lumma | 6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe
Size

736KB
MD5

18e5e760b807fc2b05172215540398b3
SHA1

6a1b4d3227088473c45869469b68a1737b26b90d
SHA256

6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd
SHA512

23430597753696466eea1c54337b1d37a734918433be2e0637aaf022c0ef09d5f8b04a3793ccb1a296bb83d13fda832d677cb926730653d78b0833f96737fa04
SSDEEP

12288:oaQ9+ICJkAp0mBpehM8ppy+E4J/aDQy5b4WeZGl/GtWV3OnP3cqXoi8TMkoleH5/:cw4GBpehMjcuP5b4FtyU/oiwMTleHKLu

Score

10^/10

lumma stealc vidar 928af183c2a2807a3c0526e8c0c9369d default credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://77.90.153.241

Attributes

url_path
/612acd258782ade8.php

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

lumma

https://wxayfarer.live/ALosnz

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://skynetxc.live/AksoPA

https://pixtreev.run/LkaUz

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://70sparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

Signatures

Detect Vidar Stealer 32 IoCs

stealer

resource	yara_rule
behavioral2/memory/5140-762-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-763-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-798-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-809-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-814-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-815-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-818-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-822-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-823-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-824-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-828-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-860-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-998-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1165-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1166-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1169-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1170-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1174-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1178-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1179-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1189-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1296-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1300-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1318-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1312-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1321-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1322-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1323-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1324-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1325-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1326-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5140-1331-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 17 IoCs

flow	pid	Process
382	5140	MSBuild.exe
382	5140	MSBuild.exe
533	5164	MSBuild.exe
533	5164	MSBuild.exe
533	5164	MSBuild.exe
533	5164	MSBuild.exe
533	5164	MSBuild.exe
533	5164	MSBuild.exe
541	5164	MSBuild.exe
159	5184	MSBuild.exe
159	5184	MSBuild.exe
159	5184	MSBuild.exe
159	5184	MSBuild.exe
159	5184	MSBuild.exe
159	5184	MSBuild.exe
165	5184	MSBuild.exe
165	5184	MSBuild.exe

Uses browser remote debugging 2 TTPs 25 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4700	chrome.exe
2300	chrome.exe
868	chrome.exe
12704	chrome.exe
19252	chrome.exe
9096	msedge.exe
8548	msedge.exe
3456	chrome.exe
2188	msedge.exe
5864	chrome.exe
15864	chrome.exe
16940	msedge.exe
9116	msedge.exe
5724	chrome.exe
632	chrome.exe
7456	chrome.exe
18696	chrome.exe
14032	chrome.exe
18604	chrome.exe
8532	msedge.exe
1952	msedge.exe
2512	msedge.exe
17840	msedge.exe
17852	msedge.exe
17356	chrome.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	WsMzwhKWWh0A50GU.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	177wGYOuyJPIdxGX.exe

Executes dropped EXE 22 IoCs

pid	Process
5904	AEGHJKJKKJ.exe
1928	JKEGIDGDGH.exe
5040	CBKJEGCBKK.exe
6120	WsMzwhKWWh0A50GU.exe
4472	177wGYOuyJPIdxGX.exe
7624	WsMzwhKWWh0A50GU.exe
7664	zmuBPmlTa1MfFIS5.exe
16060	gmX7tDSz2TnmvORs.exe
16640	wlxlfkfukf.exe
12184	v37q9r1no8.exe
17524	zm7gdb168q.exe
12180	4sWFSCPd0Eatai7m.exe
12104	fTsYJWqNMUdLTFKH.exe
36208	lgjTp4LafuoI3sx2.exe
34484	okCYtWbSuG3OJQrS.exe
36700	Op4QNzrdVJR2sQEG.exe
34168	jB6LQZcLNBzyqK4T.exe
34456	KECBGCGCGI.exe
36688	GIJJKFCGDG.exe
8828	CAEHDBAAEC.exe
8964	mGjiRF6hwcDWTCde.exe
8660	PRe4mbzoCvImhwY7.exe

Loads dropped DLL 4 IoCs

pid	Process
5184	MSBuild.exe
5184	MSBuild.exe
5164	MSBuild.exe
5164	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\P3TD4oUu\\WsMzwhKWWh0A50GU.exe"	WsMzwhKWWh0A50GU.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 5904 set thread context of 5140	5904	AEGHJKJKKJ.exe	129
PID 1928 set thread context of 60	1928	JKEGIDGDGH.exe	134
PID 16640 set thread context of 18860	16640	wlxlfkfukf.exe	182
PID 12184 set thread context of 5164	12184	v37q9r1no8.exe	185
PID 34456 set thread context of 36192	34456	KECBGCGCGI.exe	239
PID 36688 set thread context of 9068	36688	GIJJKFCGDG.exe	243

