hxxps://gamedrive[.]org/

Resubmissions

26/03/2025, 19:37

250326-yb993atmw3 8

26/03/2025, 19:34

250326-yajqqatms4 6

Analysis

max time kernel
667s
max time network
665s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gamedrive.org/

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5368	HelloKitty.exe
5472	sudachi.exe
3176	sudachi.exe
3800	HelloKitty.exe
5904	sudachi.exe
5900	sudachi.exe
5952	sudachi.exe
4676	sudachi.exe
4652	sudachi-cmd.exe
5124	sudachi.exe
5864	sudachi.exe

Loads dropped DLL 64 IoCs

pid	Process
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
5472	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
3176	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe
5904	sudachi.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	307	https://akirabox.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=92691c0f18c26364	5

Drops file in Windows directory 55 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_613067725\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1543980861\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\regex_patterns.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1340066514\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_894976183\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_894976183\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1340066514\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1448513403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_894976183\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1448513403\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1360218599\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1340066514\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1543980861\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_603596019\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_613067725\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_603596019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_603596019\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_613067725\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1543980861\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1448513403\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1360218599\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_613067725\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelloKitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelloKitty.exe

Checks SCSI registry key(s) 3 TTPs 61 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "3eywahj"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874914858396331"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5088"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4159"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3999"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "986"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1742"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10399"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "152"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2081498128-3109241912-2948996266-1000\{151B0B62-5475-4EA3-A64A-8D573C3EC7CB}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe! = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "132"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1869"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "17047"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 4e003100000000007659f46e10007573657200003a0009000400efbe7a5a949d7a5a949d2e0000007cb3020000001900000000000000000000000000000046c705007500730065007200000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "12703"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "54"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "111"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7363"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "12788"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "5"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "574"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SKI-Games4u.Org.rar:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3348	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
3348	explorer.exe
3348	explorer.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe
5272	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3348	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeRestorePrivilege	1436	7zG.exe
Token: 35	1436	7zG.exe
Token: SeSecurityPrivilege	1436	7zG.exe
Token: SeSecurityPrivilege	1436	7zG.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe
Token: SeShutdownPrivilege	3348	explorer.exe
Token: SeCreatePagefilePrivilege	3348	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3348	explorer.exe
1108	SearchHost.exe
1568	StartMenuExperienceHost.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
1108	SearchHost.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe
3348	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4380	2628	msedge.exe	81
PID 2628 wrote to memory of 4380	2628	msedge.exe	81
PID 2628 wrote to memory of 3776	2628	msedge.exe	82
PID 2628 wrote to memory of 3776	2628	msedge.exe	82
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 2212	2628	msedge.exe	84
PID 2628 wrote to memory of 3636	2628	msedge.exe	83
PID 2628 wrote to memory of 3636	2628	msedge.exe	83
PID 2628 wrote to memory of 3636	2628	msedge.exe	83
PID 2628 wrote to memory of 3636	2628	msedge.exe	83
PID 2628 wrote to memory of 3636	2628	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gamedrive.org/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ff90920f208,0x7ff90920f214,0x7ff90920f220
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2192,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4036,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4084,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:9
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4056,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4120,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2324,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4252,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6432,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6848,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4360,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6844,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7020,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6800,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7128,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=3440,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5052,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=1584,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6832,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=4524,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5036,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7068,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7204,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=5464,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=5032,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=4644,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=4668,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=6728,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=4420,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=4600,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7300,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=6452,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=4620,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9760,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=9560,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=5928,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=8800,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=9308,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=8504,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8776,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9600,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=9564,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9056,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=9224,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2056,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=6520,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9364,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3944,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8784,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9392,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8844,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8432,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8244,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:14
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9340,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=4072,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8308,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8460,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=7920,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=6096,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=9000,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=6288,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=7812,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8604,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7900,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,12264648597307535456,11728343467656033217,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:14
  2⤵
  PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3132
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3348
- - C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SKI-Games4u.Org\" -spe -an -ai#7zMap25686:92:7zEvent12830
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\HelloKitty.exe
    "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\HelloKitty.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start /B sudachi.exe -f -g "games\Hello Kitty Island Adventure [010027901C89C000].nsp" "games\Hello Kitty Island Adventure [010027901C89C800][v65536][1.10.1].nsp" && exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:5428
    - - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
        
        sudachi.exe -f -g "games\Hello Kitty Island Adventure [010027901C89C000].nsp" "games\Hello Kitty Island Adventure [010027901C89C800][v65536][1.10.1].nsp"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5472
      - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
        
        sudachi.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3176
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SKI-Games4u.Org\How to Play.txt
    3⤵
    PID:1336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\SKI-Games4u.Org\Make A Shortcut On Desktop (RUN ME).bat" "
    3⤵
    PID:5652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $Shortcut = $WScriptShell.CreateShortcut('C:\Users\Admin\Desktop\Hello Kitty Island AdventureHelloKitty.exe.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\HelloKitty.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1128
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SKI-Games4u.Org\ReadMe.txt
    3⤵
    PID:4996
- - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\HelloKitty.exe
    "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\HelloKitty.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start /B sudachi.exe -f -g "games\Hello Kitty Island Adventure [010027901C89C000].nsp" "games\Hello Kitty Island Adventure [010027901C89C800][v65536][1.10.1].nsp" && exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
        
        sudachi.exe -f -g "games\Hello Kitty Island Adventure [010027901C89C000].nsp" "games\Hello Kitty Island Adventure [010027901C89C800][v65536][1.10.1].nsp"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5904
      - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
        
        sudachi.exe
        6⤵
        Executes dropped EXE
        
        PID:5900
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\How to Play.txt
    3⤵
    PID:4632
- - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
    "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe"
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
      "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe"
      4⤵
      Executes dropped EXE
      PID:4676
- - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi-cmd.exe
    "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi-cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:4652
- - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
    "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe"
    3⤵
    - Executes dropped EXE
    PID:5124
  - - C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe
      "C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\sudachi.exe"
      4⤵
      Executes dropped EXE
      PID:5864
- - C:\Windows\System32\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5272

