f8c707c5b

SHA512
1d3c4ee4ba34f5f133345ce136ec2a987091b6a25f806f71fa0e154e1114add6852e3b2d0975a33236e0cb7e77821f4961a32e07617349daedbbab469d5827f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
a3bceed6c41a6fdaaf5528f097fee27d

SHA1
d9df611a2a3ee829144ff5290c9d122859df17f4

SHA256
e81b74b8a22283f6ba133beb803f9af9839d4dbb5cf324b8c8c5374f825294ba

SHA512
ad87633e9e5cc5cd96b91d4966dd829612c3a1758adb46368f94d00638b83b021373bb02f2e60f3607f7009f506e6038eb9b165a2349aba76deae3a975be9331

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
342ab0a76c5001f4a816b07da9a4e9bb

SHA1
337935acd61f536a3552ab409bd4e1534dd32f2f

SHA256
78b15ba3cdbe5a691e4a78d7b4835de15228ae54c20e7e2641d2a47117f13694

SHA512
16542c2dbfe2b730afec97aff51024d9ee67bc7ef0dc1799e189c6d39859448f5d874270b038ba539abc57b751aef961008a50dab831ced325d5fbff6af7d9b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1c2d1a38d2d12738bc1c732c207a1c4a

SHA1
ace8e3c6fc9188c0d6dfc5d4a2d381fc52240cdb

SHA256
44e337935c3b24460bc795fcf242f1a297f9366388a0e24cb840dac2b41e50ed

SHA512
0faaaec0117ecd6bbb65226054af7e5e45289174cc11a6927ce2c51336a6cf95ba114b2d0b67760be5137b54751187b9ad3e8a425fc0301d3bbaa44cce7c5844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f1f7f126a9f6d40b04e25d5bc4930b48

SHA1
64f7497dfdb1ad7c2f5533ad17e422079dd05a90

SHA256
145f7efdc40176a608f9229f491284dc3a21111ed5bbe40245d117b810c07f4b

SHA512
15fa276f5e3c46961dcdf06bce023d924177754f7181b7c5ed6f912245c349fd872299d2bf8823bc9757c0aeb482909cf9500b98c0c316c73acdbb82dc28206d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ff4ca2e57509f0df69f3ef61939e98d3

SHA1
f8c961941ddc68cc0101f79c73139dd33d53ca36

SHA256
17fe80044b120f023c82dc8a8aa5fe5a1154717b09bab38efab03383a515ec45

SHA512
6e2189f483ded0ae84bf58661fd457c1e604e2bc25636f32c4a44fd0dec31c063abc1331b76274ae781c5b5e152881dab9ef4f7ad794622afff1816c4f38f925

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b91bde577b9c1e7fed386c43197edfb2

SHA1
1afeb6cad0c2f812b9899061b917d631908cac0c

SHA256
5d39aa6964fda135251fd0f49625535126a3a98fba5583092332b348227d5b11

SHA512
cb9e54b316730866d3dc4a0dbd5b8d9b5a0d358382897f53fb6b954fc197f485eccb41f67c256ceb166709470e49b1cc76fa1e5a36c71b0832e10dd0a592ae02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
95c587f65232585c4eea80a48a723c30

SHA1
ddb14745447fa9b259f86f61ce26af676c9f4c0b

SHA256
77a56aba342d090ac80feb31318a18e2cb9c9abffe217ffefd06d41434ab1595

SHA512
846ca6e5676db8b477873aaa36c76eb6ab8d868e13025c5a8d4e84f4dc4563c81bf1e98c41b60316749c15b08881dbb040efea198e440a86ced49c743e68b17c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
af61c44692d1d7b7d20b196bdf6e5aca

SHA1
e304e78bfcc73d2bcceaf49d55fc421565dcf0ca

SHA256
8d48e973592cce387d73dd52a9c4e6ba5857a4d55a6a74c67fce4d5d0c4887fb

SHA512
2951e68fae7fd52f9c43d5ee291a57e54691ea8af57eb18fdd304680ca333b47e03cfd3f126fb63d32c540af0a61b57a469785e3a3c6521eeb00489cef39ce2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8a79fd1ba4fa272399a946e4b858a817

