Overview

overview

10

Static

static

10

SilverClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    312s
  • max time network
    309s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 11:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SilverClient.exe

  • Size

    43KB

  • MD5

    77e52bd69cd31b84f909a737ebcb92cc

  • SHA1

    c2ea68fc905a695f071e242b0782ef2996122a96

  • SHA256

    ac8c2379cef34550f244e79d20d6c5d1b7f1e780712168536a06e64b692b8513

  • SHA512

    6e0062f85604bb310730a2fbb87365d6543c92568561b5666af5f8939b325a464769c554751e149becd412862515c7a1e653ce07591094be1ddf2330d45a6b61

  • SSDEEP

    768:2uIQbKCHbymqTYV6O1i/MiZHFPsenEsJCSZbYvlGGooooizJj6RUT0v9SNHXhXBL:BIEKCtIO1nGFPsenEFWJj6GAv9iBor/Y

Score
10/10
silverratdiscoveryevasionexecutionpersistencetrojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

following-geometry.gl.at.ply.gg:11493

Mutex

SilverMutex_VEYRwaRvUo

Attributes
  • certificate

    MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==

  • decrypted_key

    -|S.S.S|-

  • key

    yy6zDjAUmbB09pKvo5Hhug==

  • key_x509

    U0tZRVJueVNXY2NSek1admhOVFlpc0JFcFJHbWVN

  • reconnect_delay

    4

  • server_signature

    6ye4pxF52YX+bV+EOMA/wWVAc0D/XOR0xgKLnRG8/vP8KVrSyKDJa2vThc3yczy8At3Kp7Mo/wfOVOX2XeIjyJvm3cewwK+/+ZQEfOT2wP4KN2ilxtTamLCTSLS+JudpUi3sY61JfDLjmFM1XQaJBhoOI7DB0UA13bmohsQ56tSzdbZrDUCfgvMGsGxnmcw/7oS+zcH73GH3sLqkZ+iYSNeNX6iy1BJYoD3NgoSflV3780CzCbFutTqV8Zu7H34nTKRzQ99axDzsVn+jjvzz2adi/k69C8f2yhzA8hLwKTf1CLf2zIsGIBM6mrzP7DeDGd2ae7BhYpmkZxPor0AVDdbdJxM4dEosayHnzyBKKCoQDmr2buUXA5b4wymmwioVpTzZD9zt6dwVtwAJXEiG+vo8AvKGsp/pGofXDgoSez2wkayb7XsYqnpaq2eVIS/FBpsIEd2lPAe+OZ1df+zOv5np+ekGE1/0R1NrCrD4a/e81ZtaqmjM3oyEto2/BkzgVXt0m2c+2dk0CAiBhkIFJbQNrb+E3dUcEaGIPeVwSaY8LgliG1SKiRXkjiLcx8s4Dpj3hRxeAvgUmXUxiElCcl0IlnUDbhKYXMRplHtILLJMUyJwvqX+ld3QU/6fzEXtep6rZ+b3rDC7vh/7sVIqkpMRiBGaf0y+nI32ontx+bU=

Signatures

  • SilverRat

    SilverRat is trojan written in C#.

    trojansilverrat
  • Silverrat family
    silverrat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 25 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 13 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SilverClient.exe
    "C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:4404
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:4452
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE985.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:5016
      • C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe
        "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /query /TN $77Ponispro.exe
          4⤵
            PID:1456
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Create /SC ONCE /TN "$77Ponispro.exe" /TR "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe \"\$77Ponispro.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:684
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /query /TN $77Ponispro.exe
            4⤵
              PID:3664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2360
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Ponispro_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1972
            • C:\Windows\SYSTEM32\Cmd.exe
              "Cmd"
              4⤵
                PID:4408
              • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                "PowerShell"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1768
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                4⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3732
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8a2ad46f8,0x7ff8a2ad4708,0x7ff8a2ad4718
                    6⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3752
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
                    6⤵
                      PID:3176
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4624
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
                      6⤵
                        PID:3660
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                        6⤵
                          PID:1704
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                          6⤵
                            PID:4784
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
                            6⤵
                              PID:3492
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
                              6⤵
                                PID:3960
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
                                6⤵
                                  PID:4344
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
                                  6⤵
                                    PID:4784
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2304 /prefetch:2
                                    6⤵
                                      PID:4820
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2312 /prefetch:2
                                      6⤵
                                        PID:1932
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2364 /prefetch:2
                                        6⤵
                                          PID:1380
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3956 /prefetch:2
                                          6⤵
                                            PID:4344
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3632 /prefetch:2
                                            6⤵
                                              PID:3556
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7277809464534722998,9660326671451744089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3588 /prefetch:2
                                              6⤵
                                                PID:4724
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                              5⤵
                                              • Enumerates system info in registry
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of SendNotifyMessage
                                              PID:4320
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a2ad46f8,0x7ff8a2ad4708,0x7ff8a2ad4718
                                                6⤵
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:4848
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
                                                6⤵
                                                  PID:2620
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
                                                  6⤵
                                                    PID:4940
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
                                                    6⤵
                                                      PID:2936
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                                                      6⤵
                                                        PID:1904
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                                        6⤵
                                                          PID:1540
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
                                                          6⤵
                                                            PID:5532
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
                                                            6⤵
                                                              PID:5760
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2836 /prefetch:2
                                                              6⤵
                                                                PID:5940
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4884 /prefetch:2
                                                                6⤵
                                                                  PID:5200
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4788 /prefetch:2
                                                                  6⤵
                                                                    PID:5548
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
                                                                    6⤵
                                                                      PID:3772
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                                      6⤵
                                                                        PID:5036
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3096 /prefetch:2
                                                                        6⤵
                                                                          PID:5640
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3664 /prefetch:2
                                                                          6⤵
                                                                            PID:6124
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,1335317703792035835,9034652349968024689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4032 /prefetch:2
                                                                            6⤵
                                                                              PID:2920
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                            5⤵
                                                                            • Enumerates system info in registry
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5268
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf4,0x11c,0x120,0xf8,0x124,0x7ff8ad6acc40,0x7ff8ad6acc4c,0x7ff8ad6acc58
                                                                              6⤵
                                                                                PID:4748
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2032,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2028 /prefetch:2
                                                                                6⤵
                                                                                  PID:5812
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1704,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2052 /prefetch:3
                                                                                  6⤵
                                                                                    PID:6000
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2104,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2512 /prefetch:8
                                                                                    6⤵
                                                                                      PID:5644
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
                                                                                      6⤵
                                                                                        PID:5544
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3388,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
                                                                                        6⤵
                                                                                          PID:5564
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4056 /prefetch:1
                                                                                          6⤵
                                                                                            PID:2880
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4852,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:8
                                                                                            6⤵
                                                                                              PID:5200
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,2208034641993083431,2730995110295785106,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4992 /prefetch:8
                                                                                              6⤵
                                                                                                PID:6044
                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                      C:\Windows\system32\vssvc.exe
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2984
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3208
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4116
                                                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:5524
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                        1⤵
                                                                                          PID:5232
                                                                                        • C:\Windows\system32\taskmgr.exe
                                                                                          "C:\Windows\system32\taskmgr.exe" /4
                                                                                          1⤵
                                                                                          • Checks SCSI registry key(s)
                                                                                          PID:2200

