247b94297f36837a905c4f628ffeb219dece7bd442446e4a2a44c9a88ed4f546

Analysis

max time kernel
251s
max time network
259s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-11-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Carro.png
Size

1.5MB
MD5

24cbd383fccf8ee8764c297d94b5078c
SHA1

dc61f5653b098250133b9a281b4630abf226bdb2
SHA256

247b94297f36837a905c4f628ffeb219dece7bd442446e4a2a44c9a88ed4f546
SHA512

be6c9ec813de9cfd0557d9a959759cbba4c2f659cec2498f2a2ec370319018dd522554b677b75ebecf035a7be1e0d559d68c0de50f5a36d28cf4df42644feebe
SSDEEP

24576:UIBQqhcDu3C0HzsfQc7AQW2zz5Ru7QeTeLC3DAQs+72c0EMZ1CA2ZBkUNWemPJbz:Thc65zsfH+WbuUyeLWDAF+75i2AeRWeq

Score

8^/10

discovery motw persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	Rockstar-Games-Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	vc_redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Executes dropped EXE 7 IoCs

pid	Process
6028	Rockstar-Games-Launcher.exe
1056	vc_redist.x86.exe
6052	vc_redist.x86.exe
1732	VC_redist.x86.exe
7076	vc_redist.x64.exe
5856	vc_redist.x64.exe
1460	VC_redist.x64.exe

Loads dropped DLL 3 IoCs

pid	Process
6052	vc_redist.x86.exe
1048	VC_redist.x86.exe
5856	vc_redist.x64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{410c0ee1-00bb-41b6-9772-e12c2828b02f} = "\"C:\\ProgramData\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
359	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe

Drops file in Program Files directory 56 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0daa9d77-d73e-45ba-8bba-d73ffee1c0c5.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241121214043.pma	setup.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-datetime-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-string-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-time-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-heap-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-synch-l1-2-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-sysinfo-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-timezone-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-environment-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-runtime-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\Launcher.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\Launcher.rpf	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-string-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\ThirdParty\Steam\steam_api64.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\ThirdParty\Epic\EOSSDK-Win64-Shipping.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-math-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\ucrtbase.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-namedpipe-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-filesystem-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\libovr.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\uninstall.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-multibyte-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-handle-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-localization-l1-2-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processthreads-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processthreads-l1-1-1.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-rtlsupport-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-convert-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-locale-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\offline.pak	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\ThirdParty\Epic\EOSSDK-Win64-Shipping-1.14.2.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l1-2-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-util-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-synch-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-conio-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-errorhandling-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-profile-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-heap-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-utility-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-interlocked-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-libraryloader-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-stdio-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-console-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-debug-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-process-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\RockstarService.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\RockstarSteamHelper.exe	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processenvironment-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-private-l1-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l2-1-0.dll	Rockstar-Games-Launcher.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-memory-l1-1-0.dll	Rockstar-Games-Launcher.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5b4c02.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7531.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5457.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b4bec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4bec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B3E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b4c01.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4c15.msi	msiexec.exe
File created	C:\Windows\Installer\e5b4bda.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4bda.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5b4beb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4c02.msi	msiexec.exe
File created	C:\Windows\Installer\e5b4c15.msi	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FA3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{73F77E4E-5A17-46E5-A5FC-8A061047725F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b4c14.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000719b916909da5b040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000719b91690000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900719b9169000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d719b9169000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000719b916900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766988258623354"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\E4E77F3771A55E645ACFA860017427F5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\PackageCode = "73C8C8E4844B0BB4A8B86F043B32F917"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4E77F3771A55E645ACFA860017427F5\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}v14.36.32532\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-870806430-2618236806-3023919190-1000\{46F8E83F-F852-4A22-BA67-0F121F64F2FE}	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}v14.36.32532\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4E77F3771A55E645ACFA860017427F5\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BAC95C2C6678DBA48AFE11153AC6145E\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\ = "{410c0ee1-00bb-41b6-9772-e12c2828b02f}"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{73F77E4E-5A17-46E5-A5FC-8A061047725F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\PackageCode = "66BA6B50A49EFFA418122BDB80C144B2"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{410c0ee1-00bb-41b6-9772-e12c2828b02f}	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{73F77E4E-5A17-46E5-A5FC-8A061047725F}v14.36.32532\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BAC95C2C6678DBA48AFE11153AC6145E\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 548435.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2632	mspaint.exe
2632	mspaint.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
3336	msedge.exe
3336	msedge.exe
4524	msedge.exe
4524	msedge.exe
2320	identity_helper.exe
2320	identity_helper.exe
6652	msedge.exe
6652	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
652	msedge.exe
652	msedge.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
6028	Rockstar-Games-Launcher.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe
700	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeShutdownPrivilege	2240	chrome.exe
Token: SeCreatePagefilePrivilege	2240	chrome.exe
Token: SeBackupPrivilege	1500	vssvc.exe
Token: SeRestorePrivilege	1500	vssvc.exe
Token: SeAuditPrivilege	1500	vssvc.exe
Token: SeShutdownPrivilege	1732	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	1732	VC_redist.x86.exe
Token: SeSecurityPrivilege	700	msiexec.exe
Token: SeCreateTokenPrivilege	1732	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	1732	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	1732	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	1732	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	1732	VC_redist.x86.exe
Token: SeTcbPrivilege	1732	VC_redist.x86.exe
Token: SeSecurityPrivilege	1732	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	1732	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	1732	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	1732	VC_redist.x86.exe
Token: SeSystemtimePrivilege	1732	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	1732	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	1732	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	1732	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	1732	VC_redist.x86.exe
Token: SeBackupPrivilege	1732	VC_redist.x86.exe
Token: SeRestorePrivilege	1732	VC_redist.x86.exe
Token: SeShutdownPrivilege	1732	VC_redist.x86.exe
Token: SeDebugPrivilege	1732	VC_redist.x86.exe
Token: SeAuditPrivilege	1732	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	1732	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	1732	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	1732	VC_redist.x86.exe
Token: SeUndockPrivilege	1732	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	1732	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	1732	VC_redist.x86.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2632	mspaint.exe
2632	mspaint.exe
2632	mspaint.exe
2632	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2632	1672	cmd.exe	83
PID 1672 wrote to memory of 2632	1672	cmd.exe	83
PID 2240 wrote to memory of 2404	2240	chrome.exe	95
PID 2240 wrote to memory of 2404	2240	chrome.exe	95
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 4844	2240	chrome.exe	96
PID 2240 wrote to memory of 3876	2240	chrome.exe	97
PID 2240 wrote to memory of 3876	2240	chrome.exe	97
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98
PID 2240 wrote to memory of 4120	2240	chrome.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Carro.png
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Carro.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8ded5cc40,0x7ff8ded5cc4c,0x7ff8ded5cc58
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4868,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5060,i,6725230507000200472,17277453543059499806,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4500