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5228

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
2294ba025779c50628fdab475acd59d4

SHA1
ccbcaa697ce1aa9f1daf9d88c214cb51e4381787

SHA256
ca627cba3701fc8c0358ef79f7e1aa9ced0b853fe8ee72389172bded974c431b

SHA512
c700c8deb0590992bb6210cdf3e34d0c6f94650525abb23473d1ff32f8b38d89563c8319305e64fe45bbcb765e6ffd4a76e20127ed8d1c2297d5c3a67e2b971a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\v1FieldTypes.json

Filesize
509KB

MD5
630f694f05bdfb788a9731d59b7a5bfe

SHA1
689c0e95aaefcbaca002f4e60c51c3610d100b67

SHA256
ad6fdee06aa37e3af6034af935f74b58c1933752478026ceeccf47dc506c8779

SHA512
6ee64baab1af4551851dcef549b49ec1442aa0b67d2149ac9338dc1fe0082ee24f4611fcc76d6b8abeb828ad957a9fa847cbc9c98cdf42dd410d046686b3769b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9bd0ac5b007ad73dc64fc096c2ad7c12

SHA1
2e81931337b2e69341a3f31946cb8b463d60d5c8

SHA256
57275605c03afcbaa07c202b492035c33d8d464990545e3f145ca58d73d9ba01

SHA512
6eb273c5d4e831b16dd00979151e4fafa17f896668ab6dbdd54aa5930ab9ef92f57fc7cb0b4bda34f40969bd8e7e1816fe511c429d281e54e3c17b43b7e4af1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fe266dd993e435ae57a8598bb1f588b0

SHA1
7d0e6a45f8dbfd5ab78bbb32b4d22a12039b239e

SHA256
e9df15136748c0655b500081803969cedb6956125f960e24f94459a450458033

SHA512
9fecc68c193a162343e75f0a4161f9376a67d17a854dcd32fef626ff5348c52e66d89fdd85c9193fedb96a60e70f08f4c0c3e249467b1c842a478fdc6ef945db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d3339f3c7c06719b57f1fb5cd95ef414

SHA1
ec9d4328ef42a3ff1e667a021640f4d8cc7b36e3

SHA256
f1bc9ab87cbb0c609e6d15aff5267bd69c17065060230a7696832c461dafecea

SHA512
79c4b4f6256e588b3af9fa4808f9a298ccb78432debc24b8ecbbd43176aba93b71454ec8c57cca32c34e907ff399dce667240588c1ddbd2a6c319f4c7b1a68f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
7KB

MD5
f9b99f0f2e4a63959e4fcd4e7617546c

SHA1
a33170b69d4ff4a683d700ffad9824b72d56d3a4

SHA256
f9d321716a81d6bf45726ba0372ea10075aed11de525c28cfc60515a85b99494

SHA512
3578531063b264c9d6f4e3a7a0fb7106e0885ab01f59595799630bfabe750a7c374e93646cce20efdaca324fbd88eef139a938c3106bdbdfd9b05ce65932c996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
352B

MD5
afcb247ca0449f59b164034f3cdefa2b

SHA1
d0119905d2f9de650f69e61f0f504a6adcc62eac

SHA256
7d4c7b40cd02d42fcb25c28efb9184ed4fe28feb2a230929d917508ebc8b4c61

SHA512
fddd0ba4c358600a6bd909416be9c53cbd284a9ca925b55d1b0ba1ee4460854853e8e258dc4a2ec56fda9facb3299b1b7a8fe95dbc9ad629ec0c06b248880d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
4a8d8c0fc39db39ec5c1652c4e5e3e4c

SHA1
dd050131210a1b7e65b3f056b162ad4179916d71

SHA256
7fb9336df56d928520770945bb5c58e1c605b9e26e03699b1f22cd0360650bd5

SHA512
5512fd7d8a006f46e331ee3e249e1e79b7fc018ec36807fa68d59fc9402d38a76e2002590931e60d2c7445771d1fd445f110d0069ec4e12eb8e2baa7e6354dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
158B

MD5
73e3618355bfdcaf041280a964caa638

SHA1
51962c05d79150c43f6ca8a9af4ca080b11e4ba0

SHA256
1029c80591e790dd3ac2f558103210c1327531c1bc4bcf7ed370ceedb44122ad

SHA512
7d0925c5b4692baa7463f42849225ebf18be66d3c580ae8addab33cdeb37def9f0e7d348e26f2856a873f6404131afa30869a8dd316d00cd7ed05eb62a310bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
274B

MD5
ebc898e9ed8b05981c49b0171598d5d7

SHA1
1b65dde71bb2a2fc5898315706ad18989b145158

SHA256
975b9b0aec8f13523776b0b6454a34080cb98ca46232dee8d4c2956c4ed6f86f

SHA512
2a986325378879f60ec9df4badff67bdb787690a2ee496657e6e0158ab390ab0e6be86027d3d6bb3e4d2518744e7625b8c204c3968fb7d8f084e164bff6edc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0

Filesize
215KB

MD5
e8518e1e0da2abd8a5d7f28760858c87

SHA1
d29d89b8a11ed64e67cbf726e2207f58bc87eead

SHA256
8b2c561b597399246b97f4f8d602f0354a979cbe4eea435d9dc65539f49cea64

SHA512
1c15b65bd6b998254cc6f3cbef179c266663f7b1c842229f79ff31ba30043837c398d85296fb20d3a576d9331fee9483ca0cbd06270da2d6db009bc454aee0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000148