SHA1
469a4e29749cb9ce48aac8674ef041b0b873bd68

SHA256
ce8d0d22107e6f48487b902f366e92a9b52f672ea4033124c8f96c28547673fd

SHA512
b546dfd2688cdae0267a96be4879203580337ec62a3b77556ff05ee73e003d08b735d5c3ec062bd4525885f6ebbf2030d4813e09599c910d1ce4dbfe9e4449ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
41e8361f05eddaa2e2bfebadcd3e90e6

SHA1
f550619d54f9356607823abe2eea6cebe63df57a

SHA256
c1ceb072b6c63d5d6d28db6c2bce40adfa16943841f29243ec84de3a40098a1f

SHA512
e482f11238911fc8730a5dcac8b1c3b713f4bab35c664ee1a78237dd580e24acabf900e372718311f59fdab8442dce0993fc63e9a0cc1f5561a06b960c1c1bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
194KB

MD5
abccc4ddbfecced79a1d85034593e090

SHA1
a8e9de1c6531df7068554bf20a3c48142f84e8b2

SHA256
7f1c65bc873e2272770f07ebf5ed2ab733932a78d8662aceaf467b7ded7c18f1

SHA512
7da133bd036dc37309f58f1f1131e03ed6757612744fbd107d478867639a7ef39989f7dd026d0c019302043feee181f7a5d5d26b3f36b0952b60a40d23114b66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
194KB

MD5
1ae69b5dd2ce968e7c6831a4f0ce6b33

SHA1
6481780ddfc0baac3c42b2fa9e274e61a97cd556

SHA256
aff272875719ae796b555962eead9c8546f1fba8010b9c5f53b789b5075c4fd7

SHA512
a644966f413ddfc52f998ba19edd4cb302168f5779ac72aeacaa028f820f978c49cb544146fd4a7d177c131993db936d7b95d4503cc7847907e9a958f56629c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
69KB

MD5
24a806fccb1d271a0e884e1897f2c1bc

SHA1
11bde7bb9cc39a5ef1bcddfc526f3083c9f2298a

SHA256
e83f90413d723b682d15972abeaaa71b9cead9b0c25bf8aac88485d4be46fb85

SHA512
33255665affcba0a0ada9cf3712ee237c92433a09cda894d63dd1384349e2159d0fe06fa09cca616668ef8fcbb8d0a73ef381d30702c20aad95fc5e9396101ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
41KB

MD5
ed3c7f5755bf251bd20441f4dc65f5bf

SHA1
3919a57831d103837e0cc158182ac10b903942c5

SHA256
55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d

SHA512
c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
25KB

MD5
42e84ebcf5470237abd1f9e322b751fe

SHA1
a828a45804554507d9e8521c36109e8bc3d5eca2

SHA256
a9fc7baee3689f0331e46617f60d6e7c3ed631209b7211e7dd09cf20d22a64c1

SHA512
36606d42aee5689819dedf221af3c6c0da06aeb9997b9ce84b42db42ab80a0926352219f1e47f2287dcc850fcc96e4eefd5e487e09e1f1228102eced11271e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
20KB

MD5
6931123c52bee278b00ee54ae99f0ead

SHA1
6907e9544cd8b24f602d0a623cfe32fe9426f81f

SHA256
c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935

SHA512
40221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
393dbea92ca1005a2892a0ac3baf3aef

SHA1
bb17ce13ba3fc66e76c0038109a2bc4b48830498

SHA256
52e493570043b29254480b04ede5c2f4086c0b833ed247960b2efd5244b34e15

SHA512
a81c160b992a932363d11c2f04d87d04b50384b1dec7b33045b8024135e5d1616aa7346388264a4b733cc29991e26114d5c361caad346925f52d18fd20cb8a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
358a331d21d1e7bbd1bef42b46e78ae1

SHA1
ef64cf31326a2a21b72417e8209b645a644488a9

SHA256
4ef68d9ad6e41f876c4711a7d3863f1b8764dab37fcf9c55c9fa7878227dd647

SHA512
b5e0d4ea541f6f7d26346d842b27248df999e3170312e949ff440523c255187cb8ba73f3b9d54ef80e3eadaef6bd88531254250848e9021cc6e97ddfc3ef6989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
70c51fd41742b6087fc6fd71778d5808