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Command and Scripting Interpreter

                                                                                        1
                                                                                        T1059

                                                                                        PowerShell

                                                                                        1
                                                                                        T1059.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Defense Evasion

                                                                                        Hide Artifacts

                                                                                        2
                                                                                        T1564

                                                                                        Hidden Files and Directories

                                                                                        2
                                                                                        T1564.001

                                                                                        Modify Registry

                                                                                        3
                                                                                        T1112

                                                                                        Credential Access

                                                                                        Discovery

                                                                                        Browser Information Discovery

                                                                                        1
                                                                                        T1217

                                                                                        Peripheral Device Discovery

                                                                                        2
                                                                                        T1120

                                                                                        Query Registry

                                                                                        6
                                                                                        T1012

                                                                                        System Information Discovery

                                                                                        6
                                                                                        T1082

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Command and Control

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\49359c57-978c-49cb-a46b-29aba05f378f.tmp
                                                                                          Filesize

                                                                                          1B

                                                                                          MD5

                                                                                          5058f1af8388633f609cadb75a75dc9d

                                                                                          SHA1

                                                                                          3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                          SHA256

                                                                                          cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                          SHA512

                                                                                          0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                          Filesize

                                                                                          649B

                                                                                          MD5

                                                                                          89f240bbedde36b01607c49ff39a4c80

                                                                                          SHA1

                                                                                          0bd8858e5727e8ddfd7eeb41915346406850eb7c

                                                                                          SHA256

                                                                                          89e592684775852fbca0e829a414395ddf59b58e9796cb819b72dc5137932548

                                                                                          SHA512

                                                                                          7c0796cc425de8217b8c722c55f0bba59a515e9d310f068c8f7e857feb32a238bf935a7e80f4c9175a571ab414f2299527ab2620b24ba65709eb80cd78740217

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                          Filesize

                                                                                          2B

                                                                                          MD5

                                                                                          d751713988987e9331980363e24189ce

                                                                                          SHA1

                                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                                          SHA256

                                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                          SHA512

                                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                          Filesize

                                                                                          356B

                                                                                          MD5

                                                                                          be232c2d8b4a012c379e85d16cbc052b

                                                                                          SHA1

                                                                                          a766ae54eba0d4c0cfa40aa28990fc842c2bbf50

                                                                                          SHA256

                                                                                          fa6413402ae5f52130df0bccf194745a1ef53bfff6fc600179655a66d7b6f08e

                                                                                          SHA512

                                                                                          122f7b484c74026d08aed509dacb0c6eae5044ad56433d50795783f6513aa3de070e46310b88efb2772f67149f955af3aacba9f45fd76edbbc2f311dbef84e9a

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                          Filesize

                                                                                          9KB

                                                                                          MD5

                                                                                          767a552abc38b32994a171e4dc189244

                                                                                          SHA1

                                                                                          de56f18a6cc7712beb1e607870880f6e19e9d32f

                                                                                          SHA256

                                                                                          c2e34d76061e799223a7645a71e3f3948a9b8c0506b72eb45bbda31a947877bd

                                                                                          SHA512

                                                                                          bfda2599550546d963c2124dd90529ff03ae01044fce9d56b7b8be0e4d1fcb0d748cdab770d8152f1517d7a19604799d66cb0a5ed149e7ff8a8dd3450aabd13f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                          Filesize

                                                                                          9KB

                                                                                          MD5

                                                                                          02c8f8a9165cf27f5ae835717701e968

                                                                                          SHA1

                                                                                          f9191909bbc1b43e49e93eda109213c4dbf6993d

                                                                                          SHA256

                                                                                          7fe63df9757cb7d02f5b8cc40a549204a131cf37b5a66875a86d3bcb3d6f5b1f

                                                                                          SHA512

                                                                                          499bf8e07ebb1cf52f3c7a32c0385af841f21653e274c08261fa7a6601b26e3fa3af2f4420f17a61dd44df777a4d49dac582c7ad48e268cf792389e53cd32e45

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                          Filesize

                                                                                          9KB

                                                                                          MD5

                                                                                          70878f71b22e7fed4d63dc632cafa690

                                                                                          SHA1

                                                                                          552947f28a108872a7a27360f22bf97029258e57

                                                                                          SHA256

                                                                                          73f4411a3a4a3fee2b456fab730ac595ca160d242f7d8ec41dc661b2f5d35389

                                                                                          SHA512

                                                                                          dbf603c4410e0b71a585a6dc1b1ea55ce5be128a85db98b189ef9621a059c5b3e8f6129b3ccaadabaffe9f6facfe4a1d8b9d4085e6a9085c636460302dd9b80f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                          Filesize

                                                                                          15KB

                                                                                          MD5

                                                                                          9395b48b5ad2f74ef367d3304e8d0bd4

                                                                                          SHA1

                                                                                          dcc883abc17f851d2ed67500242dda8ae0219758

                                                                                          SHA256

                                                                                          eeca8ff234a6225ce29de8bde3f129836f2d7d53911c385f1e75350c52007640

                                                                                          SHA512

                                                                                          d7d81fd41123658b5f5c7222a15dad873430d8ab1280f7ef3a8fb9af80f93bfcbedc4dcd9f823db3f73d70c1dc6102cc5bf607f3979420660145c4b1eaf140d4

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                          Filesize

                                                                                          234KB

                                                                                          MD5

                                                                                          03f59997374819dbc349967bbffae962

                                                                                          SHA1

                                                                                          18bbf8543dc04fb50da844bb14df606f4b005dc7

                                                                                          SHA256

                                                                                          b07361d3396282e38fd3666c4b0d041173c1200181d547c9a24964985c1a7b44

                                                                                          SHA512

                                                                                          7e11d22a3121dfb4903aea40b734bcb7e9799fd66407c7521d9029aec110a7b84318e5070ada57f2bc93be5970ddd6ff810d87a7afb3f19d795ca667805a1b04

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                          Filesize

                                                                                          234KB

                                                                                          MD5

                                                                                          ae528e67c717eea4d668a454eed165dd

                                                                                          SHA1

                                                                                          44ec50603f5eb5b95764e1ce53e27d3d93286b86

                                                                                          SHA256

                                                                                          189a241f7a215aa1412ee728f25513fb5ed1c53c024bc06e712cdfd053bcd07d

                                                                                          SHA512

                                                                                          f7fba561fc47d724340dd2acdec0b2c1f0d1d2ab3e214dd6a5f9664cc9780bf21e55dc154c29672c582983c7127a127a58149a397c9d97264e8c3080612ee751