Filesize
44KB

MD5
dd728a6292310ef9fe86bebc2c387238

SHA1
1feea95203ca41e1deb4af94a7a32cc43319084f

SHA256
4f822786ff5b42dce19e527fb8f38065ea5ba66ca75e96271ee770546f8c2785

SHA512
ce5a91d4f4fb5b912e221efcc1223787e16b594590395b3a8e5bd00a47058610a3b86e5d761a5ed80def837ebe4770983fb1437ab00d922972ab0ec7092868dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
fd2f1f4f478dfa8cad5c4746006a8ae3

SHA1
9aff154c632ddd0d2f1f0bbf84a01181e64c05dc

SHA256
053f8e7316bc4d5de8dfd202fa7174c9e01674711bcbca5f6b8bdeec7f05ad97

SHA512
5174dfffa882fb51ec2c375b65e58d5ca833dc1c9fe5b6b891a3cadf70d058656c6f2f035e281d7731878b36b25dad85a2b7768154e47429a14a4e733dc3b055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
4d02d5fdf5ab722c509b358a102eee4f

SHA1
526382c18933b0b721cbbdd1ab3983c5c2be9334

SHA256
3b232b3a9209e97a82a0e9188556510d63e6b9ec6dd3b407c45436c99ced38e0

SHA512
9dd31cd09b5e5c3489edb24928de3692a0cb924925016cfd55388c730054ded650045b5e9084dc33d38d13e988d240c922c3c39ae2fcd59c93e7fbfb6951d21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c119.TMP

Filesize
3KB

MD5
202ee8a7f3704b6c4fa4c3f16ccaaf00

SHA1
2bcfdd418cfb3b6d1ca1de3999eb3049ca08cfc2

SHA256
3854e3e351559c0db6df13ee6752bce13392ff94fe573eb7813dd8b665d91d3d

SHA512
d68c474ab6f019f25fb6066d10117024a99866ca987f0b3a2a402f63f77338a93e3720380bf6b5fac9506227e91817bdc214823731b6d52502d6139cf9874a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
77e269e6db299aef90553b82c870c553

SHA1
56c99779adcad4db5844bce432d49af5a048c05b

SHA256
65b81dd235a8adc3aae4a97961a37d0e2c522ab901b145a2f8445801914f2997

SHA512
ce00665b93f97c6f2b80e29b4c292d8fa45573a2f270449b4b51fee2d705f22fabd8625c74350bf1186594fb8651b92b7c164ba83784e1d7399a73feb7f83cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
18KB

MD5
0231d2812b4cc6b834e8f6a49d50efe9

SHA1
84e1aa2a1301e26b266cab659507e9afa21cbb54

SHA256
c7cce42a8bec816499ceb0e285a832df8feb41758fd31c62a53fc80f849d1083

SHA512
cc75ba9ada344d731e0f1a6c21c6ddc08e0b1c4a8e7e569185833fa1ecb68ee481b2658ed768c7abca499c77983ca249300ba65051974c212c332de84805d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
23KB

MD5
071187ae76b2235b58c2f053eeb2c1bf

SHA1
1887d57144a8a9d2883226df07d30f521d65679f

SHA256
e13c53e13c148d1d36032c22c8bc7501ac497cffa766730bb90484f558471204

SHA512
0f92f8fb887260f7fccb137f3f76afc0a058783b8596661eb8beca9d04cf8e7c7648d943509609e3b1f46863c3fa597b22501c48b3ee91b78b395a2954dec345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
1a6953c757201522ecb1556198718e39

SHA1
62f5547f2f37ec69b70a63ae76e2bc6bd0c6971e

SHA256
4eaad100bfe4a785de4bfb2e934df8887c84e9c5d198b02c5cd66996f771518d

SHA512
08f0140c59bda6f2a1079fb3083fe9c9fa55b2820478a48de00369b294f37e7e4ef87f634b793d2a9d36c68838a59aaae5a07c41016e8dcd9f14af98cfe77e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5e5dbe.TMP

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
24KB

MD5
3a491b0f8cf03a80fedffd6f99039ac0

SHA1
d2d49f929b00c77d2a21735de95fd4c90f9616e7

SHA256
1fba2bee2cc66b014a33cc00a1142e760b9a4eb0ef289524ce1ad112cd146d75

SHA512
d02402183a7c5a348161583c68c5951524c03164e56e240c90d1bcf2845b52dcc74e1f73a8e3b5365371c7cf3151b4c0f395d77bd711b73f61a0955e06f98326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
bb044724455097071e0e7064fbac174e

SHA1
e26c7e42de09a3ac7927115c68ea45dd4d6c24de

SHA256
bc4f6c04922feb3acee1a3eb739b6c2b1382256da1e6fab3843d39a3e4d27127

SHA512
4ebf8f328f0622288c8939b167eb7b1b60937ccb95641d30d12346c56d68573e24765a3549ea5cfe0ffc0269df85c7807616d8c7283f1d55c6bc0ba557c392c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
d1981517d4ca87b5cc20063cf1cb596d

SHA1
d42e31409c93197e0c4e741d263b0244caee0179

SHA256
8c097bb8715eac26c9b22e10e45831b5712e2b57bc94977c990ecc7ea848c9d5

SHA512
7728930885dd0402ef301a1f40197604bc787113e56dfbde96bebd832bd9a9c9fdd80ac97b8f8c64c31291cd15cb014c59efaf6f2adae7244d7b54d57145819b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
0cc1a1a07a1cd58a193e9f4a82e4feb7

SHA1
5e6365a79d21f63f77684c75fea1ef2c4ccaa2f6

SHA256
a8529eef92ca4b2821e92c96236dda7e441f1374f1dfd08b02c0484ffa380086

SHA512
bd73f537c317ab846439a520e4925756eda2f43a2ee85a705c6b6c5138bcd5a0bc0272dee99eb0e2ea375cffd9bc534ce5091b06b0e55fae36466bae36bb5353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
dd3bce52594f1f4b6ef6d78b4a8ffcd7