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InitializeEnable.mht
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff8dea246f8,0x7ff8dea24708,0x7ff8dea24718
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff68e885460,0x7ff68e885470,0x7ff68e885480
    3⤵
    PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9136 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:6944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9336 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9132 /prefetch:1
  2⤵
  PID:6356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8616 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9136 /prefetch:1
  2⤵
  PID:6412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8900 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8816 /prefetch:1
  2⤵
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9160 /prefetch:1
  2⤵
  PID:6308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9360 /prefetch:1
  2⤵
  PID:6380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1
  2⤵
  PID:6392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=9080 /prefetch:8
  2⤵
  PID:7128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7932 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9684 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9840 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9852 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10148 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9872 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10836 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9884 /prefetch:1
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10892 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10984 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8372 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8816 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9512 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=10652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Users\Admin\Downloads\Rockstar-Games-Launcher.exe
  "C:\Users\Admin\Downloads\Rockstar-Games-Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- - C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe
    "C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" /install /norestart /quiet
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\Windows\Temp\{48176080-E0A0-459B-B488-81F2C01155ED}\.cr\vc_redist.x86.exe
      "C:\Windows\Temp\{48176080-E0A0-459B-B488-81F2C01155ED}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732 /install /norestart /quiet
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6052
    - - C:\Windows\Temp\{74E07D79-DA4D-4BED-85DE-A86386965253}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{74E07D79-DA4D-4BED-85DE-A86386965253}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B4BDE7F3-0AC2-4787-8E47-CED23505DF41} {4B2DB53F-DB1F-406F-A910-623ED1784EBE} 6052
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1080 -burn.embedded BurnPipe.{08453D06-FD73-4A5D-A6FC-58EA80AB8899} {FDA97006-2DD0-4016-AAE5-BD04F891D687} 1732
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:652
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1080 -burn.embedded BurnPipe.{08453D06-FD73-4A5D-A6FC-58EA80AB8899} {FDA97006-2DD0-4016-AAE5-BD04F891D687} 1732
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D29DDD2C-56F1-481D-AD6B-069DBE9EA3D1} {47DB7756-C962-47F9-9936-141B19B31352} 1048
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5288
- - C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe
    "C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" /install /norestart /quiet
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7076
  - - C:\Windows\Temp\{76D45862-EF88-44DC-B498-00D436DC364D}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{76D45862-EF88-44DC-B498-00D436DC364D}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=716 /install /norestart /quiet
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5856
    - - C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5F9B111E-408C-4ED5-A252-C1E4F20109CB} {D9BB5AD8-65DC-4E10-8E96-FA50EBE9579A} 5856
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1460
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{4E9C36FF-FE7F-4E5B-8BDF-9359AA30B143} {5962EC3D-3A1B-44D3-A4C5-64E6B830A017} 1460
        6⤵
        
        PID:5448
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{4E9C36FF-FE7F-4E5B-8BDF-9359AA30B143} {5962EC3D-3A1B-44D3-A4C5-64E6B830A017} 1460
        7⤵
        
        PID:3252
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{26F0C773-4AFF-4598-96A8-52C68EF5B7F1} {D48BAD1E-DC51-4B90-AD79-37AFF6B68B0F} 3252
        8⤵
        
        PID:4288
- - C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
    "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop
    3⤵
    PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5078921258146724406,13545151177823282745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10384 /prefetch:1
  2⤵
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
1⤵
PID:5756

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b4bdf.rbs

Filesize
16KB

MD5
9c154bc20599d3d14c01b907678d4bf2

SHA1
d937da153680ed24a58a7a7fcb5b93c93f400e42

SHA256
b4775c7cf40c8a67bcd6b44e7a2b6194939e7127055dad6ff393d3868f2b00a9

SHA512
2096fc11f8a0efee79b0201fccda48d7a6614c32f975faead44caeba063cc5ce72e9b2f7837527e16da64d6c3ef6260d69ce9cc672c3811efbd512427bd7ad91

Download Submit
C:\Config.Msi\e5b4be5.rbs

Filesize
18KB

MD5
4d875b314d4e55cf4434c24eae973a76

SHA1
016bed8be4179c9afa84a3b0ae49d2ffd4def6a7

SHA256
72ca453a944ab8af28204f9ff9784f7511d26001f59ed90df9bc12c5bafa70c8

SHA512
a35bf72a325d9ebf3ed2cb28a6349704b0c646e112ae63acd9c01a5f01c4201cd036c8dcd9c0f313f12fa6d3902fa4128c367a71c94fa78a55d246d3ece8052d

Download Submit
C:\Config.Msi\e5b4bf1.rbs

Filesize
20KB

MD5
a061c13a326282bc21016927e8e27c96

SHA1
bcf0c58212b618a60d9c075bab1ad7ed56b2058f

SHA256
fcafa4049e05b52012da8b5cf96bbdaf215706578878c2d9708f99b69e21618e

SHA512
4718d5121911f2a2b2d3163a859fa8dbd58b553560ef2a2cd08c9b6a42d381ddf1478b023cc306598b3bd7df606b7d6762b73b19493d798da028ac1c647fd63a

Download Submit
C:\Config.Msi\e5b4c00.rbs

Filesize
19KB

MD5
bfdc58f02f6910bf90ce6ddfe64f3360

SHA1
8970860a9e95edce9ead6189a9d8c682166e0c67

SHA256
dba892202e958133d5984a0df636d61e45545fdc36eb8ce70b76a29971275740

SHA512
6db620fccd6d082c10c1577c4182d03db1f1c596be856fd83f9d0b229371ebaf8678cf020b3456b5b32fc1c4cd08c47eafb9a688d49371afadc42e452dd6b0c6

Download Submit
C:\Config.Msi\e5b4c07.rbs

Filesize
19KB

MD5
bac4ce9643d01588c677b792935706b7

SHA1
5273e4ea1b23ecb529a547e8d861709e928a8bc0

SHA256
5dde17ce4994f043bb50fabb7767e169aba79477b444d04ce08758b221a0c42c

SHA512
b077a688872f9c68f94e512a3f28ba35a6d8342a6fdb9971c8a22c338f95be334ec8ab93ad8990117221bd93219e4d5b030c0da3b16872b5b38707d83779beb6

Download Submit
C:\Config.Msi\e5b4c13.rbs

Filesize
19KB

MD5
76b7fb54aac74d16346b2227e2aa1798

SHA1
0fd78cedf045f4f63cf2e1fa275ea8b5a587a09f

SHA256
0451e55d0ee91966a40d57c34f7c1f865cceb1f88587799367ab53930bafe00c

SHA512
5cfd2d65d62c741c58d89c84611566fd99eb867c6a1f1de83941fe1793e3b66c82d782504064260fa0d587f4d50af6bc7bab3a9a20d4daf9460b2abcffc6631c