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                          SHA1

                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                          SHA256

                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                          SHA512

                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          103d4d04ba000c259b652495455a726a

                                                                                          SHA1

                                                                                          609384a824c0a2a107678c6aa523980de445903d

                                                                                          SHA256

                                                                                          80aa798eca2611c4a42829c1d0c4349aa93fd3c6d2eaa12d123774ab29922e30

                                                                                          SHA512

                                                                                          2b2834af2484623f290a8bf5e951925b79901baf0edc2e56fec0f741bc7e02a3fa3007ba6df3ee1f7f81df02bb9ac3d0971c37a90ae146a08f7f82903083bb19

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          b74d890a6b50beb7c40e5b18f77189ce

                                                                                          SHA1

                                                                                          e37fb147b39214cf87eb0c56848c187609054924

                                                                                          SHA256

                                                                                          bb6278180c3b51534c3c2c941f1996afcbd4a367d72f0b373daec753252a82a1

                                                                                          SHA512

                                                                                          eea003c5bf54d02d4ab0ed8cf902d3cc8bd7f61e98e979c87de7077ffc5e48489afd951c906fdb057c67cb8944c27a675b2985a903fe70a501ea7e48e7d1eba8

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          c4ac057e3a4ab90874c9e160242b736e

                                                                                          SHA1

                                                                                          5b062ccb24ddbf5b201603b40a37f6e0c4397a1c

                                                                                          SHA256

                                                                                          e1c16c471c199a961d83eef408156f7b957daf7fb9219a220a103ac314486ae7

                                                                                          SHA512

                                                                                          65864b9371dae827d484cc9edcc883d43d21d1f3f5064361d6d43bc9c1ea082d9352bbf6da458c907deb148c973a1c62a244ad2341dd8d4690aef7981aaa45ff

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          8050dc225c3e0531f554c5d50496c369

                                                                                          SHA1

                                                                                          06ed90d73f2700095ab7f0846b411069976e8ae6

                                                                                          SHA256

                                                                                          4fe56774b2058f8b1ce32f55b0dc93e53c1dbebc7eaddfb230cc32a9f36c7b32

                                                                                          SHA512

                                                                                          a431fe7f65cf713088726abbf4ad66ddc2f0433903c777df9313d4c6bafd4f054b292378383dd4e480afbb837ac788194e5fd489bd067adeef9e1ed4cbcf4b50

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          418B

                                                                                          MD5

                                                                                          61aa2f095f9e3704daa0602f81cdbf65

                                                                                          SHA1

                                                                                          77250fa38ed53aa5214be356890528b016bdd945

                                                                                          SHA256

                                                                                          148f0cca1e25661d6e63cb1a12e550729b97e9b453251749492b2beb6ebd9eba

                                                                                          SHA512

                                                                                          8b466a93c749d6283dc9c13414278e558e30ccd93f47b2161a1f240d1e6ba0678597383f3678787d7210fc6eb50a5ebf224124b0dd1361edadf436f61a747c0e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          552B

                                                                                          MD5

                                                                                          b31130d18e08627e5a45347160801a3d

                                                                                          SHA1

                                                                                          bb9d65d02138944c3b1e701ccd80139494901e0f

                                                                                          SHA256

                                                                                          1c145b51453677a9af52f8324e56a2a1e93a80166b7ebbd4ac0a3a4ccf0f0766

                                                                                          SHA512

                                                                                          c30fbd568c28b934f222fe92388d8dabadf81a92ff885c04eb63c647bc4a2438597113462d47a2904ee40f0398a6d1058053d591e4ef2d9c0f67f902c989d796

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          820B

                                                                                          MD5

                                                                                          3df5f78ff1900b03ac39dfd53340af3c

                                                                                          SHA1

                                                                                          cca32ebee8dc70eaf2edf16a081e1e57fc7a5887

                                                                                          SHA256

                                                                                          a892a1d56f6e9e83316a3c13af48fdf824470d06a5cf9143c590c17ec4e18e20

                                                                                          SHA512

                                                                                          d0e1beb1aad9d693da0af4e49c8119815aa2e0c659a2cf767f3a879161ca17049fc63e311e4cbb18f202c6f770cc4735e6f333f77888c0cd7cd03ceb3b3a557f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          954B

                                                                                          MD5

                                                                                          9e33bbd31cfb33b6fb1809449243aefd

                                                                                          SHA1

                                                                                          f89da56df3847c54691daa6dd1af975b16f1f754

                                                                                          SHA256

                                                                                          13d3f0a84ccb30ee42a728d43f1569352ca8e0a33bd7bfa78deba67c5228df78

                                                                                          SHA512

                                                                                          d675923356579c7e41bc83fbbaf2e9f6595cedae3fbbbca8b21f982c9ccb9ed42dfa1dd92b1158bc215328c9352907867a741ef197e8fe19d4948f81d779efe2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          34735ea11559f3863226ff78a406074b

                                                                                          SHA1

                                                                                          1aa3128a0c7ae5c5320eb05bc81d232582a8057a

                                                                                          SHA256

                                                                                          b345dac6da60611920306e368c3a593f6dd517fecf0d540e175e5377be90c307

                                                                                          SHA512

                                                                                          7ca629963f98b45395ec119c2f45ed71a3f0e5c9074e1de8e2b73b8f14cbc05f5a724ac9c20aabe526fb09f9a7caf79b66503d48d3856d933212db7ff81ec2d7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          26ce89d3a51765c9bbf393233a745d3e

                                                                                          SHA1

                                                                                          5cc937271f69c3b8af3fc9483a3337d342dd95a1

                                                                                          SHA256

                                                                                          17a6dd53bff5f3feae5c2b73b04f76868f93bc838b1742d967e637589d0ec08b

                                                                                          SHA512

                                                                                          0d5f1e2649958d8aa7e850c023046aa19d447cccb8a2d3846b2647d145389d348ec7978fd57474737e60eb7e92464fe14e58fbd830177d874d6919144e3741d9

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          1d9c2efedc677cd11bc7997cb5095b45

                                                                                          SHA1

                                                                                          4bf40e95b0252260dcb9bc6443744b98b41c4044

                                                                                          SHA256

                                                                                          29c6e68cd5ec6f72230be612e7859cb1dd42483f179a24c19ce556f644cde0ee

                                                                                          SHA512

                                                                                          caee5b3e4bcd9b90cb08e256554227b7c6d3dabafbcb7ac63cb7e6f732461e55438885ef314b8935282525bd1c251b74880e545e6735cd7ba6d7506d9f3485d8

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\06357099-8931-4500-b685-2aad97361df0.dmp
                                                                                          Filesize