SHA1
9ecf180ef0c60776a531c9dd821c8a6b44bb6c9f

SHA256
21fc4a843d5c21e132d3fbd97b93d39e0854c575239139efa75e6484a9c3c717

SHA512
976f2ecf05527fce1f89721f082e7c2019f43c55090af3207d416f01ff36154ca2b6c34ee2561cfd6754fcd04a86b523df9993c150ad3f36f3da8abc39c9c82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
25KB

MD5
42c93e5884af7a12bbbb4bf617065e40

SHA1
39910b36e5cfc152765c1142e62aabde618ca49d

SHA256
1c7f72a2e62e4d8b567a2fe8142919228e399286b8be95d6f728374e084d6f20

SHA512
88621e5c29927257ed9e29567a0d6339962a599ae84ecdbcd2083f7734ce98a81b86f414305b7499f595221ce93827fd432069e3a2b4d293ced8736b71cce8a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
e35b0b9bd2f38bba180442de9acebe8a

SHA1
29f80198acc7809a7d1294e37f0373156a1d87c8

SHA256
9aa557d843ca3f767dddad93a7950d274c1c494c8231dbe570197e26f1b33fd4

SHA512
1bd5fe124134e8480bc185f6cf4283cddde9575dd792a8fbabf84924b7f6e4944ab1e07d35cf2ba77409cea79e119764480f4ffacf57f422f98baf968669f6ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
6d4fb4ffe55be4d0d295427b1c9acb9a

SHA1
cc680041d607260906805d663e74c14e6b2fc75d

SHA256
fe9e17ead27bef4af9d6a226004745c2a51ed15a63a9d89187f9c483a6b5edde

SHA512
009f8c2353391b7eaae293799e199d6391311ffe4bbc5ca6f348da6a659bdb11cfda1a070f5467a9637eb5acc5e854018dd4c14bebb126bc4ced2b935d13bb90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
c3c11fb12623adcbe95c483f9e9e72ee

SHA1
0c6a609732117efac3456c684f9d09719f19f9f0

SHA256
0e980466c740faf921909024ab488ff8ba883e700b1581a329b22278dfe413fe

SHA512
7979c8bdb66853ebb12edcd8e07e59bf02fdd1c81ef6e06362282a54ce921589b000cdba64a9750d7587fbdcdd4fa2c828c9054758b1119f3300090826bb9a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index

Filesize
840B

MD5
ad8288be9de1b84b246b66e285f39e57

SHA1
347ac3f6346fec0c94e715c5b6442169b054d604

SHA256
a4a924de3426a9b1a169950dc8e368560e234539adb1592f6f1f6abd19732f06

SHA512
233a7d852e959d2c81b039e59042ae63a83c4057d830710e7a1bb1739bbe3ce5d85f0f5436fde95fd43a9f35d97ceaf71d524c85e896f116a845e0bf0b40d294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index~RFe5be9b1.TMP

Filesize
864B

MD5
eeeaa47de54de94b0e99930dfe57290e

SHA1
45b35ffab0fd28653d7d6662cfe934a8a6da6e97

SHA256
595a38de18a9489b2597b3145e87cb3dc63e2ca3ace5b71525fc235a3bd1d3b1

SHA512
d11cd8d91fe45084795568d815c68f4b68110a158b1d8daa4c4f5847550f2ee2b0dd0d63d2d1435ed4930ad37ccba48fa46ef1b68ce572195c4a9ce16e265453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
fa0c1b517a0db858f7dff3cbb72f20af

SHA1
b584a6f17a563962f760287f87ec417d5750a1e7

SHA256
5c477146ecda8ad8c4bd8ca8fc8b43b6fa55e716e630ee9a9f34b300827a6b57

SHA512
5aefc055d1c3af875d8e17594c9aaae3cbb6cefe5ee8a0be11f0e48282825f589885fc0f56050e48ee2f830bcc82eb0809fc643307adb3bf32e2fc12aa17b612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
152KB

MD5
aeb52767b5e39fa76d1ce0e6a3ee5b35

SHA1
59bb5dabf4a831b8d8b2484f123aaaa9ae525555

SHA256
d4b77a8c2cfb5d191bcf200cc27bf1dd9f1864eb6f40545985757d4e9c7f1a98

SHA512
25a6c94b787627a1895aa2da04e2429e77a08081bfe669a13d6b2a1900bb78edbdb412cba0dfbdc59e86cede11bfbcc30c446c0e8e91c9326557f8fcc91ffb4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
28d330c8c47a3b1de5641188db11e5ed

SHA1
346c91d111b0fcdeb705fcf237a445758cdc218a

SHA256
6bebb4b82d58e5e4dd780609b4f488432179f3c6fa6b4ee2a9fa8f9109069694

SHA512
c2b6c905ef430ad4f9374f789e7ea26a1be35cf3ee9a660a0307c272b3d0235fe706b387c9ec4bf899bf396bb47efcafab6c3534e53c319a3f45f68265a50f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e77dd.TMP

Filesize
48B

MD5
7ec84bd39670874017dc2709642fdec0

SHA1
c7ca731ff07bba1481aa8fd3ead1321d26608049

SHA256
b1b8b6ab8704afa6451f7f6c6b835d53fff69b32514069606008f3b586af47b2

SHA512
3e7489b522e30560a30e68877fa524fb6861321e75b849efdb1d7bd13fdde513802e5a5bdcd1653b337652fd57b474c8f51b0ad810b6e5ab9703018bdf5f1291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
9cfebd2bd3ade82b0c6871548959a9aa

SHA1
0f40698d94d9b332ea3d37119dbd2f0186bdf4fb

SHA256
f368b420779eaf34dbe47ec359501c9363627a9cbcc419b691af5f5f19835a0b

SHA512
92f018a1072612e50b50325e10e23292cbe129096d94216b51b1d2bd7ac0170aa80bdf38770a4d91a24cd328424f747aaa9eeafd39b9c316b33a093e03c0d35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
c67ba14bf678a1769d56279648076234