SHA1
631b71092309f8cdc489e9f32fe35a33df420e42

SHA256
42b1ef793e0e0df0bae34b4f8a106b334095e4fe1868f60e3dd224b1525259ff

SHA512
c03a498d5e9daba4b0a7d2a28f95eb136ba3416284ac25f7485c4b9bbdfab033bba37a8306a9db159e159f668fbce66d3123fea18fc0b412eaba6868e939b8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
af192945c0515f40397df3d9623df57e

SHA1
242576e1227496785bcc8464de50892a30efbd58

SHA256
b04dc0b29ed9fb8426ba2d3fd7040fcddbe4791783fffa751451adbf10ab8b81

SHA512
8a26648d29a59f5f4b625b1c0d7aba4304ba1371578d47584ae368cb51fe8fb46a404f5719a37e8b3a5eab4664af5e31b30ff8ab9bf711d5caa4cdf1ae630f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
a5c2e03d2c2b6de12b58fb5276f9bbb6

SHA1
b7f22ead3c187d73f0565fadce736494a9cea5d3

SHA256
112fda92cb4114fbe632f1648a53dd875e57a26bafb1d20b97a1575ef3106b89

SHA512
06d2b5593a56bc200fa6207d5e63226abacc74635b0a1a8e5b759fe858c578b4fa447bc3c9e41c1236f5d92c96bb5b5c02857a6039dbf6bb88ab154f0b251b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
fd91b9e9d4194e16240616387915bb3f

SHA1
6a2de5a140e4245c31e9f1ebe5fda88bb087eac5

SHA256
22b9985957fab747988542dc8a7200977cc3192931d71b467060d87dcde3be78

SHA512
3db4924c20c3574c2af0c55ca60d69aa9c7e23ad76c54f684cbf900885060fc96efc67012b62cafb743468554df2c49f334ca7b9eb434ce24cd3abf51c5f2a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
993B

MD5
061730b92ab61b0a0648df590da1d774

SHA1
14100b80a33121a434cdf4dea9096a008765d6fb

SHA256
b77e418feacf7e140954a455b1273dc15054abb1de0b81ca12eaf62ebe217a68

SHA512
7decc9afc179d3b67098dfc7377032bf5843588418318a8b35374a009179944d05d504a20623b54b94c6390b647970fa657ab7b232c2b774850ff44587300a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
eb973cd2366f1cff78c1ee9bd5f74ff9

SHA1
7e3b6c63cb50f8fb5a030f021c3e63399eab471e

SHA256
a60c62e3019911de54e79498f89324acd102c933c4a249b467c8b07a888ab195

SHA512
e27820a81f645cb8ef37c227e8a7cacceb41bf4af9743ae45ae8c15f5a2e95d54dbed8e40b9d731300fa5c35ed6b92c614384dccf7e5531dedd66b3a876ea961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5059395064c64daef445612ec3ba174c

SHA1
1ba02cf7ed35ee4aacf485289ebb92c34d1930f7

SHA256
4581444b92e38f4f7404ed437cbafcf6b2494c69eafe3012bfbe6ba87bbbb196

SHA512
edf942234ec734a5e9e16335c80f552ac4e5ebb6c3ae3ed7056837cd2bac09322f97fbc616ed96ab033f19051e23c49e7549ca45e7bd519575a72e8c7b4cbee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7fc57540c449a8061f1393c745eec179

SHA1
706ebc486699eca40ac8fd2ea9fe6e6b48473664

SHA256
98effd998f61a1d0d2d6977a6c48c302beb1e9cabbdf92931f7853a54c13744a

SHA512
5eccecba6a48b01412c9a303e75add35f914d906924c3375db2207332f3109947b07af729e340526630f4c2544057590c38f8fece6de66b622c2533d7d44b1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
205475f1d64f2eb3804f023cdad466bc

SHA1
bba669487a8dc9f3c7627ee98b99e5661a65305e

SHA256
0c8cb346af7caec423eb6c5d1de270dffe9870bf148a5c624fe6b47728020451

SHA512
a82bbb56818bb5029ff2a7b65fcae5c191654f564fd013bb428732907b1ebe4319808ad091abe1a4e877a3b7c7645469e802de58045646789d2c2f6f0049564a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e06931a6d879e6c04e4b3f963a75c616

SHA1
fae76f3b9260cccbee541b6d30fc6d8ba62015df

SHA256
6293fba46453b780ef16013b06b63a1ae69708a11adaaddd5802dbbaadd22a2c

SHA512
2573eb8aa4597c818d7cf991eda5dd632ce12c85da5a228fac103008e42557185e19b905ac116544a61e20919110cd9c194f26e0ec7790d793feea5eb4db85e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e362420807481659f1bd8e50873c508b