                                                                                          830KB

                                                                                          MD5

                                                                                          cedbddf5a4c5a2befb8c3d71aa3bf17d

                                                                                          SHA1

                                                                                          e2db89408749291629186bb542216208a24a47a5

                                                                                          SHA256

                                                                                          bafb4dd132da1fa449de1215cd2747dbd4d1d5ab22fdca43c4cd289cd6755875

                                                                                          SHA512

                                                                                          4d62333fd07f2f16a4adbe2a6d9e570eac16e7c480cc18f484a1ab5b79c6074adf96023ad6d5bf92eec64665f64335b633992a4f1fbb20a36a53f49a6f9ba320

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0701b2f6-a31d-4791-a51e-22d487191a0a.dmp
                                                                                          Filesize

                                                                                          896KB

                                                                                          MD5

                                                                                          a306eaae7bb17073f49f8051b65270ec

                                                                                          SHA1

                                                                                          04a143851b324a500ce07624e7e95b5e00252c2c

                                                                                          SHA256

                                                                                          2d3159012d191ad8c62ac1996b8f12b3c24c8eef7c9552b0a00dbfc089698b62

                                                                                          SHA512

                                                                                          ac2cc613d4157dc21eb7df12ebcac5126c2274f388fdadc533c2736715b4856319c462118b8138ce001d04513c3defca664fdfa2f42d44f727feec5b653f7344

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0daaac76-a085-42c4-8773-97674f2e8052.dmp
                                                                                          Filesize

                                                                                          904KB

                                                                                          MD5

                                                                                          8f974f619917cc7f06ee25af193c9baa

                                                                                          SHA1

                                                                                          9ab3174419ba24952c7385690154b54036963c79

                                                                                          SHA256

                                                                                          6ad8d53928031d7ee6fee9ab5bca2269ceff8e598269c8aeeb0f7e78877d3f15

                                                                                          SHA512

                                                                                          1d777cdd264661e22a5ab4e8d21530d0e972f7dee1dbbf2af8d4abda94f4fe7fbfbdbbe023282aed6af87f9930c114653e6421f4e663a0383a07da876d5feb07

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\14256a14-bc3c-49da-8e35-ae0707e57d10.dmp
                                                                                          Filesize

                                                                                          826KB

                                                                                          MD5

                                                                                          944f257b10bd5edbad961448af8681ed

                                                                                          SHA1

                                                                                          c3aa6c060e5435a56f24d488b648ec6e4b50bcdf

                                                                                          SHA256

                                                                                          68085aca853db5bd5bd8ac680616879bd31a6a8603040be9443e5eb61f42a806

                                                                                          SHA512

                                                                                          aa2b73eb55d54f78deeb81db749ef4ebb0c73d2356fcdbc7b6ae0ea468f9468dc96cbf1bd35c591436f021711d28eb1dfde5ec65ac9b237a0dcf480824e447e5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\15393eba-77ab-477d-8e79-11b0c54e1049.dmp
                                                                                          Filesize

                                                                                          896KB

                                                                                          MD5

                                                                                          035141b5ac298bf5b63c1d9de936defd

                                                                                          SHA1

                                                                                          cae40370cfe88f59c19fb218e5446a7645ea9149

                                                                                          SHA256

                                                                                          426de8672a1102b352c28c9bb8f82907fa7e499a36d734cccd377e124062a863

                                                                                          SHA512

                                                                                          c994d55b836888066ce29ad88239fb9fd22dffa4b562b16f6ed07e650c46b7dd2cba35696794724e1f4eceb6d75425d3327137023b2fc2727d6df0020118d086

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\19cd1605-7f9f-4996-8dd3-0ed1dba55ade.dmp
                                                                                          Filesize

                                                                                          904KB

                                                                                          MD5

                                                                                          e9b176464eb17112f5caf17ace03129b

                                                                                          SHA1

                                                                                          88f77449a7bb448beb887812182ecf60a4f936a6

                                                                                          SHA256

                                                                                          6ac01eb6e58125eafe7fac46d0633e723e0565bd7c3eca544776f374a752817b

                                                                                          SHA512

                                                                                          52180a2991ebdcc1df735585bcd94cdf4fa52500cc3424f600348547e44eef54de2a9ba8bb2e394ee93115c363c1303d6e8992bd3ab7d18ea93d06d9371702a6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1ae9f409-30f8-4375-82f3-2cff3a6a87a2.dmp
                                                                                          Filesize

                                                                                          904KB

                                                                                          MD5

                                                                                          84b190051a715c92fa31cbf417f06aaf

                                                                                          SHA1

                                                                                          f3c18e6cef2cfcb5a43957aff4d0f2d96c3a400f

                                                                                          SHA256

                                                                                          247ecfec2e8c008d2e5768f6b2a71b4bee14d28e91ab7cbdf432532282b72726

                                                                                          SHA512

                                                                                          fbfab447c267ac3e0538976788672a01a6b34b44bd2975b7ffdd2b7128c9b971b8d36f2c4dae6de5b071f3c0161297eea73c74152af06bb01ab0b15e055e8f99

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\21227444-692f-4edb-b1e1-92ea056c1352.dmp
                                                                                          Filesize

                                                                                          896KB

                                                                                          MD5

                                                                                          86522da56e2fb923474b1471a4bfb9bb

                                                                                          SHA1

                                                                                          b4dbdf15e5e1c51d63582397bb07d5638915a1a3

                                                                                          SHA256

                                                                                          2a6201e634f98b50568ce266cae9fa9c813b4dbdd8a712edcbffae77ec682516

                                                                                          SHA512

                                                                                          e2d11b2160864e05450f25fe3b6aace7d42e890f20d6f0dabba86debd7005d8c29baa715ecd0eaa649c6f6573fee313c443c9737396a4218a2901d4d0433cf4b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\3859e206-fc0e-4240-b538-4ed531d7b46a.dmp
                                                                                          Filesize

                                                                                          896KB

                                                                                          MD5

                                                                                          e8b37dfb0973cad7ad550dcf39fa37bf

                                                                                          SHA1

                                                                                          93b622b925456735f059281af158100abf80f506

                                                                                          SHA256

                                                                                          3dd3c2b5198895dc50e7425499639aa3424b4643a2dfce2cb167dc2f6c43ef18

                                                                                          SHA512

                                                                                          a1bad9adedb1ca43284b8696f4d8f865d87de071729f062899311612763e7d70b36abfb661191f718da812c9c957498bfea0f52f3df199efca579ea8a3028755

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4aed77d6-d897-4740-97df-0ba67922d8b1.dmp
                                                                                          Filesize

                                                                                          830KB

                                                                                          MD5

                                                                                          c6f4b20e899e4eb6435827a2986588fa

                                                                                          SHA1

                                                                                          294c4fd68420facb7191bee4ee314d2b85cbf18e

                                                                                          SHA256

                                                                                          71e8f21ceae45b31e7a3e1a03f7c0f41a33c87f55dcfebcfc344fdb4b3a5d3e7

                                                                                          SHA512

                                                                                          45e82adcaec423e50b8e23784b379ac789af4e4d9f6135f79d78a64cb4684a73a3b1091ada0c089eea3e4013345550e4024e88cc094eda7a6158875c5662bf65