Download Submit
C:\Config.Msi\e5b4c1a.rbs

Filesize
21KB

MD5
58bb3c6cc4034859447ff132c46399fd

SHA1
1756e88dec195a439b4a94547d83f7a137db8760

SHA256
e991d8a10f93ee6d547cb3a800307ab3b78e829d56db72ada810c99ebedd218c

SHA512
16bc8cbabf1d230c1fa7cd0b591f9e01c8a4d553b6a78f8b86623c9ccdbf0bf9c30e6c5d606eb4577ced7e184cf70b7062c1ab6c1d6ac94f9f339b2d2f1e2781

Download Submit
C:\Config.Msi\e5b4c29.rbs

Filesize
21KB

MD5
09bd6b64f9105c496ac4bd83be0cf6b6

SHA1
9b4fb8e18a0b59d0f66ec5e8a01b1e28f524101c

SHA256
69b18517288a7831bad682bb685bb68190372204d57f2d40c537e845dc4e022f

SHA512
fa1a5ae746a152fed2eccf14012a5112b7ba950ca39d0d2f67761d8bba3f0bef99254c8592a7895e89efd2cdd70f94867e3d5b4904de10e02ba4620ea411a4a4

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe

Filesize
13.2MB

MD5
ae427c1329c3b211a6d09f8d9506eb74

SHA1
c9b5b7969e499a4fd9e580ef4187322778e1936a

SHA256
5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490

SHA512
ec70786704ead0494fab8f7a9f46554feaca45c79b831c5963ecc20243fa0f31053b6e0ceb450f86c16e67e739c4be53ad202c2397c8541365b7252904169b41

Download Submit
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe

Filesize
4.6MB

MD5
714024360fe27863d16841ca3c78a71c

SHA1
b97c3f87c688e7a22dce08ce7215e1763109447d

SHA256
3dbca04a6258a09519e6919dfb03452a6939c50eb205b903a3b7e24a85bfb183

SHA512
0d0cb6bbd082118f28ee34a06fda1b2d1c29bb51738ca454dacf296863a7fc01643676103ecacbc0694ceb444ca1c3702c223ca5b468f6871b19ddae48c60fcd

Download Submit
C:\ProgramData\Rockstar Games\Launcher\installer_log.txt

Filesize
7KB

MD5
5abe4e5bb21ec7768425d99a9a192962

SHA1
5795601d3f5d069f913b892fedfdaafb5272d050

SHA256
7f6370bf404ffc94f3057b8256f23fd4c405e2ef16a9ae4746601f821bc9a087

SHA512
3cd33aa24ffc803fbc4363b35aec24c2cee67d17246c4f738d83dc084d352a5db1b106e9ee1f297e595cc4d098818a971991b37d3e3237d95313e08af5cffd83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4a8cd3a6a2b1db2157cd6205ebdc3854

SHA1
d3a316bf8f3a36643c02607406b5a142ac8e06f4

SHA256
2918c6925612eaab734415a6ecddc30dad4d3c233189dbef90c3e15b6e2f47ab

SHA512
4e6300689cb209e9b668ff5b7ecea50d7ddbe5fc138e33075457b6b4ba5ebd6df408372225cc901f83c6cbecfb86778c38815e82beb485cfeb23b6a0a89174f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
de464c8c073d791d679621c71fd1b3da

SHA1
ff2c95e592011ed71d30949ea2697a747953cef6

SHA256
6ae9b2362f5acd2014cc396ab6fb644bd414eb8cdfa42531c94a31c9d2961cba

SHA512
491faac7f990da0f531c8782961b4335287610eccd3ca9522d3da39afc8561d3319e5f55b0d902b98658ada6552d000a163171aecc13e40d8084373f929cf1ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
176d747c1730ca118b5e3bddc607eea7

SHA1
a8b6ac3b6735694ab35a88ce446eeb390574e55d

SHA256
f688562637363aecaf0a4e1c0c08468c862c944321c601f4963d8d91915e9ae9

SHA512
72fd8cfb65bb31ca01e357ee4ad3d3a5b0e4eecec869783d38488ce6b91892b9383d74368530163de93d16c8669793da0ae25e2fa3032a43ae53a143593f0373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5d98679e403344403e290799c36c3d3b

SHA1
29f6570f95fb23d6f047abce132453e9ac344a07

SHA256
e91e463ff1288b0b3b7ffaff375757c6baa0d12e988477c5d41a09e19a689404

SHA512
b864894bfd4811ed6d84604dc2054061e54791a582c757ead9b76e425d46c95f6457d21841333fd34ec749d60e5f9605b9ea512989a20815806ea5f9fa73fc75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3e36e79b5cb32ac7ab16896c9f36b7ff

SHA1
0fc635ff003ee894bd2fa1d6aa407b94d84f3549

SHA256
de1a448d73f77beeb00ba298800adff4ba5b0007d4e09e5896ccfe40e71b7df4

SHA512
709ec36cd4d789192e34a7a75603115a354d243bdda23c595e44c92cf23e33e07f836c905b18271a3bfc3b1495c8782ebf4d4278f7ef8bb0f78390ab507c9d80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c08a7981f338406d1476c1bc128198df

SHA1
e9bc69608e6eff25caca10bf34e3363134c7d27e

SHA256
1b6ff108522a92bccfb59751085c57bb16c6b7bade7fe06a3085072eed1b4759

SHA512
29d668483b90ee95601061c0c4d3f2632e8278ee0b86084327cbf4b87fa9c297c3209b5b70b52cf710f3d9c07f5acd938ca771463f591e8f5087076cd322c032

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
78260388eb123fbb84a3207f595ef85a

SHA1
ed8db3ec93d80930495b34e82c5a886f9ebc784f

SHA256
8707617dc3e035c5153b8ba4d08aa08a1e6f90c83ca6b96878866d3e4e98f487

SHA512
f3879fd2118b33dde600623da97d4eb3c175672cb6206009b68da7aed29f6b333d81a6e2071439201183aededaca26bfe76010556e4c461e3d2a939c10bbfd01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
130595abee2c045f9d3d35862d79a466

SHA1
4284c3644e4ef86c99b3f6e08308d79a11face57

SHA256
df8d54a05c07fd8d5a58c2d8bbddc9a85360300f8363067ab52e3c9293d8ed22

SHA512
5b56ab18f14120f5b134b7545a4c24f823a839ea15af897b02f5468b1b4c8262513e68a0c1e61be3c879c4d4c2913512a289693d507abd96e3d6721033086ec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
22123853c523651b49cd2deff84bfaaf