SHA1
11d0cb8f96ad9c9c1564f647289a6cf16a925b9f

SHA256
a94039661a221410bd218df546198003c85ae514b12d83ce62ec5914555cfb81

SHA512
72a46a36700f6e120ffbd23348393ac161fb9bcf3ce06fcb4e20a9e0812faacb6b4eecec3c1612c33aa9f256cd408df332b397f6065fa6449998d7025389f86f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59515ee136fd86adfcc976647bb5c9f2

SHA1
a222cf44331dd9551a636d70b9eb703746030e2a

SHA256
425bab126ddd85635f0fb733533b4f00d362954505f0ac289b03fe073c241346

SHA512
d4b44537077199567e382e085ab743a4f12c71029daaa23bd5ff3371e82c548eea0b35d9ccb5dd80e0186206925f02d73c0b36c3f55c6cfb7210c3775c587701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ad67e2277e1c8481faf62bffc620cdad

SHA1
2a7be17a9835d17ab3a5710af254d916f8a2f981

SHA256
e6a3bb899f126d10971bae30daba7511bd7061ff76a3d69aa60c6126711a0ffd

SHA512
bd81e631ec82de98d33ee3bdff1b945504a44144fee5dee93d2ef6c1542a7321bde7d09c316cdd7df503e69c7c5332747bbfb9506338fd4a54e2b984eb5f0f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d3530a9c3f6585f3e03550744a4ab0b2

SHA1
9d96750773d1b3697193267df1415fc6ad79127c

SHA256
9b93bfe51511e9e1eff5de1a3780a0485510c5ccdb46c82545a229b33b438173

SHA512
e3fc241d2889967c114400f0b7494b60de8e6e4b0e337eafd622e96160d2bdf7659d865b21dffa2e88a1a4672da052a98e3398c4b0ab23a23ce6bef508badbd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
cc16eb5e1192ead0b61e5a5ea52fff4a

SHA1
67d1781072916ede14104fcd636dbae0b9f30f1f

SHA256
56ed641fa439350f449dcdfdc0717f77444e937669253239779bb19128b5f409

SHA512
49b38f6ba5f783da67243456b80f805d6d7db2ad4e3ce8b2d703184480520ba76dd9bb39a600d5e1f03721014efd77ff974d7161473a22bce4f7393e7ff92432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
72dc7797b52642e610d4b1b24d87d04f

SHA1
37f08865ec0bf3edb729d8d66ead1a430ede02cc

SHA256
44f667041a64b1de920bc8a525e626b2b701fb95413676d56abc21da3ab52c30

SHA512
9858616ef567a18c57980d239504d76b8bab7bdc34ba13e07cfd998b0311c4b5b394eeb4b97c62e04c6fd180fc7eac88e2b0d303b1d7f8d2110dd4ae073e4974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e242fde5cf9fed9e122a72447a50b96c

SHA1
a2cfec25c94aaed459bde9face08a88b7b542d05

SHA256
0a83fe364ca73279c49ed7d126b07312cbe8ae2d0d8828ae58b6f382eaf18ef2

SHA512
bb92a9a7bb396814a3f0dcaa743d73260a938d16f0c91806f01ef84a3e866f16c80b90954cb4ff545be3ff964b2bae957ec6729dd5773cdb33adfab26c003c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
230a8aa663763c98327d50eca24af41a

SHA1
56b0c6fdbccd54647b99114b271383e1b747cd89

SHA256
815cce0d775c224c858d86e95090ffa9f102ef3e5a48c85e7918bfc9c7411d70

SHA512
653d444df14d1bd0631e726a052ad6e26e34733cf53a0df8973df4765adebe6d1e857d6bdf1fbdb3a72e2a9c23167ebb35521e6f9cfeb1a8fec537a8d3564bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
10c1ff8483239a4af123ddeebce379c2

SHA1
692b0c95faf285fa4ebe6566d18ff470923450f0

SHA256
eb5dd2537f4b4514c00016a560707dd90a65eb93cf66fa777752eec0989b188d

SHA512
b9379a8cef02e08f596d3b4fbf749fd3a7b87c903756feac8c4677b0909357fade392ad1a04c0dd6bf47ef94d0f655232218be1186268c4bc4ac4b01ab35ae61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
952ef984c87ae8df02f48940b56018c4