SHA1
d6c505f538f6e7f38223924563cbaf2cec4db721

SHA256
18f09426d7681fcff879bfc18c28737c1d6fa4a2481c9523d28b4032a7977f06

SHA512
2edb280f36bb7fe350becfd449075aad4ca79aaa4086d986de3472333aae63715cb3f51b112fc1eea1f1d2d1422a10fe7f47e3fc51777be3fd2680fa68fffe4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
abb75878a522fee9359229037d686c6f

SHA1
37d82319171ca59780f70ff3d0da450acd9c6f22

SHA256
cebe24ea70821c3e529b04330fdf3c44b55ddfd332beb74f70fe0a2fb91dad89

SHA512
cede44909b5a442e1c6628e7c780b3097c1619ab9b49ab5f8c4c76d27072bc0daac14e69bf729eb7d616574b1bbe4c1509359c051d71d47e8d1acbbe11c49a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5837a5.TMP

Filesize
467B

MD5
bdea8b6ca24dcd1945ba026f5c13f06c

SHA1
99e043e429470860496fb397dd184cc86f0a5a13

SHA256
4a5d3fad413e9e2711e42e846da5f7c411f8f01c40e495e66e60bcc65834cb34

SHA512
27b189a9419c75e4da7ae6632007b3b9bf8fcb18899985e0067e20102c3c90b01abac3e8e8780ada503834900e74384ac70a78ffa363031a8592819613cf7685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
21KB

MD5
97ffbea42e9a0795865f12dedaa14292

SHA1
82b1a9a09d849ca8e55914ceb05677991729de10

SHA256
84db83a7515ea99283ea322d6ae8a7e806287e7e98771a53a5d0e3ff362ecd16

SHA512
884e56e3e7419a5ce22725d8b39b6d9424c882185762fe6ebb3a5c67d65e87b846ecce8a26491019acd3ba79641f489a32e20e2c7b99576315352cca1f5a13a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5838be.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
87e1e1f4d1aece0ca9f0d09828f9c2d9

SHA1
e5c8c1534646b6e3a746849f4cfd4289f4212982

SHA256
76ee3bc03d36f947518112afed66fa4d53670e67fbb520df79ea16ddbf111371

SHA512
2b6774842f2bd00df0911476698d2137364ee4094b96ca7f5ba6c9c285aff9b536a0b37f78c6b2ee9bb50d46edfc7ab25ea149be5706553aaf3bf5b60ee9e780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
1df3018294b1f1991cf4809d1eeedb02

SHA1
fb7f5e644ed1b9c548af2371f80c13192ea6db36

SHA256
d44602e59455398295962fd51f320e3daf25fa7379c45dc01e8a53ae13549019

SHA512
8df1cdeda4eb515be3b4b0dedd7094d2df8309b5c6bc75930d1c3228d265c5e9ea109c97620b6950acb1677a8ee0dfe5c64bf82a304d84053e96b4cc401e8ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
16cab8c839cbc1d5ab15c041d390c35a

SHA1
dbae7eddd8b60d3157e65a54f1b28ecb718fc130

SHA256
14176091ca91e3a5dfc371951cd3a47a2b597baf97c2505c51d6833b816fa4de

SHA512
9bc695d799ed5b2736ac5cda09287f03c2e8a1a1e2b4e8b42ea659328389e6d96ffe752fbe8a67ff4fecf8534515f2260a515921109778819b4c5e04fd2c9c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
e7e11940a377af80f198749d561126c6

SHA1
8cf490b5cc0e6fff59275dfe87764c5037e51d3d

SHA256
08df54cb6746ad19d78e9f2c5c10194c63cfca5217001b2e14d5dd44116f5409

SHA512
43cfc03ed0ac5fe4f9f4a471c61f2189117780bd155303b6afc56ac7214c6689f3092d993873d8ed148204ec5e5ed1695012efc47d603998819272402606515b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
7e967ee87377d9c6416bf91ddbfe7747

SHA1
9a24cd4af711e8cdaad447dce0f838ed3e583967

SHA256
c8714847b39e17da36a97b4a9125de9aca4be7b0d50155916d53889f953c9ad2

SHA512
dfa61991dde84eead69f22cb04236d1ea9680bd2495aa1f3ea91f04cbf74c09c223393985e954c4d8e82cf1e04bea20665b7dc27fe9b1678fce2ed593d0936b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f84570e6bf303801407edf90d713e49d

SHA1
5a1b53aa721687dd0cc676b27c8b9e082d376ef5

SHA256
79215b00e29e0fc0f63bfcac4f82a6a034ebe1601f43d742d26668f3907504c0

SHA512
f3a5ab6bfb997b8c080dd25209112f11165f892754f67994f71251211f36ba7661b3c9a0ef877cce4395f07a859d73139821d38cfb41292c2e3742a60640fd0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
acb45b588ebb870af76f29d7a52b4323

SHA1
225b5b2fbcb8d2649174b30ef2368eba94282bde

SHA256
78b7203b8ff9113bfad24dd727fbabea3bcd9f0a36d1bc6203e52dba2bc03cde

SHA512
20efc4637a3e71eff87abfeb864fe30e9a1493377b6c14c73b206039686e8826a550faefb458a904375a7f2ad056a33d7c9f070c8f5ddad0450209ba433a06c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
49bee850fdc836e80922dd50514ccb72

SHA1
27e535769c4f2bd2a2895134f5e3446e2a52885d

SHA256
66da58d9778c3a9e757f97eb9487c5002cf5fae4e303550c84905994d077bde8

SHA512
9f7f545e99a2a971226bf0067ce45afed2bc5657520e11dab5259b7c265d298e1f24ffc1e09e27feee73e3e7f365cb5c217195694c00d23c4f7d01d6e29a55bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
983f51b0a5f60f071099e73f2e58fa71