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5fe53194-21d0-476d-83e8-4ab18089b662.dmp
                                                                                          Filesize

                                                                                          900KB

                                                                                          MD5

                                                                                          92bb060b4096b8d126d499c95805eb18

                                                                                          SHA1

                                                                                          82a5ca7f6aa8faa32b5ec8a6c41ef36ccb82967e

                                                                                          SHA256

                                                                                          99c95eef8e0353cd60cd53c9a5a76e4f509bc9a634a9b83bdb1214851b6e82e5

                                                                                          SHA512

                                                                                          8265694f67381ecbb1379dc1ad62db7cd6792b1fe266b3fd138aaf15aafbbab19e4aa2a6b3a7f8528579245e439656dc2e02b0dd18b84cd8c81bc02f690e664c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\77537179-9212-49c7-877f-5bfe09492848.dmp
                                                                                          Filesize

                                                                                          838KB

                                                                                          MD5

                                                                                          2062fe945c36b71316843feb8eadf1b8

                                                                                          SHA1

                                                                                          3c27a2fc6f852f5e25722f382019d2f0a7eaf63f

                                                                                          SHA256

                                                                                          cf6892a120b65a1b4be7f6fdcd9f1ed2bbadc73d9044f03286a70b34b93f4561

                                                                                          SHA512

                                                                                          8c7d6282f37428cd77972ed45ae958ca3ad4ea8352e4efed28bb370e65102612ed7a18955d1417f64b737e21629f6d3aaf5a2b2e2419e90c7e0e76b6660a0d8c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7afd7ea7-1b79-42f5-b11f-111be2ee770f.dmp
                                                                                          Filesize

                                                                                          838KB

                                                                                          MD5

                                                                                          796515667ea9cfb61218e15a7cbdae84

                                                                                          SHA1

                                                                                          b2978546cf11cf29782b6f89540d1cfd005ab60a

                                                                                          SHA256

                                                                                          c6d070c1abe006de8884b089103156942e814900fc0a80a2832cce99fc64b57a

                                                                                          SHA512

                                                                                          15e44152e1ab3c39b95cd76adab367e28a4c2919b7000df8a8fdb9148edc1726d8fe18376230d0354355d86c4f4387882bfd0f0605d3ae204972469af436b2d8

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\84c317e5-82f2-47c1-9f11-c520345a1676.dmp
                                                                                          Filesize

                                                                                          6.1MB

                                                                                          MD5

                                                                                          504b2c2823abc6299d9a56d774ff05a3

                                                                                          SHA1

                                                                                          95eb3e6d06f96839ec8fe72ce3c06f7f8d1c3ac4

                                                                                          SHA256

                                                                                          305665d5b90eace6e3b438bf8cd36e9009c01b8e5c48b9bb1b991b233f34c2da

                                                                                          SHA512

                                                                                          5c967db23632eddf81347adc3b826e219453cc252415bdb7da64394559d53a471f7e21b684fc11d956bb4c6f7e0c0aa31a42325f2f32310dbef72a5cb9f3d195

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\97b39354-eebc-4fbb-9793-fce39102a849.dmp
                                                                                          Filesize

                                                                                          830KB

                                                                                          MD5

                                                                                          3cd566dc93f2971d7b64aa5a6e475716

                                                                                          SHA1

                                                                                          518c0ea1733ef9d52abf94773cb33a154608b325

                                                                                          SHA256

                                                                                          b266be39f5a8747627a35d1a3f0ff2501a88148a69e9a031f85413f6e69d5c16

                                                                                          SHA512

                                                                                          ed149f4f5924363dd05d02f1d3a01595e0cbf5f1ce20c838801992375cd6109a0b76988585c27bdbca8b0bebdfe357d7b384071797099eeb9ebfc982182b386c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\a79c3a76-5d4b-4840-b511-5cd2d58da436.dmp
                                                                                          Filesize

                                                                                          892KB

                                                                                          MD5

                                                                                          6768ae05a61f92aa5d8bc3f6106d5a2a

                                                                                          SHA1

                                                                                          304005551d48832f397821cacb2798955b9a84d0

                                                                                          SHA256

                                                                                          a9d9eff796f418b63a97acb32b9c8fd1a8c35b3543f8a5f873376fe803615c8f

                                                                                          SHA512

                                                                                          696b2fa0da5f557ae73d6f1d79b9b32312b9d96981ba140f0ddc44e337244ee67be7de418d8fbb1ee4e86a09700dca65850ea5bea4a2c340692d8e3b6d571518

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b3c6fb66-bb77-4be6-9d7b-63967a52e797.dmp
                                                                                          Filesize

                                                                                          830KB

                                                                                          MD5

                                                                                          8d4b080999743e94e61d30b3e3f7c94d

                                                                                          SHA1

                                                                                          639a0131d4e574928b8dc0ebba470b39ab5cbe88

                                                                                          SHA256

                                                                                          3117c48f0d777de597fbfa93eb42bc59bba94244354fa43e578fefdd136df663

                                                                                          SHA512

                                                                                          d13f8b771e96fa66e63f520ba418767d5dd6c9467c75cd4e7ff1f05d7a1edbafb14e0d0c818027e1f878867e78a3a92604943dfd8098b370c3970f1a7ce9742c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d4b4c1dc-31c0-48ec-877b-94be71973159.dmp
                                                                                          Filesize

                                                                                          838KB

                                                                                          MD5

                                                                                          18bee5ad7ed906bd827a22ecd7cc5c4d

                                                                                          SHA1

                                                                                          09fa2738e06332cc3050d1c4a5f137b88d4132a2

                                                                                          SHA256

                                                                                          e1fc5197d44a42ac01469f5002b354fb69a165d9192ba8e736811733cc7714cc

                                                                                          SHA512

                                                                                          777507bed4efb0944282a69eb272a5c36a287eb285afab81c66225ac43787a0bc1c05edb5c44dafd83a473dbcc01a60495e2fb562949124d5e42c29011a4f496

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ebfcc1ee-f650-4025-bc05-5a5346e02643.dmp
                                                                                          Filesize

                                                                                          6.1MB

                                                                                          MD5

                                                                                          0ab11fa53951c9d99d51e5aa1dcfaaab

                                                                                          SHA1

                                                                                          bf972628de8cd660f67fbed68e1e12295f0aaef7

                                                                                          SHA256

                                                                                          65c867b0cab311b701061c8839abe258e8b234ae007f658a3030bb7719eb7d39

                                                                                          SHA512

                                                                                          23d35adc1de19cf9438ee848f3b9c127471677db7c73ecae4ee5a9a8aee627b09d2334883d40e706f545f3e503d01bc137d3c108b4cca62ad8f7d645965570f4