SHA1
b343c3c780699f3a22d1b79d6ef33725827c14f8

SHA256
3c74ac81d7994fa3e055d37e44636e9f8ee2e4d4279c106139952e774c870d80

SHA512
2ee0c0b25ac02972755b4fd0ed8e037ae52998e08a08730386bb6993086978ff7153afcebde9963a7f4c4502edd14f0f2f1ce780209aa27a5dc7db30c93bc4b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0f09e1f1a17ea290d00ebb4d78791730

SHA1
5a2e0a3a1d0611cba8c10c1c35ada221c65df720

SHA256
9f4c5a43f0998edeee742671e199555ae77c5bf7e0d4e0eb5f37a93a3122e167

SHA512
3a2a6c612efc21792e519374c989abec467c02e3f4deb2996c840fe14e5b50d997b446ff8311bf1819fbd0be20a3f9843ce7c9a0151a6712003201853638f09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63716c70d402b580d244ae24bf099add

SHA1
98a3babcd3a2ba832fe3acb311cd30a029606835

SHA256
464f0f2ca24510abc5b8d6ca8240336c2ed1ddf5018fbadb092e18b5bf209233

SHA512
dfe1a5831df6fa962b2be0a099afba87b1d7f78ce007d5a5f5d1c132104fdb0d4820220eb93267e0511bc61b77502f185f924022a5066f92137a7bb895249db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b82dda3-a821-4363-b19b-342dc7a5761c.tmp

Filesize
5KB

MD5
f55f14ea939a7799888bba4198c00896

SHA1
e0090fe116113691935b5cc8bba901e271bca4bc

SHA256
25697aaf4bc144f9a6a9e886a199cd9cb56c945844a146a38cd43fcd9b2792f1

SHA512
06820a3f61662a49040148211ad0109a4a9780016215c69aba8f717d1cf6246175ae828d77deacff3214ec80344942c3de91ba3d01758f4a50cab639feef16be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
17KB

MD5
9f2385157e4637a0426a9bf25312627a

SHA1
395b7c1428ee59ebd152d6917494ae39edc460ad

SHA256
6b20ede33b01a5b351c42913c5478fd87bda02c26c07782ba22a1112e16b896b

SHA512
e220fc5181801c0f02bfae8784057f0800ff31ff05e1233bea9d6f95f94b501c2f1215e38590bec76ba00d3ddee29ef41158d60d3bca0613dcc73ea7b58c5e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
19KB

MD5
43e938feba1c5d3f13b480e5939831aa

SHA1
41300f992edc0cbcb20669b33253290f9e969aec

SHA256
998e2a9c21058b6d6bf46bc02e77d9261d8c57de10a039d38ea58c9fa00494f3

SHA512
c2760b3b53e783e038749523fe8c2454a50016a74d46856bd2f0fda03051d7668c7b03b58d5d566591eb0433fb5efd1486a32e3b6c19749c84443d80edec5f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
21KB

MD5
54d77a2debc571d6efc2b3fca74e0cc7

SHA1
ff9fbbac96b8d9f5b7ca86c2916a704f387b64e6

SHA256
96c7756f93cdf5cbe01a7eaed2760923420fddbefa81708dfc5c77b55a673f5f

SHA512
966d9fe1f4c58bdcd3af4de8f1a706c53b9b1daef46c9fe5d755ca7567634ee3ea8747892edf69131c50a00068978810a0bd2d8d560617d9b14e693b77bf8e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
103KB

MD5
c12602b8ebdfd5ea5113f42ee978d526

SHA1
1159db5c354e5c9a73b2e072b3c0c5d02f3ff07b

SHA256
412aad14e7b55e51c4c56a88949c8f5ac81e06bd1d9b23da4378b1d9711a0794

SHA512
00ba76a1f0f08c969a96f4418c158d482eba611fa5984cec234ded9c7a1aa2e9e4dc2a69816c2940783289767212ac729cb7b3ae4cd002f772a5dc5d45bce3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
94KB

MD5
71a27c415765f014a481aa1e97e81db1

SHA1
37bdf7cb417a7a418577ed0b067dffeeca1b0d6b

SHA256
315ff3b118fedae70d5dcfbe66e10d711d7e0e55ac3696b84b1a2928805cd491

SHA512
0109b4f2160ada425a5c6b232abd6a5b9253640eb574fe97bed95abb031a9aa00003503be9a8c9390924754c8b5fdb49de299fac052f8d34d365c1baf268c579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
141KB

MD5
d26e5e6bb1ea72ec522ef01d39f60935

SHA1
5f74f3d11142b9070df8708cfb825f9fd1d9f783

SHA256
e7cfd15416a792e98a5fed94e07f0fe500fefdeb3418908d0c99ee8b4fbc7ee8

SHA512
4c44417be4b9ede24bd4b934abcb3f7d31aa8d0caa722efae901dfa6ded464d3354f62c656b41fac3668e35511c2dad14ddbd7c06bad6f48f07636c0d977f630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
32KB

MD5
d8dd87dbd9cdc9fdec9ae3e45c09e798

SHA1
b06334c8a9cdf4e64dfc7023fe5c4be64c5057c0

SHA256
e3c1e6d0cfe5b85291bd2ccdc9d88cc19dd77487700b279e0a35ee879fcef9a8

SHA512
687075a10179f824cc95cb0b4cab860dab0262aa548e02203e136c77b078d72594b33648b217d476d04c9b8592bb42b1ae69381e6fec82feff471a6a85a3b020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
137KB

MD5
da1b752d088730db151cd44b8ef93357

SHA1
57a6409f0f314a12886f75764efdde7c9d91e9fe

SHA256
0104291a733ce9b7d37d37245cf2e48de4cf5dc8430317fea19eb86a3074a012

SHA512
76a150bb59b5806dbb703a211afc900ca0b62d005d96e6495e6c0470d9e944e968f2c743e879b7b2f857918b62b18be9c2813fd6b900b3b9facefc736865d070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
21KB

MD5
f296707b4c73ead494d385c89341b075

SHA1
a472bd888ef1984e14b3e3c68604987612b858c3

SHA256
1f43ec08a42fa7f83184e52d01b1bc08d59c7fed982e5a86727f5561351e9bd8

SHA512
b18015bcdba5d8ad0cfa546a447c4abb469019a83606f6f5e52cbc262e8bf7bf7d48e4521657046e89d28e8dc219bcd508fb6a8c34a03c6a13abb91af1ddd670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
152KB

MD5
4521b6fb0d76ba6fbde6dacf5a6a2a51

SHA1
8ffdc57f21502f0164760f9e2bf4dc10bb3fb43b

SHA256
4f9e8f4c4e21819683335f73bd1e7d2b3afaa30d3449508472294885afe8f0d4

SHA512
13819a3a6357cd44717fe768154f8117115b22043e9ddf024b5b7ebc5ca427d733261e0a0aa0237be54dda49fd3010853b1692dfb74fe42695d201cfddeff552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
67KB