SHA1
1e7bdbfbd5b866f6bd6fc5b3dc0d56a5f4a64146

SHA256
8455d54f1d841467761f2a463ed6a0759d55d1ed3848a3386055100d0cf2b915

SHA512
c58f361d70cfd71cda2076fe6a99538cfe23656e9cd081ff655b685819aa2f488785abe4631c50ede508bd155e944a359bb29065493689e3343e5c440d3eceac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
dd1e567bebea3cef6957c6b8594bcd62

SHA1
f82b6665f41d64893186a6b416340dd03c7439f3

SHA256
3e20c5831bcd2a4b212abdeb914c3caf73d98d48839477bade832fb622404eef

SHA512
3bf08be5f553f6d532cd508c0d9c9f0e63a4878309a9dcd5de06db37097917409024bb4d26d8fc1108fdd4921be52589ba73e3ef9cbd7a972f0f555b32cee607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
3b350b2c2e3ddaa67b9b3f85dbc140ec

SHA1
edc3eafa9b86ede7b990a212159d8a5bf2e219ae

SHA256
72749f660ff7cc174cc4b0f2643d02b587e98e4a53667c8e7f231e8ad32c7e23

SHA512
bb8666d6e49d510e2a78ec3cd514a726e8298e0f41b59c204a8258214f379038182a028cd296cf4a7c9505e4a997452badf5f19fedb9f23621ae3c4f73b18873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
314e19283054701bf1280e65d165146d

SHA1
b081aad98b29c1805baf38478d1767d5ad3d59e1

SHA256
79db1657683ccf58172b68b9df3f4ea78c0797068ac31f752385b4264d521b6f

SHA512
ca5547319ec3c6c3ad1cb58824a1a1cef2846f2d3ca0f6831d5524211600d86a1ed54188aceda4dbc2ac6bfb977bc4db72c7939e054f502887a0332a7ad794cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
800a0d607aa41ed27a55df1e758081f5

SHA1
81a0acb090756e107a70df5acc64308d637339da

SHA256
1c14664effa30b1c21f520fad01979b5072c54622bf3ec441213543bd2406062

SHA512
6e769834f9944351de5e729b1c95d11833a6d0b3b84089cb7fb0ece7c2b33bec23a658760e4332f8391bfbf8fd50595e5ce9617cea533801e696288a472cc21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
eab24c314da4bfab8bf6c972f3d61867

SHA1
ea53678571f496f05525ad0a096a5ca321a21ba1

SHA256
1f4958f5e01d2685dc42c4304541bf1a662d08bba1a89b4260abb5a73aa681ed

SHA512
3e242c65f63249be5d3251fea1e167264bc1881d931aaefe4d4a08822a8ca0ca9921773557c3e9041a45b09f9031c16453e2a7b3e09b693b2936cede1fb018c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
ad097520a94edfb99bb795e9d9f07f2e

SHA1
711c52c82ed24da12f7a5f601f9d59e96b7305f1

SHA256
cb0f547d820514cbf153c7121fb51dbc23060909a7d5d44d5cc10a4f0050b559

SHA512
a136550af673059f57e52741094c2eae9f26f9cacbbe7b5e13d72591abec062ce0a2b5c869e94f58f9507472c7a56208c26bcd712064ab5cbc12ecf6e812ebc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
93aa43a39982dd4749186d46862f3fbe

SHA1
bd05e33814787578d5b98cca0d3a787c02e6c82f

SHA256
6969e3301203fe88311fd66f471ab11b6bb198071fc22648f0a7043e4a12cf99

SHA512
500e7b14e355fa46b330a6cd8c164d0f90518a2f4c292608beeebcd004a359aae916a28096ca509c42e11608bb0a752936cee044e5739616ad7a97998402f3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5ad398ee4c8fcea81fba80be43bbde6f

SHA1
c89e5563d92c1262d3525f1fc0a2b0378c193d8b

SHA256
b833a349e5ad5a9b98792e4727a2b34c07e55d89d3ab45526bf14be32edab09b

SHA512
e99108fded9425f8971391e2efa86efdce8078723e35486aebf63f301d4605beab666da80a1bb676d24c83e95b41468d396e550534408cf9e61085974464395f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f7334ef7d7aa64a0ef2fcef02f9f1822

SHA1
bb7db1524793da0e32d6234f00b46e03b4bcdffb

SHA256
912786b9665181e452aea9982692402077fe99e28ac83a25152b705598c56ee0

SHA512
0da20c9cd0073d613797c42087df8a80bfa03e8dfc64883a834e33b054be55cb9b1462deaefa7b17a4c1481bbf7ee5e5a6d0aceca5a378da60d8428adf80cb80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57aba1.TMP

Filesize
392B

MD5
2d9a0e2cb0a495ce278f9f9557a48e87

SHA1
b0058530683df23cb1b64a7e6c43365a2638f35d

SHA256
1637d0cabdd1369c729edd4e43857ec582f96d060618d8bdaaf1341619f3ff29

SHA512
e66076ef0058b34ca8abd4db0dfd337fe0a6b58edaeaf4b8a21caa3132bddf199126dbcd05afb54b85c0f1cb1c0abf25f3b044a14fa867df901930907dc27662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\76eac421-0d5f-4ee0-9d2a-348191b6533a.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
17KB

MD5
692b0478126091a9835f9c5382922baa

SHA1
2cc192abef2b5d63ab6dbf254fbb451358ff4f95

SHA256
7a0418c0cb90e86e86bd3a082c71d9b4810d837b8e00e2a6078d49127e34252f

SHA512
a45c7cc237074ff0be7791e8ef48d6c49c6bdff5a7142232e4d7f44f0eeabd14cb898a58657467fd1d89f0434a5eaa4357d5341208a15867e3cd97e7676c6f53