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
18768	6120	WerFault.exe	138
10060	4472	WerFault.exe	139
28104	12180	WerFault.exe	187
28148	12104	WerFault.exe	188
30156	16060	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fTsYJWqNMUdLTFKH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	okCYtWbSuG3OJQrS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mGjiRF6hwcDWTCde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WsMzwhKWWh0A50GU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4sWFSCPd0Eatai7m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jB6LQZcLNBzyqK4T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgjTp4LafuoI3sx2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	177wGYOuyJPIdxGX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WsMzwhKWWh0A50GU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBKJEGCBKK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gmX7tDSz2TnmvORs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zmuBPmlTa1MfFIS5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PRe4mbzoCvImhwY7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zm7gdb168q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Op4QNzrdVJR2sQEG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAEHDBAAEC.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
16784	timeout.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877507154841700"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
4700	chrome.exe
4700	chrome.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
5184	MSBuild.exe
60	MSBuild.exe
60	MSBuild.exe
60	MSBuild.exe
60	MSBuild.exe
6120	WsMzwhKWWh0A50GU.exe
6120	WsMzwhKWWh0A50GU.exe
4472	177wGYOuyJPIdxGX.exe
4472	177wGYOuyJPIdxGX.exe
4472	177wGYOuyJPIdxGX.exe
4472	177wGYOuyJPIdxGX.exe
5140	MSBuild.exe
5140	MSBuild.exe
7624	WsMzwhKWWh0A50GU.exe
7624	WsMzwhKWWh0A50GU.exe
7624	WsMzwhKWWh0A50GU.exe
7624	WsMzwhKWWh0A50GU.exe
7664	zmuBPmlTa1MfFIS5.exe
7664	zmuBPmlTa1MfFIS5.exe
5140	MSBuild.exe
5140	MSBuild.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
5140	MSBuild.exe
16060	gmX7tDSz2TnmvORs.exe
16060	gmX7tDSz2TnmvORs.exe
16060	gmX7tDSz2TnmvORs.exe
16060	gmX7tDSz2TnmvORs.exe
16060	gmX7tDSz2TnmvORs.exe
16060	gmX7tDSz2TnmvORs.exe
18860	MSBuild.exe
18860	MSBuild.exe
18860	MSBuild.exe
18860	MSBuild.exe
5164	MSBuild.exe
5164	MSBuild.exe
12180	4sWFSCPd0Eatai7m.exe
12180	4sWFSCPd0Eatai7m.exe
12104	fTsYJWqNMUdLTFKH.exe
12104	fTsYJWqNMUdLTFKH.exe
12104	fTsYJWqNMUdLTFKH.exe
12104	fTsYJWqNMUdLTFKH.exe
5164	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
1952	msedge.exe
1952	msedge.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
16940	msedge.exe
16940	msedge.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
9096	msedge.exe
9096	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	7456	chrome.exe
Token: SeCreatePagefilePrivilege	7456	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe
Token: SeShutdownPrivilege	14032	chrome.exe
Token: SeCreatePagefilePrivilege	14032	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
1952	msedge.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
7456	chrome.exe
16940	msedge.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe
14032	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 2884 wrote to memory of 5184	2884	2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe	88
PID 5184 wrote to memory of 4700	5184	MSBuild.exe	93
PID 5184 wrote to memory of 4700	5184	MSBuild.exe	93
PID 4700 wrote to memory of 4764	4700	chrome.exe	94
PID 4700 wrote to memory of 4764	4700	chrome.exe	94
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 876	4700	chrome.exe	95
PID 4700 wrote to memory of 876	4700	chrome.exe	95
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 3636	4700	chrome.exe	96
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97
PID 4700 wrote to memory of 2096	4700	chrome.exe	97

C:\Users\Admin\AppData\Local\Temp\2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-29_18e5e760b807fc2b05172215540398b3_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98144dcf8,0x7ff98144dd04,0x7ff98144dd10
      4⤵
      PID:4764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1984,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2040,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:3636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2388,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2396 /prefetch:8
      4⤵
      PID:2096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4048,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1660 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4372,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5260,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5284,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5340,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5632 /prefetch:8
      4⤵
      PID:3116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5716,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:3620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5400,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5676 /prefetch:8
      4⤵
      PID:3684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5392,i,7978192714593414142,16901278045591216544,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5712 /prefetch:8
      4⤵
      PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff98206f208,0x7ff98206f214,0x7ff98206f220
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1964,i,15537343230666003477,12968166388440034831,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,15537343230666003477,12968166388440034831,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1900,i,15537343230666003477,12968166388440034831,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3528,i,15537343230666003477,12968166388440034831,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,15537343230666003477,12968166388440034831,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AEGHJKJKKJ.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:100
  - - C:\Users\Admin\AEGHJKJKKJ.exe
      "C:\Users\Admin\AEGHJKJKKJ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5904
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:7456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98208dcf8,0x7ff98208dd04,0x7ff98208dd10
        7⤵
        