MD5
ce58019b091dbdb1895be63d765b1177

SHA1
37a38458a92835c43b270069c0629c6975b2ba69

SHA256
8defb86fd585d1e578370bac22698f0de49d509d7398a0e83fbae7a9d11e0fcf

SHA512
36be843dd5630cf0c76219459b2ff946fa91ab90be31e3ac62452642a79a062b9d7aaae14a0ad8fd92b1a6d468394f1aa8bfe45f262f33e34048b46e046a1b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
62KB

MD5
fdd3922edde39c73dc37b568650e47d2

SHA1
1566ef03ec365d9d7e4ac9fc9cbb4e5609b9b976

SHA256
d464beb2c15b29d24af42a7cf74db9539652dba74de861feb169145b5589a3ad

SHA512
b3c7e48d1bdf62d8436ff428af14155a5c2e834ffec8003e9457fc1458cd77b7474210edbb5f57eb838723844f6139b3c523d3a9d1d4f525aa067bbccb9e146a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
31KB

MD5
a4da976dde535a4f11ff4c9d57a8a56c

SHA1
fc4c29049db6d81135507dc3736cb638340f55aa

SHA256
6b85680498d0061e6b748f0fd9c904c74eb9f265f7d6ff6b33a37a0656164bf9

SHA512
e3db7eb080a2c927ec3a223d16d818cc76f9da51525a91b8eb3cc9e15106e2939ef6d550121b8cdf76d38c001971662d833d70a269ccf35d36278d25cf42aa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
20KB

MD5
02d0464758450d87a078aea4e46187a1

SHA1
41154a61b8192c00a4f03e5ce97e44ecc5106e74

SHA256
c6aabc7504bbf101eb3b39fb3f831b61148f34605c48b02ba106aedccde52750

SHA512
9af139023983a975acb29147037f4fa8ca820e15b4c5f471e2cb000909970ffbfda2b210c8330cea93271bfde3732455a545730e242f1a0e59871bdec702b39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
17KB

MD5
7909108e624bb441107d1cb33586b6d3

SHA1
19ea2497a016cf47af1cbcc2babc6c8c0a968e14

SHA256
29f01061a6912c49322951ae13f0e567006c4256f33dc4eee098d996aa4c3cb8

SHA512
02cfbd98fac8ab133d766e40d6714acd8a772e4b28d3786b303ad44884adfa80f4ec6791c681c2cbaf9ad042fb98f196fe68b6fa4a207a0d0e02d5409fd3fefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000089

Filesize
21KB

MD5
47ce2d83c35fd76a6d6f7b8b3413a85c

SHA1
9924f62dee99cda84d48d7bbc60b0d8e57357bdb

SHA256
e4426cca4dc4dd6cb5fbbb0d9182aa0f7fae061709e58f014df910d19a74c828

SHA512
819a17ba1f4d4bcf0152acd0932d6852d72cd51cafbe2009eee7e609e5ce0761b19087d5959f90fdf69e26a1a1851bf7fb0aeb688181c94a24cd096e3522e11c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000099

Filesize
20KB

MD5
fa4cc25f0f72ac052e9413b46705327a

SHA1
72127f17a73fdeaf1d867ff721f8115e90d82e8b

SHA256
62215bb3463a1bdbeab484739c056495d60f9e6feab8e3974cde6bf69504f05e

SHA512
b33ebe5aad7802e7aadf31bc490bb697a7a941c4ec9a03c211b42bf54403f05dba02fdbe42bd7c28a27e309c868f4d74c060840a4aefdff57ac9c5c2cb66921c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009c

Filesize
20KB

MD5
e92faff58b6be9dba9bc283c4f4c8513

SHA1
49588273a413dffd248cd35dd191189ed2c2343c

SHA256
8c6c6736f4650f9bf7af6fe14128a3d173816f3dee2e02c5552240c04852b691

SHA512
52ddb77b600f519eed2343d528b9c9bc03585c82edaa91c63e8850d19be23c2f645bc8faea19c3d75ccffb30e4e69a3605883106fb1783346a8883465051643e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\118c7f3c9055a906_0

Filesize
21KB

MD5
0f11b0b2b5841a9157efa9e5d31e01db

SHA1
9a685501addce478eb78dbb9b784ff1e79dfb8fc

SHA256
10e6df08947edea5bb069c5f422794c85fc6ca4bcc006ce4de338fdf5a885520

SHA512
25794efc41fb16a3719dece7f8cd881686a791b6f20818eac01bbb5e602bae64d224c1d8e494d8eed347fc47935d44b721db71881203bfc7c59611b2283a3641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\118c7f3c9055a906_0

Filesize
227B

MD5
ed86fcd46a07c64e81fe0fb8cd31a621

SHA1
265aa8bb63657b956c72a0e7a00f27f4fc947c34

SHA256
d24b3dc922f57978051add3bed57f39967dc5698b7ffc59c230ae58706a055fd

SHA512
5a19ea327b2129e3b6bb4f045dd8177c56d81da4cd3eb24e15c5b80332a35a48113227852e4648d6774ee977902ac0ac6d4f87f24193c8863faef694444987cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2452536b75924538_0

Filesize
14KB

MD5
573c5cd64342804cca833a08afae8fce

SHA1
bbedb629a66c23ac0889b470e6dc08adb56df13b

SHA256
668ffbe6ff8c45c53be62b966e419fbc09508c69beda02f28aeffdcae5e7e315

SHA512
e8ca250af596e340463ecc519c05beb0e0caa87bd0171ecb39728dc40b366eb67f235b9fe7d7e655047b300739c7fc5539ad4495b7315c71b61b4b2b3fbd4706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2452536b75924538_0

Filesize
228B

MD5
433360406596065b64deca9e8dfbf2b6

SHA1
d6f42f6c9764f9caa8acd7a5e63329efc940d7f7

SHA256
18b7d8a11e6edefba12551cff53334edf90574f5b6332b1b2c70ddd8ac6e85cf

SHA512
7235231c56f80364ba6a6e81b34b28d6696cd2bb476255de69cace0fc891bc42d98e01592a31f89993cb47b66dfd6aa0dc47cdbfad99cf0db4ce70582f9dd245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ca3ef7f97f6e118_0

Filesize
267B

MD5
1c8012db2f3128b30386d308ac1a7a31

SHA1
9f745a18116fc8fce59c2c80adc438b4d0c9bee6

SHA256
5a3e102dff1365ec94ce318eae8ad8f0e22d73fc6c6cfe4d7c2b2a0352197c75

SHA512
52d7a409ef08ad3f5a450b04f876fea375cd98d8ca8f2c7f173fc96f60971a46d8b7baea8848a8765034accd645788e5db51c4c515a1009d7171e7fa67fd32a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ca3ef7f97f6e118_0