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
8KB

MD5
e5a0d3fa01da4e0395363d7397db2b0d

SHA1
8df9f891ec2b5207d3a25e5f096f97dd5c2a6abb

SHA256
6137bf187c7ff79ff3534616dd393591f79d623b2f283af906c0cccc1e285b46

SHA512
626e1b0b39c7ad5f248a7ccce66771ea8cb34a22399319d1dd083cbf49b01a84956539429ad7ab1e5c25cce566213ff917fe57b974652e3f1cf8792e9c294ff2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
25KB

MD5
69f6a6cb5ab00c9f33055afa4460112c

SHA1
5851adba1d4d925739d2f159ab4ff5b314dbf4be

SHA256
e1eab927a45a7107181c72c1703fc0f731486439d9ffbff6e9f37a55abb8d1a0

SHA512
5ccdb73c29dd5bb4d8c634998a933d305ff836dc43036de9807861d9053e6739a0a06f2d2f88f76a261550b0d2587825cf66ceaba1399c513641c15df894b327

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
6KB

MD5
b0da2febc9b255183dad268c671b8e66

SHA1
4df62c4fda6ccbeeb8ea9f9f68c0755abe2d381b

SHA256
639697417879bfedd12070eb5649274cc184e47fb91b33a74751a8f83ee6349e

SHA512
107d7465d904b2190389078b278ea83c605e1863bf3ed954a20f5ee7e88f8c407a9b2f8b37b8294939b09788d7250eb7c63b337fc46309e899615a9211a1309b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133874921462063780.txt

Filesize
82KB

MD5
c380934ecc1abb4c438e83a6931bb860

SHA1
7b88b5765a6877a3e4b527c068042a814b5ef158

SHA256
bcfeff0a747e3c3d1a7523ac9945fccbaf4ce60299e9a290d0fe0a2a0f6e3e26

SHA512
bd511be617aaea39d86d02275dd8d5d80e0dfc4de17c43de571c8f4cabbce931f862f0328cc41aa74e688669559808c32a9e78d1715b2e5268f3547054eafed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3fd0da98-439d-4483-9a6f-7d711c658c29.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_chuiq2f5.rdl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4d5e6fc-fb80-4a72-a263-8f17209fe727.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_62194174\ba443016-b6ca-49ea-af37-ffd15cd2b736.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9b9cdc69c1c24e2b.automaticDestinations-ms

Filesize
1KB

MD5
aa96bd8cf375686ef8840c93b86a29e3

SHA1
e89b04216a82b54543903e57d8f69492d45528a3

SHA256
07c94307e5389334994b971fd5fe759349bf90535983897a88f6ab050181b8e7

SHA512
91ad92f9b04dc690f65918c1db2191da29557280d833d3c465b612790e6f6d651cdd79ca3bc16bc06d588b3b791096c714e46a16576266ca88c2fcf97528bf2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
91b1e1e35f8e47b81590c2a238ae8edd

SHA1
330c06b71079feec2e7ca2bcecf04b5852e346fc

SHA256
aaffcb8764e90f6c90cf39bb115707957bc71e92f26772c8eaa910ae1b576fd4

SHA512
04bcd5c3ff9546057f7439dc895671e71fbb60c60442cdc9e65b3b5a26cf6b7ba96d81c8d67cc8873c23188abb2d660d7fc32beda7ee6e03a14f7d7a5ce6bdfe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
6c8b4b035244fcac6735dfca06c28248

SHA1
aace89df421228ee2b7f8be05b23329f24811410

SHA256
0c73055a732a707876f34c7dffb9d6f94307bec2f176bde4644c2dc133890c00

SHA512
687bcb18d5372e2c4856114832f5504c74f3882214688e1114574f6b0ac0eceb7338abe7ac22fa51e1eaa570c4cbeb31f2c18079222a69d33dd9d14b18889d6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
10KB

MD5
862a42b59e911b2b66e3ac3627864d46

SHA1
67781a8b16e9733d1607e5fa097b260483ebc829

SHA256
b539271ed515e23c7a71cb80222c23ee63d11d6dd4fef15f57925bbefadb22d5

SHA512
0955fea0769b31071174a83287a67b0fcad93283d4b1eaba13675a04e84aef7d7e3e511dd027a064a8becfe6650ea2d80049fca5c53f4ee371f8d9d5ea08b4dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
37fb0e5d37e1d926c2fdfc53e7eeedb1

SHA1
4626da0f4417a2ed5f08584195093778d7d29fde

SHA256
6767dedb10366d8ae123cfd8d9007fbb9a0a43bf0bacc486e8eb19662572006c

SHA512
676acb7f96cb1fe621dd4d607f2f7a040bae279c3c0a9490855d8be29ca17cc5372124355f260412bfc3f68b9e9a9965872c5f2ee029dfa565c241a23a7d6dc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
9KB

MD5
096f33e57be2187342980807caea6abc

SHA1
3bbea547c1bba993cc56753da0695ca2647f82fe

SHA256
32981eff74cc12fcbe5fa2d0eb4116bc012aee1b7896622ba7fed261a18503df

SHA512
3848a0af86545ec4157b2759859437d9f5ca9545e3903ebfb0e454a2a4e4dc5a08033c44aff0bb280bb76644e8f2e490e8b6604f6c84b82f4a66a1a1960c5c2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
b330833b752b5757b4a4e5c7875d549f

SHA1
e7e7a7b0b5f3af19342202c44758c6bcafd09832

SHA256
0db5bee2b6af3266f9fd3121236c8314997aa5b5d54a0d038120d7975c5cde81

SHA512
03346d29aa430787b6314ae0041608f50d7c818930a55a3c22cd0cb9da83a51f4fe7013e3aa7040009f0b9e8604d567da4164e4d8982a262ad94a85d79d9468b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
bf2cdba8bb5ec652e95abc04195eecd8