SHA1
4e3ccf6c43e2611bbad67b5fdda27875e38f3932

SHA256
1807d2a1474e826c3443c5bdfcd662c2383d7536e2a17aab12a28d14d5b9e68e

SHA512
8bbc2846f5b4a21835cff53fdb51f466837e8c997b9e16e902efaf6466dcb89a1beb037efde6127af923c5cd53e74aedf77e2d2bc145b9e6f32cf620a6d514b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a0e596b0d5a9f634bde765af7635f836

SHA1
e259b22ec986a989b9bdd807e71fcd1120806d8d

SHA256
77285e668e21ec7f30b00770f66b8c93c2e221a1fdeb2db3dd86110f3495dfd1

SHA512
1677867f76d9acb0a87757d1a9b5315916d9d942fd76165be5d2d6952be9dc76593db937ca2a0bdd8f07f2c9494d4e0f0836db35ed1fe8bda93d42d9c130cd36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b1fc7c39c680826ffc086ef5ee9e5cfc

SHA1
3cc4bcc30b6ec0e23b23674cb3ad6c5287343d0f

SHA256
ac1b6e85a1346b75e2489df007cdd7762541e4e89cd6d7394b3a84d5f228e0d7

SHA512
680d84e3802242a3247e5e95369ac9f3bd67a6624fc3ae41d2e55467bfdc6abd88c4b4f6e3dd781ed4be8a5133cf0c78e4568e1b5ac10f5d196ed4d82bfb316a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5822d5.TMP

Filesize
203B

MD5
11f1b35fcf89a866ad022d0dd622ebd1

SHA1
36f282943bf91f123232f47d65788dd7a3add86e

SHA256
84404fac02344e68a610d4cb27354fba517703757a798c533ade229d08b35815

SHA512
135b88df026c6f2d1d7bba291d7d36aae42c57971452daac6c95206ed80a92fce93719c81ff53b39a5ca98220975e0e27e1d59bfc755afd90d332990c8b9a504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ba89fb307a7a9d80c50990694738f275

SHA1
e42f7e363e98e722c6649980676aa6619f275468

SHA256
3371a46a71ec5ab1ea20406b5b131c980d50a03afe8ee2a0a0c84503b55cfa07

SHA512
205b3f21011373c47ea05f6fef113594efd96b271840ac014b720f300754cc762bed6fa390255d47a8a1dcbf5b105ae5a55a361e13b2aa6c59dc9da8984615a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9642daf7329d2cf41c6972d7444c7905

SHA1
32043a4fccaf8cff1f84012798ca5670053745a9

SHA256
a6a89f1db30abcabfab33aae389f09feb3a34cb8cebf9e11221b356b4650e780

SHA512
4730cbfc9b8d31f8431c1601f59900b72db1bec5fb9a9ff64d9704634335cb9e2bec8846e4aee7e723e7d6e80b08f06a9e5a9a1a138dd86c12af04876de39994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f6bb1ae68cef9946738c81262ef3be7

SHA1
9e1854d787807beff9c493e0f28615f8eaf1c783

SHA256
71a0553906dd3ee7e7a15d552cefa5cba07cf2e7d289c8f3389b38182bc57f19

SHA512
b1a1b1aa30eddf049536c39646bb178026188bd3c7290bcdb6f81e41af91cce65d7b80e4d660902aea01acdcf0ed12de7e5d10023882c532c141c2d851aa9e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2594929e15fa28b22ff6065a0bda77a5

SHA1
08db61778e629b955182571718db468f183737af

SHA256
6a2a1dc362dcf31ac0cae310f8d8c34b47dbee66486ef70e902de71a27ba6528

SHA512
d1ea4fa72ed8188ef03c09f0b1a294e5a0b6fe0f6f0cfa730c718310e90fc4eabeab166a5b2c0aea52858eb4c3c9db7cd858467f7d7b6c491f8f07b22691f62f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f6760f1926072428d24bbeb3e6cbedad