Filesize
219B

MD5
2d93b064a5a0ed147d744399b36caad5

SHA1
059945107d4ab7f045876d9f8085d0ea53db0b0a

SHA256
7e4895372f03f4b8f0c65d39a37838bbfcbae6ca61abf8058178cded9ca847ac

SHA512
0e1b0c2063331757a38e98320f74065255bcb5137e9d662c222e7f57d35f4e0df393c8d0a61b7aa42833fb7b81f10bb8b3a551ae0e8569ba64f714cce74ccabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a829395f3b1a744c_0

Filesize
341KB

MD5
a1a369b1db55b6c63c06ce9c385bc751

SHA1
8afc3ef9fb2d5a800e85d32718bc1831b8556f06

SHA256
ade67bd51f5cc66a241a51f60bce58ccca7d24f822da326d7eebd5d065e34c27

SHA512
10f6044d6960e3aae7bb7b26cfb3c604d2ccc106725ab1a1dde62186aa5d362554c3f2818581f458c41b08fbf95dc64bfe9c5a95b40941dc9ea56895c0c21143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ceae1fccb049df3b_0

Filesize
159KB

MD5
9d0cf40d5f43a9ea4d744df788051451

SHA1
62d20e30a1110db173fd8e18ab8d9ab1458b6bff

SHA256
d19f379b34305c7c2fb589eafce0db75e08216088578cad144382d9b58963347

SHA512
0fa35cd449665078e545515f0e1d5bfdb5bff9e9f4ee4ac45740a5fa880fe9b4f3bba3221f569e9ae6e44b48731d3b160b921b1a293fdda3d116b9bfe9f83fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dccc6e10ef775901_0

Filesize
277B

MD5
857a46f91e70db1ac7ba0d0d640dcd68

SHA1
b62f77bdb187e3cf1879e8a945708cf6c77cb6de

SHA256
1f2ecc9d3a36866351383ac1cfb70c0b4784947b0cc0dc3e3ccbb49bd931e195

SHA512
5cd975542e79f9b7c2b9104c46144f5c166f8dfad6c94e5907e9a5e155468c68249653c3279472a06ef5da870354bfd03e4319914e824e0160a9b67008e7087a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dccc6e10ef775901_0

Filesize
229B

MD5
a513631fef0056951c3b8b0ff3a25cba

SHA1
7bf8d39509b47a4eb751e7bea1914b571ce82d94

SHA256
8141e7639575d4bd5cde797779e59e93c0586656904f6169dc1870dd8dc087ce

SHA512
6bdb50b47c889629114157bfbf21c3be6d12a69ea57a5b03a3f8e48350f2e39818190068778a27939dc45dc756667cfdde12b23aeabc628f454db9999327947e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efb2cfabf9bde180_0

Filesize
54KB

MD5
8fdb8e9a29814c0a457c3c71ff219252

SHA1
e32b680514c0afbb8f7d89c4a360ec0944a99501

SHA256
7ec0092b57d417b25145601c02e6101b71e63b9e22659530730f584f4097abcf

SHA512
6fb04f54c51677f3b2a8384e10b1d31482bb53ab6427eadddc0835e20ffa4a705ff33c7f3bc313a39efec7151d6ac5d353698cb40585aebc07797f3086125da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efb2cfabf9bde180_0

Filesize
224B

MD5
d2ec177c9bab3c768c9998eb2ce27bab

SHA1
49cd035c6399c125f9effdd4dc0baa56ccf62a4d

SHA256
4e756660ad32465d9fafeb6576d5b7f7cbcccf06fb0c4bc8f8b2373e4526e4b1

SHA512
a3cfa83d69090e9ac5d43766947ebf5f9077263ac22b5a1294ff4a7e9ee5c46ed30ae6a8ffbdd91fbebd5d9190219d4ae9cbda1b260b29fe2e7463ad94c708d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
9a5ff4022047568a1588db84dcff25f1

SHA1
471f0cb29420172eff61280828cc97da22d86cda

SHA256
690048ac02673b072bde271411fdce5f2f8de8f0e32ce1acc70b541175d33df3

SHA512
d8de54d25943878e24a5dcc042b35723bc28e32414734d5f8a62c8d9b6191a8457b0ca188fd9ce52f52ad91d5a4a762fcb1aad216b2eae7ee761307fa4b1732a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
efa75f07785a24801d682416880ed0ed

SHA1
a606a49f1ff6e5128fb8c057c7b2bba1cf4cf1e5

SHA256
17bedb121785d8b5fed200bb368d7b0ce0a6ef7dc8943ee96eb4bb5427a83427

SHA512
a03019c3fe0080033e13e842e1d8c6bb4ea58958df9d37f4f12b9a6229a0535c4d6ef9473baa2da8eebe05b36aa3bd82b9a8c88180835e6343ee715259614952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
4dbcf2deac2f492a4048c0723f688104

SHA1
11746468fd102231744d2c71992050cc4fd80580

SHA256
6c13a81b749e3c76fde7efb0d613f026bb534645e000a67afa203ba2957455cb

SHA512
ffa9ba583b04efe6135126d8b7bdc56080f9b4e9ee1716359f17ca6e43d74ede56adaa14fcf55e7ebf0bb52ca54edca66f39f75941decd58727bc853778d5022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
cfc19fb0f82c18511cbe3ee04d0e4774

SHA1
6c96348447bd3e87ef8a4acd4ba8671e977725fa

SHA256
0d0ce56d149050bdf66e44ee7a3e7878d3cd6d48390878d395a7ae958d0bd2e1

SHA512
4fe159c586e40198194b297a2b3af214d4bc7243db95367169d70969de1e130fac5d0bc0010c2b0ee2e3d07841dc90a07160e7d0b4fe8dcda4fa5fa31960aad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
c133942ef584eeea1f5ad8bd89f6c3e9

SHA1
9aa04f8a9ca478e711500bd0b8c6a84e30ef9046

SHA256
60d3aa87fcb465922ee534cf5e2d7fb9986086012c86ed532bff3661085cc0e6

SHA512
8f519c4c8425325f36b9a948d22cb51b424f709d5a620fcb78a71c3f785c6d3aadf77ea677f3af8bf14708d8e64fbd15244d7ab6cc36e814fdd23c2114cecf00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
285f895b1403e967d4a03b754f33da62

SHA1
65aba0f953c2943a04fedb98a392af23f5da1deb

SHA256
1645fc4809caaa07e85e8be3f52e37e6a2b74dcb97a21b6e0bb1a2131f852a81

SHA512
9761004fbe03025751f56cdc82c62e7ec928b2cba713e9fd51e1525344b5072cee46da18cc23fa264ed28553dbe35903f55744bde75f64e588d1355e2ee7999a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe591d90.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e014ee5875735a20f1fd2335b4a5a326