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f430921c-0e96-4a64-95bc-920d1b9eb00f.dmp
                                                                                          Filesize

                                                                                          830KB

                                                                                          MD5

                                                                                          c10499a8303da5fad315428b788d4ecb

                                                                                          SHA1

                                                                                          ae18e91f8629fd2a25658820dc073e004bcdd76a

                                                                                          SHA256

                                                                                          2f1d75a063bff6edb9847e1cdedc2fdb94c10b4cacd09b18151d3c17752bc84a

                                                                                          SHA512

                                                                                          19662fba2a7557bb2cdd0a361a9b5f265f3f705dfc50defdeacb9d23a71101438099559ff283c7bd923c5d8a39e372784aa5385676638c5c2aee17d62d2231ce

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          8355a46192e3e4985546d6621b4b5146

                                                                                          SHA1

                                                                                          8c678db0cd3ca3ddc5b161b1247877b96e6fa657

                                                                                          SHA256

                                                                                          60f67b96776ffde76255106f6e1138e749dfd77cb13deaaca39fb33298cb635a

                                                                                          SHA512

                                                                                          69c20ab511a7ab41a0b69e22b1edcd2e8e077194f6283c2640fbd16994807db0c54a9a0558084c613f9edd35321963a6ea86d7fa8746c496d9f905d595fbd42a

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          d22073dea53e79d9b824f27ac5e9813e

                                                                                          SHA1

                                                                                          6d8a7281241248431a1571e6ddc55798b01fa961

                                                                                          SHA256

                                                                                          86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

                                                                                          SHA512

                                                                                          97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          bffcefacce25cd03f3d5c9446ddb903d

                                                                                          SHA1

                                                                                          8923f84aa86db316d2f5c122fe3874bbe26f3bab

                                                                                          SHA256

                                                                                          23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

                                                                                          SHA512

                                                                                          761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          86c418c297a70a76354bb5753e91c007

                                                                                          SHA1

                                                                                          3d1587c638ecfed7a4c1bc38f8c696fdde281c21

                                                                                          SHA256

                                                                                          6f4fc094e2b4f9e1b99e67e9895d9de5acfd73d32257ab97d9e9cef065998eb8

                                                                                          SHA512

                                                                                          784ce10958118800eb1e22ae3bb0a2a791f67d08b8539c8b0a13881595a8e3f90f82709bcd699d5bd6eab3b6f685eddb57e6fb88b7fd1537de6dec44199bbcdf

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          ea5a2cdce48e225c643687e85bfcee97

                                                                                          SHA1

                                                                                          c8a9787b017d88aecaa2c29028b9f98606fd9b08

                                                                                          SHA256

                                                                                          d1819f48a1df2f875331ec2c7d25de198119654ae88ab5b30f47390ab75f31f1

                                                                                          SHA512

                                                                                          d0e542d6ee311d31da6e02e284305be4036743c75f6324d1204523e91b0b92f0b103a4fb591a963f25ae612eba629131e0e925f3815cb49e29e4c6e2ab76ce87

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          52fe33938fdfbd0baa9b4f1d808e6d8a

                                                                                          SHA1

                                                                                          7c2383e0d2ea3b79c50774df6ccb8e73d53301d4

                                                                                          SHA256

                                                                                          fc0d55dfdef8aa72c684c8f1d15265b4dacbe3f068d37b6ce1b766b6047ceed5

                                                                                          SHA512

                                                                                          7bc8f844c0ddcfc219a77f07d0e6f79393a6a4345c076450fafb58a5faa6f3c94c8412758a880f2103c8468f97b28c15d444a34c9fee94773521eaa9f3bbc199

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          c4cca8c1032b59d1944f7645b9693ee5

                                                                                          SHA1

                                                                                          a644c07252e4b0eadb9f810825569a33cd48278f

                                                                                          SHA256

                                                                                          c3f4f91d62845d0eb3199f2849d1ed5dbce8b835e21326bf19a448d4120f67a2

                                                                                          SHA512

                                                                                          3a7831c3b81c2d491a4643ccbf5b25be1686463e5108e92d46845479768654c6551e479635efe878e78dc9113050f97ebff966dabf7a61271445f4970cfb40c1

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          Filesize

                                                                                          152B

                                                                                          MD5

                                                                                          081045480b3a3d0ea7b6dca793348078

                                                                                          SHA1

                                                                                          ba039de26732aff6abc9dc110f0f29cf5bbad5f5

                                                                                          SHA256

                                                                                          5b2405bde67c4c4739d980906d65a07a7fee60b10ad1521e3f126d71fadaf9b6

                                                                                          SHA512

                                                                                          55a7f875420fa3fc280002f653b9f9f938a6a268ef2d52cbed2042f82a9577a6aa35bd5fba17b72e18b9f8cc0892aa5c347a7ce78b180c6d9a2040225bdcbec2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
                                                                                          Filesize

                                                                                          8KB

                                                                                          MD5

                                                                                          b307fd1d550469e57cf09191506867be

                                                                                          SHA1

                                                                                          8dd52e068a9f45f0eba434b8e5999a75c872d77e

                                                                                          SHA256

                                                                                          66ea6a0d4e3fe2fa2dc55b5ec35269b73f15b904092933bf830175b2d2927ac4

                                                                                          SHA512

                                                                                          63061654b818c102ebecf24dfaf627fced06ed53f8669bddfc33571f741762829fe3d96445972597dabcfbb22e12ca90379d041d6d670824cb3e2ef261b84411

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\582c0cad-eb22-43fd-a9bd-cdc5b6b8174e.tmp
                                                                                          Filesize

                                                                                          5KB

                                                                                          MD5

                                                                                          7b8f8688fac0daba75a35041a1240e52

                                                                                          SHA1

                                                                                          b581b15e4c8c00fe6d6694d47193909f7d55d89e

                                                                                          SHA256

                                                                                          a2db9a9aa6cec4ba90b562752d7e01978ea024c9ba843729464bab69e3425014

                                                                                          SHA512

                                                                                          2fb7c3f23f6cdcca19508f83b1662bb023e08e2120ca3a5ded377cc962758dd2bc7ab8ea597199a279157c9168a90f123bd29f6793752192eade7235113b1480

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
                                                                                          Filesize

                                                                                          44KB

                                                                                          MD5

                                                                                          8454871f67101f3ae816b2d1596dc1ad

                                                                                          SHA1

                                                                                          87a9e6e8bc73aee18b8a8db56560813068fba825

                                                                                          SHA256

                                                                                          130d100432384b51f3c184fad34d27e3ed79a8b86b48233f7b1272c294983ad4

                                                                                          SHA512

                                                                                          3b5b4de09d5e7858b384398f6f9723917f2fb3b83a5edd4b5e0bc0f6b787b1e128ac5818047b803790a9ef590a4b241ba8feb2c415c899cb2633781b745bddbb

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
                                                                                          Filesize