SHA1
c05ebcf57c2be32cda4e58e34ea251c72c70dbbc

SHA256
2a3e518aff23531cb460cbf1c54d1133806a1ff0a1c15b4410ef11ced798eccf

SHA512
f8fa412e55509739c40d5daeef5f5ce540cbfc92ca5f0d837493e57fc4a3d404d4eb67cca97e7c0bf8ab6071a8b7cbd45c96d122b3c49c5eb8e0b1cea14e0ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7b2631c6931cf5e343e6233774d0efa4

SHA1
0e24ae855b4bc4e233f19ca3c6d1b165f892880e

SHA256
10e7ac2ea0b3aac9db913ecf611b5b08af64cb361d09c2200d2f08b48cf97635

SHA512
22d72fa33d4bf4fb26138048119c3026e7d2d16109c1eaa294a541ca3e2a8bbb9fc725e3f2c35800f0f6cac146d40d345e55183038932692a04beda7e03f706a

Download Submit
C:\Users\Admin\AppData\Local\Temp\npp.8.6.9.Installer.x64.exe

Filesize
6.2MB

MD5
594119e87364a0668899bbfc0df56b87

SHA1
2c16b2048953244dade00f6b7fd58a5f4c03fcaa

SHA256
3fd473e00fa464f18af2dd930cf5bdba0709fdd841631598acccdb04c32a5cd2

SHA512
a74f4c1997b69d88ae40f954bfb2c6599a9f19b5e9fe79c5f263084b1d51a497a8e16fe260664dd08439b7669bf3080b53c211770fc8eb5fc36343a82600375e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\UserInfo.dll

Filesize
4KB

MD5
d458b8251443536e4a334147e0170e95

SHA1
ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3

SHA256
4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7

SHA512
6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\ioSpecial.ini

Filesize
1KB

MD5
9f298b8ac34bcc589d843598f4222795

SHA1
1c73576e040c1cca1d5c378b9299ff733ba01c4e

SHA256
bde2ae292a75fc1a2b4017df2dd89702454cd55acbe541b38c435b57af6277b1

SHA512
cdd49b0dc41fbe793118094fa0f0d694a02ddd69dbde5c178296e46ed79570595188728d0389eaf3b9341ea43662b759bef3239660e017d114a90aff98bae596

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\ioSpecial.ini

Filesize
1KB

MD5
5f125d2698eba6ee9bbe39d8d6652946

SHA1
3a9e18f0daf637e3f63b5226a59c0363f878b7f6

SHA256
f3a830d8de7ca48a76d08c84662130e9707209d4328a562c03f1b82635535275

SHA512
3c83467d5f89c67616c779c61d30033917b43f00f6ff546aacf1ef87e89bf41321707da448ce66ae000e4d61ee1661db46196d44040635befe2186960431757f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\ioSpecial.ini

Filesize
1KB

MD5
ab42e333e5b42cfc823ac51a811105cb

SHA1
d10be988e1b77ebbf0559c4753f7e4ddc07769ed

SHA256
cd8f22ecefa3738152c3a71458cb81ce601bef9255617ef444055eae72f1b8e8

SHA512
cc98b540bda597df5311c10dde056f60ca02353d3dde1b17090879cfc0bc962ab9c42493140037d03f270be49dd374ca2afbaeb67d7c0a118937221efd890dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssABDE.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\backup\new 1@2024-08-06_072647

Filesize
18KB

MD5
8ec29dc13442b7cc5afb8f17b8393b45

SHA1
5144d62e93e0af3db4ee5be04d6d159d895c9777

SHA256
26371b1289709235857e1195fefdcb3af7c3f9fdd364765fe3b61c9b0626629f

SHA512
5cc0356a0dbb81d3ce1563e768d00d8efda986db14fb8b60785faa801f6903e400bf20abab620a0350677bccd67a0ac174e94e36bf4e05f1e1df48fa44ba89cb

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\backup\new 1@2024-08-06_072647

Filesize
18KB

MD5
fad6a6c0ac5f159d6ece841eb04fd99c

SHA1
5f1a033674afff5b60b84ad2d888e17905dfc723

SHA256
c3d29273d5d813fb2fea35f4c07570f3bbf7f955040fe892712764d451b50c25

SHA512
83abde5f596fde460fd2001b609a41121b79fcdb4c916430133baa689bcb9f6853d74190d0f25db21f2a9df73a3bfad956d58c6dfdbbc56ea4b40f427f6a4235

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\backup\new 1@2024-08-06_072647