SHA1
360608cd0a985ca4a40208e9509931bc84a72acf

SHA256
20c2deaed370f136013051e73f1a3be9a38c2b87e6f1cbf9e6d8b8711023a4a6

SHA512
fc9b859d8fa2c295542d43bf68898eeb453a758915cc563d674cbf91485f952a1af72bd1a6f75fd8ade46bee7dadafa0f22cd51c5f67bbb0d3cc556f721e7434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
f6d6ba8d1c8f54d977740d12823d05e9

SHA1
91fc8baf34e7402d8f065367a09c9125edd69b3f

SHA256
731065ab5f74e0215989ec1fc05827bfd2cf5d0927300781ae80b5828699be2c

SHA512
ed53f16ad47ab9ac152ce085c14805a59b6f67fd4e3d744b6311736a828acbf8979bd335bee7d90b2465da6a248e449f266a745f6e51be6d9e9c22e7c5f56d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
19dca61df6a9a50d2d34f74cc0f4bcea

SHA1
415ef60d7c24a977ebea1e0c562976456c3ee909

SHA256
5720de12abfee0f8b76b4762cf976cc29961c7f484c7919e930723cf5074fe24

SHA512
de7dab5386deb78e6067d94558a897ee0494aeef31a80bf370c53ebbcfbcae7021d616a484c5464e45f1f876f42e07fc8c0e28266a153e0ad9a3d9cb4ee20e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
5cc3f37ca4613a12aa523b867683c6c8

SHA1
02ea6545ba48ff859f7cdaf53df592c8210fe1a4

SHA256
777e09177cf53e1bd8cc30d07e35f24d1b55b48d269a87044e5b1da5043eac04

SHA512
5431bf9eccd63a55a7437a49f6cf7f0b01776e77991cfe8f0b418507c5ac2a59a56673277093b27976399ae7ef8c9ef4e93ae69b2da74271c23871d52354dbc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
01b2da67361fafa502f96e39919697c7

SHA1
62c1e23edb613ac95d004ac6dd64eca7a21ffc8c

SHA256
4241a758b561545ec5df23ad445e008753f9e35b7934d01e0e98819fe723d81a

SHA512
97ef84179564336c1a66d7266222d9ed6ece6fea43455e4421b67b7bfe9bdaa9955d843ea07f482500be6100d2d741d1dc858d580850c62bd4a5c419d61861f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f19eec112399ec6edd43268d5da8a2b8

SHA1
7659e2903609cbd8798fbf5fd9126fe4d382d82b

SHA256
fcc7f18a9c158334a5ae5c812d4b61c1b42a3441788f78c60833859376370f88

SHA512
3e6d5135cb9df927ad22f95c1bd96fb06f927510ad96c3376803374e97011cbc0efc5e77035901c8c1ae64c560d09feb1412c505453012cb3cec338ca13fc9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1e187e37e9c0881ab3db6e43c9e31b45

SHA1
0b5826b0b33486657f1de5af153aa7a841d6473e

SHA256
c04c38036d71e0cc7d436392b78bbe82834a130146a175e2e59b60165bdc76ec

SHA512
b89633ad411d7e86f202d0a886aa5cd9e2d4b4f4902aef44a1c71b1eea81e783f13d66eef3d7972a1e71fc993ed35a87d1c0a37c6f7ed06ed50d41c7c08ad9f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
5db914e68a3ece9258ddc378163d7e8b

SHA1
cc5e42231540b7bcbeec94b8ed84e9f89d8cbab3

SHA256
db75a72d8d631a75c118fc89fd1e36e698d45708fc6fc86f1e449afd90310bbc

SHA512
48af5cd6058a61010ed1d37d0fcd2df61cb609e5e699c8e46b05e4fb18e58ee54931cc64a1234e0a2398ca21e43ef3424a4c2e88f574d68082db6bb8456ca789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d0addf205f393c8aff08c546eb21a0f0

SHA1
1f79badbe97700a373edbc9178a8ac89ef363154

SHA256
ca66718fbf3c68a7985c25e4133ce63f0408343ca55a7ff286b94fbf3e501790

SHA512
14e821f730470e72a1ad8f2961ffb21a627cd90cfdea273cb7496e387a0267123d9bcb7b5dbc4d26941eb20906cff874a183114a46675c50539c369779e37f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
aa10f656cc16d036a580048ba0bdac0b

SHA1
52c15a55cc3b56bd1bf5dd0efcd2b66413b7044c

SHA256
166d97573db5472f64c5d066f2b07e6fbff2f1f9d5858fd7757548e334e9220d

SHA512
748fc7d5155285784ecea52d01af8168213210231a698073945b30b4989ae28463a7fee01e24792fd33b17744cd54587f801c5e836c926d700724171bb0000e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ee8e616a03201ab31e032c60a6d81b15

SHA1
4fa72ee1a3ed74f7798b3b58cabe174c675adc12

SHA256
2d77f4c62538359ca9c795a3be97c3817adb7954e004fe4b85cfffbf216f64c7

SHA512
97640f1aec0c917ca0bdda6f0228eff1d4274d2d681c73206be660697d3a7fefbdeeda23d6e3fa853228be633b4988e543a41f84bd027493c7d633089c863151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5dc08aefe107759b74d75454705a4826

SHA1
a01eed5cae24782728bc6ac0319c9c7e52514258

SHA256
779193dd37be4823749032a88af3a5dec4826c77f792c7777e0c8f5fb4e77d2b

SHA512
81d2c9286f58179e6f39bd7e58272b4a945c7c91a7fdee07a65f8423e9319fb3cab1fe0bfa2d9f211c2329ced3eb91a14d99a37f9932151bf547fb6c406cbaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
4da51d7c6b878f84329e959d4dac7260

SHA1
e6c1a4d2f957c644bd8d74d874f1622107d6ca38

SHA256
c07d93a384cad0c74d99472bf2e4fd32be506aa203df5f756657f23119de22de

SHA512
ee77fbf11a579db6a3f9d20ee524ad5bec4bd5fd9d2990055f3dc0f710c18bf2b86d3ed43d128e251dfe7c2bbe493b4ec9240170d8a7669ae95405730069fed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589f77.TMP

Filesize
48B

MD5
3b599988af85454e44ccdc470b5ed741

SHA1
55c47a728a6c3f647f073f7f533d6847a3fbe7e6

SHA256
625a38c372ede38e5e44fbc19590b70a9bb6763d4169e12cf4c8ae09836d3430

SHA512
2ac5dfe057403f40417ed68c17ef6b3f71a80db3119f56022d58269cce9def9b7e30204bacfb6090a914646c768ad89c59cb4c0b2182f6743f297e22a8480583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d72683bb09086271317692d0427df793