                                                                                          264KB

                                                                                          MD5

                                                                                          960883d6c511c3f6ee45cb8e22a9eed8

                                                                                          SHA1

                                                                                          e47626251f3317bc6e7b5d3348f6f3cad22f6f71

                                                                                          SHA256

                                                                                          e2af03655be674f095df96627fe94deed7218591c272be86853f7f983daeaa57

                                                                                          SHA512

                                                                                          5b7dcc0f9a3ad1c63b7a4427bbf1c21393a1be2f27687b51e0f72c37372076fac968dd8cb1b8c6ae557765d87b6680091859587f989e85d69cbb94ce15274fd6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                                                          Filesize

                                                                                          319B

                                                                                          MD5

                                                                                          b172cf9a99c2065984596e027a36e029

                                                                                          SHA1

                                                                                          eab4705f840b237b394a5654e10ca5cb6ecc29d1

                                                                                          SHA256

                                                                                          fba6febfd4658a92dfa5af6e7125a019fc7e4e785a9d14d213b27c53e7226673

                                                                                          SHA512

                                                                                          3f44693859111871e832e934799ce0d8bab799331e57da86e855234fc853d51a12e301adafa3743915bf8598e82e87050764b8ffa2330d355c1a20b45532f82b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                          Filesize

                                                                                          331B

                                                                                          MD5

                                                                                          eee1a5ab706dc5a823d37d6e440c8411

                                                                                          SHA1

                                                                                          f5be3b4e7a998d614356ab57c6274d5569301866

                                                                                          SHA256

                                                                                          547c2f331417342e1f9751742a9efc34781b62eeb55ca95affdc47b620e59aef

                                                                                          SHA512

                                                                                          21c95e8cf97196c84fc76ae0dee02c8b71d4dab69a6ca065c0c6c494860828f424b3e1dcb0595c34171bab6028916d9d19e6f389d78e43a2ae4d92cca2c679ea

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          Filesize

                                                                                          5KB

                                                                                          MD5

                                                                                          7f2075d00ed3b870edf5b210ad0da063

                                                                                          SHA1

                                                                                          08c209a1edf4b17f4bb1ae70729e10d4b717282f

                                                                                          SHA256

                                                                                          c38723ee67f9989690d9ff2a80c3f07c70ccddf9d10636b38eff679a11e302be

                                                                                          SHA512

                                                                                          7ae1d50d2f1e51cae01e77f0fa8815b3077351e325580ca9b5b8dbf34e2022de420de61a1cb76bb37b514726d0e4b52d073569465bf3b604ba9eaf3918d758b3

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377441840564312
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          cb707a3728f13661e4f0277bf334601a

                                                                                          SHA1

                                                                                          970f207c05956e419195c29e886ebf0f0c67358d

                                                                                          SHA256

                                                                                          27393a615f83e48a2ca6a99681801cdf8dc6a89808a2083f9e9d1930d2fb8bbe

                                                                                          SHA512

                                                                                          5eeff686a621bfcd3ee68158c90b45e605de7eb19c1dfb50961d43f128088e8f5af3b1708a4c93f7718ff00673139d6c35f3108d87ced4805e92295f30a5aba4

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13377441840733312
                                                                                          Filesize

                                                                                          933B

                                                                                          MD5

                                                                                          3e6b3dcb50ad5c419590f5fd96845d41

                                                                                          SHA1

                                                                                          ad70bcf9af039a147ae424298019395dc65a4ccf

                                                                                          SHA256

                                                                                          dba5151a5a2d79a16948768206b3a6f49b43fec23138b6a12d3794216f0f44dd

                                                                                          SHA512

                                                                                          bb6c1d823619def9db75a78c1ef1aae45415fc2251029c3ed51f80474376a1466f0994197477dd61bcd0ea102bb8b3426db8a15bc68443d70e44129b026dae47

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                          Filesize

                                                                                          347B

                                                                                          MD5

                                                                                          4a48142232463209506dc135c22c08c7

                                                                                          SHA1

                                                                                          b335baccd7f31cda6b530c4f74b9d31e150d8713

                                                                                          SHA256

                                                                                          42a58dbcc384b00ae55bf13c813263d7a69103ecb24c62068664065aa07b5895

                                                                                          SHA512

                                                                                          c49e7245b2da66fa5f6379a85cb4da0683c7a5ecb13461b903d766efa5945e1722c7b103c9ff2f9121ede9a00c5b7321a23e88f85f6323b4800308732b3c597d

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                          Filesize

                                                                                          317B

                                                                                          MD5

                                                                                          992b12e70495d5b29ceb07a79b8bf802

                                                                                          SHA1

                                                                                          c98ac27f82c036e3e8ebbbc3792dac3d57eca71f

                                                                                          SHA256

                                                                                          1eeca01b7c3188327180f2a63e9b3c1c4569247b5161dff6fea582a56adf18f2

                                                                                          SHA512

                                                                                          b924f54878f14fd7eb581f42d7309ec8c5d3641e03db3953a46ca554a9f9447d2ede2d7e5cde7d0a3e44fcda4d998755a7dd74f0799dcc85549fbbb90d2004e2

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
                                                                                          Filesize

                                                                                          16KB

                                                                                          MD5

                                                                                          f64d8f26be3fff93f84b40dc48f7afe9

                                                                                          SHA1

                                                                                          ff9197b7caa7f8373bd59d8ebe7c8e6d81bed843

                                                                                          SHA256

                                                                                          b4022932959b463dc3d1bcd56540dade721f87a0a2002fd72f4d100774158f8b

                                                                                          SHA512

                                                                                          4bedbd44cc24dd01b40074b91378f4cecc5f2d840d19b941b12fcef614f0cc48304387caf2b55e33267910d9caed8c47ec1dc87b2ac90afc2e37bc5824243e75

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
                                                                                          Filesize

                                                                                          319B

                                                                                          MD5

                                                                                          df766ef53b4d7dba199119d15f96ef4e

                                                                                          SHA1

                                                                                          3d30d0a9ea5a20c06de642b18e9f4fa91dac82b7

                                                                                          SHA256

                                                                                          436fd0d79b4c21899ea3306684a873d7578541911af5aa53353c3ea49d600812

                                                                                          SHA512

                                                                                          f9d9292d9474952cf0c4e691042f0364f0f728882dd96e4efe7c6d17d263cf6cbfbd28d87e22f9f91e6731ae31a65c768a7bff9427fc4327563c54cb453c40a5

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                          Filesize

                                                                                          194B

                                                                                          MD5

                                                                                          a48763b50473dbd0a0922258703d673e

                                                                                          SHA1

                                                                                          5a3572629bcdf5586d79823b6ddbf3d9736aa251

                                                                                          SHA256

                                                                                          9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

                                                                                          SHA512

                                                                                          536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                                                          Filesize