SHA1
5d67efa3bc27cee430828ec5968a7d81126c5cca

SHA256
bc49c54dafa74b9f69754b1388e05882be07bd73e21642ba9311b86f136acdeb

SHA512
e49f29350eddb60cd48b39caff3912bb30cf9e712c9ebdc627a61d0fa9afb39cc81f4c0398f2294ff52f77fe6e2aee80d5436e2f290a09f674539423e75a158c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
e770d6dba2a18c3880e84ad07c10d326

SHA1
c08bcc2bddb7477ffe153317fb9d89cc0a8ae13e

SHA256
084dabca773523ff5e668759436bcc21df117343ed13cee07bfc44901ff250fd

SHA512
81c5cd910f800df86cd993c78021f82d1b1eee0e7a2a292922fa41bccb4bc14ae0f9ef03ccaa99b510c9d02b951c97e9fd29e31c5d280f6a0af4b956f05a1cc6

Download Submit
C:\Users\Admin\Downloads\SKI-Games4u.Org\Hello Kitty Island Adventure\user\config\qt-config.ini

Filesize
65KB

MD5
158a6cb010612d89bd91813e70ab94ad

SHA1
c3f2602be147bd7aacc1a75c41a65c59419eb64e

SHA256
f067187132fd491a097aaea1da56a4ae33591b565448debf6e87b056357be182

SHA512
1744a723db5d522ef2827812dcaf298a2f7e34639aeed3f8bedfd73457f02d69f9b37ffbd3908a022e2c9a88ee40fd7a88918441861bcbca6676c4eb7665572a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_104805548\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1340066514\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1360218599\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1448513403\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1543980861\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1681922715\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_176237005\manifest.json

Filesize
135B

MD5
4055ba4ebd5546fb6306d6a3151a236a

SHA1
609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

SHA256
cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

SHA512
58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_1896043326\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2025999740\manifest.json

Filesize
119B

MD5
f3eb631411fea6b5f0f0d369e1236cb3

SHA1
8366d7cddf1c1ab8ba541e884475697e7028b4e0

SHA256
ebbc79d0fccf58eeaeee58e3acbd3b327c06b5b62fc83ef0128804b00a7025d0

SHA512
4830e03d643b0474726ef93ad379814f4b54471e882c1aec5be17a0147f04cfbe031f8d74960a80be6b6491d3427eca3f06bc88cc06740c2ad4eb08e4d3e4338

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_2069858868\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_603596019\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_613067725\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2628_894976183\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
memory/1108-2022-0x000001FFFC5F0000-0x000001FFFC610000-memory.dmp

Filesize
128KB

Download
memory/1108-1907-0x000001FFC90B0000-0x000001FFC91B0000-memory.dmp

Filesize
1024KB

Download
memory/1108-1908-0x000001FFC90B0000-0x000001FFC91B0000-memory.dmp

Filesize
1024KB

Download
memory/1108-1991-0x000001FFEB010000-0x000001FFEB030000-memory.dmp

Filesize
128KB

Download
memory/1108-1993-0x000001FFFCC00000-0x000001FFFCD00000-memory.dmp

Filesize
1024KB

Download
memory/1108-2121-0x000001F780E30000-0x000001F780F30000-memory.dmp

Filesize
1024KB

Download
memory/1108-2126-0x000001F780E30000-0x000001F780F30000-memory.dmp

Filesize
1024KB

Download
memory/1108-4998-0x000001F7806C0000-0x000001F7806E0000-memory.dmp

Filesize
128KB

Download
memory/1128-3034-0x000002E97F580000-0x000002E97F5A2000-memory.dmp

Filesize
136KB

Download
memory/3176-2999-0x00007FF8CA670000-0x00007FF8CB670000-memory.dmp

Filesize
16.0MB

Download
memory/3176-2994-0x00007FF8F1CB0000-0x00007FF8F22E6000-memory.dmp

Filesize
6.2MB

Download
memory/3176-3000-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/3176-2998-0x00007FF8EFAA0000-0x00007FF8F00A2000-memory.dmp

Filesize
6.0MB

Download
memory/3176-2995-0x00007FF8EFAA0000-0x00007FF8F00A2000-memory.dmp

Filesize
6.0MB

Download
memory/3176-2996-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/3800-3070-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4676-3558-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/4676-3553-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/4676-3554-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/4676-3552-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download
memory/4676-3556-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5124-3565-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5124-3566-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download
memory/5124-3567-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5272-4574-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4573-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4565-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4566-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4567-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4577-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4576-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4575-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4571-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5272-4572-0x000001A7A6E00000-0x000001A7A6E01000-memory.dmp

Filesize
4KB

Download
memory/5368-2985-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5472-2988-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5472-2987-0x00007FF8EFAA0000-0x00007FF8F00A2000-memory.dmp

Filesize
6.0MB

Download
memory/5472-2986-0x00007FF8F1CB0000-0x00007FF8F22E6000-memory.dmp

Filesize
6.2MB

Download
memory/5472-2989-0x00007FF8EFAA0000-0x00007FF8F00A2000-memory.dmp

Filesize
6.0MB

Download
memory/5472-2990-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5864-3573-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5864-3572-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download
memory/5864-3574-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5900-3078-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5900-3077-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download
memory/5900-3079-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5904-3072-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download
memory/5904-3071-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5904-3073-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5952-3544-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5952-3546-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5952-3542-0x00007FF8F1CE0000-0x00007FF8F22E2000-memory.dmp

Filesize
6.0MB

Download
memory/5952-3548-0x00007FF726720000-0x00007FF728345000-memory.dmp

Filesize
28.1MB

Download
memory/5952-3543-0x00007FF8F16A0000-0x00007FF8F1CD6000-memory.dmp

Filesize
6.2MB

Download