Filesize
18KB

MD5
c165d0880e306ba59236dec90f98af48

SHA1
053b071defc3147244f5c327914793125ac36e9c

SHA256
c73eee643ed0b4aa06efdfb08ae6be64af1bb97f2dc5c3a2b6f0cdcf6ffb7a04

SHA512
f28e845878ec7d661540096a1f5096768143c660472a6f077491d01d50949936cd04d18ab21216511488af9c1edb74d710afb2b03952fdb9be7bc470ba1bfc79

Download Submit
C:\Users\Admin\AppData\Roaming\Notepad++\plugins\config\converter.ini

Filesize
646B

MD5
f07150054a6afff4d8e9d58899167722

SHA1
e092cd960ab728667d91b37d64a02d7f6821518b

SHA256
5b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0

SHA512
8c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 75249.crdownload

Filesize
4.6MB

MD5
d401161afb56b8647202e031cec1ae78

SHA1
6eb7ed61ccdb0bd5018271a3ec24b63b913fc281

SHA256
81470eb5917705fa0df03181b8112422671842bdcec5252a7894975b38058c91

SHA512
01df1134b9f4d6bb44a8f23a9ba8191dbfb20ed1eb5f249331000955f6b340b1e3e3a6c0e237456a39a712f77d90fe85fc4b946832c88fe4617e45daea9c966b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 990692.crdownload

Filesize
1.5MB

MD5
f1320bd826092e99fcec85cc96a29791

SHA1
c0fa3b83cf9f9ec5e584fbca4a0afa9a9faa13ed

SHA256
ad12cec3a3957ff73a689e0d65a05b6328c80fd76336a1b1a6285335f8dab1ba

SHA512
c6ba7770de0302dd90b04393a47dd7d80a0de26fab0bc11e147bf356e3e54ec69ba78e3df05f4f8718ba08ccaefbd6ea0409857973af3b6b57d271762685823a

Download Submit
memory/740-2720-0x0000000010000000-0x00000000101F8000-memory.dmp

Filesize
2.0MB

Download
memory/740-2716-0x0000000011000000-0x0000000011369000-memory.dmp

Filesize
3.4MB

Download
memory/740-2717-0x0000000010000000-0x00000000101F8000-memory.dmp

Filesize
2.0MB

Download
memory/1224-2726-0x0000000076E00000-0x0000000077015000-memory.dmp

Filesize
2.1MB

Download
memory/1224-2724-0x00007FFA33290000-0x00007FFA33485000-memory.dmp

Filesize
2.0MB

Download
memory/1224-2723-0x00000000032B0000-0x00000000036B0000-memory.dmp

Filesize
4.0MB

Download
memory/1224-2721-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2232-2515-0x0000000003220000-0x0000000003620000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2516-0x0000000003220000-0x0000000003620000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2513-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2232-2510-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2232-2517-0x00007FFA33290000-0x00007FFA33485000-memory.dmp

Filesize
2.0MB

Download
memory/2232-2519-0x0000000076E00000-0x0000000077015000-memory.dmp

Filesize
2.1MB

Download
memory/2784-2523-0x00007FFA33290000-0x00007FFA33485000-memory.dmp

Filesize
2.0MB

Download
memory/2784-2520-0x0000000000890000-0x0000000000899000-memory.dmp

Filesize
36KB

Download
memory/2784-2525-0x0000000076E00000-0x0000000077015000-memory.dmp

Filesize
2.1MB

Download
memory/2784-2522-0x0000000002580000-0x0000000002980000-memory.dmp

Filesize
4.0MB

Download
memory/4964-2729-0x00000000028B0000-0x0000000002CB0000-memory.dmp

Filesize
4.0MB

Download
memory/4964-2730-0x00007FFA33290000-0x00007FFA33485000-memory.dmp

Filesize
2.0MB

Download
memory/4964-2732-0x0000000076E00000-0x0000000077015000-memory.dmp

Filesize
2.1MB

Download
memory/5168-2514-0x0000000011000000-0x0000000011369000-memory.dmp

Filesize
3.4MB

Download
memory/5168-2508-0x0000000011000000-0x0000000011369000-memory.dmp

Filesize
3.4MB

Download
memory/5168-2512-0x0000000010000000-0x00000000101F8000-memory.dmp

Filesize
2.0MB

Download
memory/5168-2509-0x0000000010000000-0x00000000101F8000-memory.dmp

Filesize
2.0MB

Download