SHA1
d0c1af5336f984248fa46f0baab8daf6329c6ea8

SHA256
96cc81f0ea3d0e60714b93aa1481f578c8bdf5579bd8539e59bd3f2fc1d4d48c

SHA512
c15399ffbf1f7abd46c7c5f0cef862d568511384c4754e99cf26e178714a6751db6bf1c08604f89957adbceec73022f680772f3711f821d57a0daf89bc935aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
799eb38dd7d1f2e1932b92db12a1cb50

SHA1
4a82b83146fa2f7ec576ebee5308b086ec358a69

SHA256
9678fbce7591ec3d93f9247fa3e6c3ade2ccca94ccbe7f98f9b50dbe00f2292b

SHA512
e748c34e37e1593b0337b9b52a5a260652e1e20cb2da21359a879cf46916204abf8d95da5201fb0e66c91d71327654559d4ed006f58d52947ed1734490cc8b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
eff2d5c9776b84db6d7f3f479c4e1ea6

SHA1
9ae9f5826110d1b5a3fbcc650437a6595fb6ac18

SHA256
e63d15d9ee63b26ea7feaf1a973df53a7517081b6a7ba67618422bcbd82c3d47

SHA512
82080d87b534e2267bc5940fa4ba498b72948f0ebbbc914b12abeb82b89f56ee4e1bf9ba127434e00c1f987ec91e0752d35c07163f4262efdd0da06aaa13caed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
1a764f0628126344a27d49511dd97c4a

SHA1
884b94a53eabf702b6f4e10c316c1d0fee54d951

SHA256
85d99933e8a272e1d0832af4d3e4c4fd527d9196e6f3eb03c2421683fa79e25d

SHA512
a820081c3c41cb9e901f6919be5420808aaaf09ddc3e22cbcb8e018b12cd97fdfae2170756eb2851eed99fabce31c0dcd6c9ee2805b65eb9e6da41ed94b5d528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e26.TMP

Filesize
538B

MD5
5c1e50f8d9aada1ca3d4bb89e3081e76

SHA1
a6a0a97b715144b23418984b28f63f5a4a123d17

SHA256
db8486575d3e1ca8b9580788c7bf910523f12273d8c0ac5d798a088ce5ee32c6

SHA512
47a54a712ca3848aa175fe50010e5a853b5abfb660e33c7cd2d24e5849836d11eca571419ca447a0824634094b0ac3921150bcee3ed910a783bdc8176ddd5156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c387f4ce3e67fd64134553dca35aa7c

SHA1
a3c0ff58cbcb5d0c755ece7a20627857e714754e

SHA256
13b6a24895b78a7d7b3ad43b23962d8ac3c9abfc3b7ec8424d2726666c1d9e45

SHA512
30fdae81895835b1df295bcf1a78e0b5d79decb030ce3d8a92e55d11a02939f3e095150ed9c20c82dd971d8131d0240b0e172f9b6e823da8e39a34d83cc537d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5566fa97953d1171fdb2129ebd00e319

SHA1
3a115444492224d3fea6dc09dbf6a1995703facb

SHA256
f9b7416e41af42ecf1a179045aa93a33f6cbf336d97e5092fb2e55f4d1d1a713

SHA512
d6862659cc54ca3bd8d8b3267019458a691564596beaf57419821439a72b8258feb1f613ddc1ae01b810634b7f7d9e91605aa421732f4137e0777bfb90bda87a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dfc74bb6f1eeab7f759017fff8bea889

SHA1
0e85c8a4a32becf8eb514c93afeca34f1611658e

SHA256
7972c9bfb8eaaebf0c532aa2738e35ed05e01539aac452c8a320abdbd43bfee6

SHA512
2eaeaba7b735cfed5f788b0f541cbb11eab17dfe599e15b837c8b693a6b41d28dd293124dc78d14811e605ddf1f09f5e9dbf525acf8226c975dd735d5914caa6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3c8c2e5a773aea26d48451d31c345688

SHA1
3fdd11a34cd089c5a0192e51d022b0223425b647

SHA256
9d4cef3cf0f5b54b13abff01da2e73128e72a14448d4d9b60b473ab3db3510f6

SHA512
e02d289687638334398f3f247823bedbaaf1fb4a5b34c50f9e244fdbfc95040bc6f64cf878081540f154390e09f2bdf1168ce490b0faa15b79ab5b004c10d095

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
eaca08c0aa63abda2fce8abf4cc94d8b

SHA1
262199aeaae37b53c8f555ecaadb2e5e0d525ef5

SHA256
69b06070a11480c75070652efa2e1be47a929d07645a1302ed53072eee36d4a5

SHA512
b7199f387fd3b0123dfe47cb674dd77f0e7591a70dc353a0c5f292bbba42ef75addd03d1ef42e3c59c832a49fdcebd3151599ec0ef557a6351973b9651fd88e0

Download Submit
C:\Windows\Installer\e5b4beb.msi

Filesize
180KB

MD5
7c87329a66d4c22f03acea4e817971f9

SHA1
12a2134fa09fd7df026ffc20bfe58a7d30d6ae73

SHA256
c78bc45113d0270c2154930761c3b74db714987a16c0fbe5e7a05fa3a853d0c8

SHA512
73f11aa3f9b3dbfba157a0d47dc61ff2a22509b61339882a9c2cee53ee335b18820700d7a413b81b426e71c83443f0d99bea8b3638b8b87ee9a42f01f404f955

Download Submit
C:\Windows\Temp\{74E07D79-DA4D-4BED-85DE-A86386965253}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{74E07D79-DA4D-4BED-85DE-A86386965253}\.be\VC_redist.x86.exe

Filesize
634KB

MD5
415e8d504ea08ee2d8515fe87b820910

SHA1
e90f591c730bd39b8343ca3689b2c0ee85aaea5f

SHA256
e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0

SHA512
e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1

Download Submit
C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.ba\license.rtf

Filesize
9KB

MD5
04b33f0a9081c10e85d0e495a1294f83

SHA1
1efe2fb2d014a731b752672745f9ffecdd716412

SHA256
8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

SHA512
d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

Download Submit
C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
C:\Windows\Temp\{C347C228-DBEE-4A8C-A9FE-04603FBB98CD}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{F2C9EA0B-57E4-4A99-9E18-E3DE624CA4AA}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/652-2487-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download
memory/1048-2486-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download
memory/3252-2773-0x0000000000FA0000-0x0000000001017000-memory.dmp

Filesize
476KB

Download
memory/4288-2736-0x0000000000FA0000-0x0000000001017000-memory.dmp

Filesize
476KB

Download
memory/5288-2449-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download
memory/5448-2774-0x0000000000FA0000-0x0000000001017000-memory.dmp

Filesize
476KB

Download