                                                                                          337B

                                                                                          MD5

                                                                                          fec850a85e06a9ee40be72fc5ed12611

                                                                                          SHA1

                                                                                          00add5ca8e193b97f197c52d4b42e85192d1fa22

                                                                                          SHA256

                                                                                          21b39466228208d24722d8fe27424cb9c09cfb2e5a2cccddcb22226369246ce1

                                                                                          SHA512

                                                                                          c00db3fb510302bbdd691eac110c28d49540e96797a92607d946aa79811ec0306b25fe4ace50b7e5b688e1c0daccd8e1fba72fffa15ea9bf33455cf97243c841

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                          Filesize

                                                                                          11B

                                                                                          MD5

                                                                                          838a7b32aefb618130392bc7d006aa2e

                                                                                          SHA1

                                                                                          5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                          SHA256

                                                                                          ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                          SHA512

                                                                                          9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                                          Filesize

                                                                                          264KB

                                                                                          MD5

                                                                                          f50f89a0a91564d0b8a211f8921aa7de

                                                                                          SHA1

                                                                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                          SHA256

                                                                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                          SHA512

                                                                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
                                                                                          Filesize

                                                                                          4KB

                                                                                          MD5

                                                                                          3192dd6e68181a59bf24ead7a9d78cc6

                                                                                          SHA1

                                                                                          84a6b2da32aefd83b6a2eee2d4f08fcb65429e97

                                                                                          SHA256

                                                                                          c8fb8fa3aacc1041c5a935c0ee0b4f1854b2994e5cf24687848e01254d4277fe

                                                                                          SHA512

                                                                                          01ed8f714a9e0a69f65d965f83ab5836e7dd33938358bcea421165dd8c3ad39b04587206b6e66b6e731099bfe5a0ad53207037e65b97dea7c069a08478b4d06f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133774418441361269.txt
                                                                                          Filesize

                                                                                          75KB

                                                                                          MD5

                                                                                          a609a1c96ec38a6db5b49b3f9d0d7c86

                                                                                          SHA1

                                                                                          2c724fbcc75fb85f20ff54faae903703534623fb

                                                                                          SHA256

                                                                                          da70884c5572e666b28cc679589b18c9814174e5208cce75ca475c2984a5c1c1

                                                                                          SHA512

                                                                                          daa82d923a6f97905b7019aa5bc2718f4c137cb87f8185e86a70bc60bd0671433a2acf226ac1c476dc028ecfe7f13d76c691e013e50f4da2b37b802285aed659

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1v4uyz2z.hn5.ps1
                                                                                          Filesize

                                                                                          60B

                                                                                          MD5

                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                          SHA1

                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                          SHA256

                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                          SHA512

                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpE985.tmp.bat
                                                                                          Filesize

                                                                                          164B

                                                                                          MD5

                                                                                          98788d0fede43f4d61d755a3d043762f

                                                                                          SHA1

                                                                                          6d7bfcb99d16a187ce2207059967839dc650b52c

                                                                                          SHA256

                                                                                          f7a41037094da2c35d74bf3ee45de70bc9ed974055f4847777dd644a824560a4

                                                                                          SHA512

                                                                                          df60e8ed72d654fe8cb303800fdb75075df349afdfa56c1118f9285775af5751ea58479f5a9c11e39327e48a79b61f81d4738bda5f3321f677615b1560e239e7

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe
                                                                                          Filesize

                                                                                          43KB

                                                                                          MD5

                                                                                          77e52bd69cd31b84f909a737ebcb92cc

                                                                                          SHA1

                                                                                          c2ea68fc905a695f071e242b0782ef2996122a96

                                                                                          SHA256

                                                                                          ac8c2379cef34550f244e79d20d6c5d1b7f1e780712168536a06e64b692b8513

                                                                                          SHA512

                                                                                          6e0062f85604bb310730a2fbb87365d6543c92568561b5666af5f8939b325a464769c554751e149becd412862515c7a1e653ce07591094be1ddf2330d45a6b61

                                                                                          Download Submit

                                                                                        • memory/1384-1-0x00000000008D0000-0x00000000008E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/1384-10-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download

                                                                                        • memory/1384-2-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download

                                                                                        • memory/1384-4-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                          Download

                                                                                        • memory/1384-3-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

                                                                                          Filesize

                                                                                          8KB

                                                                                          Download

                                                                                        • memory/1384-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

                                                                                          Filesize

                                                                                          8KB

                                                                                          Download

                                                                                        • memory/1768-43-0x0000018C44B70000-0x0000018C44BE6000-memory.dmp

                                                                                          Filesize

                                                                                          472KB

                                                                                          Download

                                                                                        • memory/1768-42-0x0000018C44740000-0x0000018C44784000-memory.dmp

                                                                                          Filesize

                                                                                          272KB

                                                                                          Download

                                                                                        • memory/2200-1455-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1465-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1464-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1454-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1463-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1453-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1462-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1461-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1460-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2200-1459-0x00000271AC3D0000-0x00000271AC3D1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2360-20-0x0000022AEF590000-0x0000022AEF5B2000-memory.dmp

                                                                                          Filesize

                                                                                          136KB

                                                                                          Download

                                                                                        • memory/3732-50-0x00000000029C0000-0x00000000029C1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4116-51-0x00000272DC300000-0x00000272DC400000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/4116-52-0x00000272DC300000-0x00000272DC400000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/4116-67-0x00000272DD290000-0x00000272DD2B0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4116-81-0x00000272DD6A0000-0x00000272DD6C0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4116-56-0x00000272DD2D0000-0x00000272DD2F0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4116-53-0x00000272DC300000-0x00000272DC400000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/5048-44-0x00000000013A0000-0x00000000013B0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/5048-1437-0x000000001EF40000-0x000000001EF58000-memory.dmp

                                                                                          Filesize

                                                                                          96KB

                                                                                          Download

                                                                                        • memory/5048-45-0x00000000013F0000-0x00000000013FE000-memory.dmp

                                                                                          Filesize

                                                                                          56KB

                                                                                          Download

                                                                                        • memory/5048-47-0x0000000001400000-0x0000000001420000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/5048-48-0x000000001EF20000-0x000000001EF38000-memory.dmp

                                                                                          Filesize

                                                                                          96KB

                                                                                          Download

                                                                                        • memory/5048-31-0x000000001FE40000-0x000000001FE96000-memory.dmp

                                                                                          Filesize

                                                                                          344KB

                                                                                          Download

                                                                                        • memory/5048-30-0x00007FF8A8593000-0x00007FF8A8595000-memory.dmp

                                                                                          Filesize

                                                                                          8KB

                                                                                          Download

                                                                                        • memory/5048-29-0x000000001DCA0000-0x000000001DCB0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/5048-1416-0x000000001BC60000-0x000000001BC70000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                          Download

                                                                                        • memory/5048-14-0x00007FF8A8593000-0x00007FF8A8595000-memory.dmp

                                                                                          Filesize

                                                                                          8KB

                                                                                          Download