        PID:7432
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2064 /prefetch:2
        7⤵
        
        PID:7336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1560,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2160 /prefetch:3
        7⤵
        
        PID:6912
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2252,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2556 /prefetch:8
        7⤵
        
        PID:6760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3300 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:868
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3320 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4228 /prefetch:2
        7⤵
        Uses browser remote debugging
        
        PID:15864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4628,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4620 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:18696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4928,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4940 /prefetch:8
        7⤵
        
        PID:18940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5516,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5532 /prefetch:8
        7⤵
        
        PID:19024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5628,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5064 /prefetch:8
        7⤵
        
        PID:19160
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5720,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5712 /prefetch:8
        7⤵
        
        PID:19208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5724,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5876 /prefetch:8
        7⤵
        
        PID:19244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5532,i,12251581139271418419,11628256036817248148,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6028 /prefetch:8
        7⤵
        
        PID:16220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:16940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ff980b6f208,0x7ff980b6f214,0x7ff980b6f220
        7⤵
        
        PID:16868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3680,i,13390424572157717382,9274331002589686678,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:2
        7⤵
        
        PID:17996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,13390424572157717382,9274331002589686678,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:3
        7⤵
        
        PID:17976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1820,i,13390424572157717382,9274331002589686678,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
        7⤵
        
        PID:17088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3016,i,13390424572157717382,9274331002589686678,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:17852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3024,i,13390424572157717382,9274331002589686678,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:17840
      - C:\ProgramData\wlxlfkfukf.exe
        
        "C:\ProgramData\wlxlfkfukf.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:16640
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:18860
      - C:\ProgramData\v37q9r1no8.exe
        
        "C:\ProgramData\v37q9r1no8.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:12184
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:4056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5164
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:14032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff98264dcf8,0x7ff98264dd04,0x7ff98264dd10
        9⤵
        
        PID:13976
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1872,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
        9⤵
        
        PID:19320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1984,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
        9⤵
        
        PID:19312
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2284,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
        9⤵
        
        PID:19400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3264,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:19252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3284,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:12704
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:18604
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4620,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:17356
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5192,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
        9⤵
        
        PID:10104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5500,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
        9⤵
        
        PID:10036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5264,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
        9⤵
        
        PID:9924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5308,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
        9⤵
        
        PID:9880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5604,i,3603226701672631608,5885973132529741854,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
        9⤵
        
        PID:9832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        8⤵
        Uses browser remote debugging
        
        PID:9116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        9⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:9096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x23c,0x240,0x238,0x260,0x7ff9803cf208,0x7ff9803cf214,0x7ff9803cf220
        10⤵
        
        PID:9064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:3
        10⤵
        
        PID:8784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2636,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
        10⤵
        
        PID:8776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2160,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
        10⤵
        
        PID:8716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:8548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3500,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:8532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4712,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
        10⤵
        
        PID:28752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4628,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        10⤵
        
        PID:28760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5460,i,8999113355240838014,1772075066308275902,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
        10⤵
        
        PID:28776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\KECBGCGCGI.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:34412
        
        C:\Users\Admin\KECBGCGCGI.exe
        
        "C:\Users\Admin\KECBGCGCGI.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:34456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:36192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\GIJJKFCGDG.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:34468
        
        C:\Users\Admin\GIJJKFCGDG.exe
        
        "C:\Users\Admin\GIJJKFCGDG.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:36688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\CAEHDBAAEC.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Users\Admin\CAEHDBAAEC.exe
        
        "C:\Users\Admin\CAEHDBAAEC.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\hQZD6VhQ\mGjiRF6hwcDWTCde.exe
        
        C:\Users\Admin\AppData\Local\Temp\hQZD6VhQ\mGjiRF6hwcDWTCde.exe 0
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\hQZD6VhQ\PRe4mbzoCvImhwY7.exe
        
        C:\Users\Admin\AppData\Local\Temp\hQZD6VhQ\PRe4mbzoCvImhwY7.exe 8964
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8660
      - C:\ProgramData\zm7gdb168q.exe
        
        "C:\ProgramData\zm7gdb168q.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\co5kMaLs\4sWFSCPd0Eatai7m.exe
        
        C:\Users\Admin\AppData\Local\Temp\co5kMaLs\4sWFSCPd0Eatai7m.exe 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\co5kMaLs\fTsYJWqNMUdLTFKH.exe
        
        C:\Users\Admin\AppData\Local\Temp\co5kMaLs\fTsYJWqNMUdLTFKH.exe 12180
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:12104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12104 -s 620
        9⤵
        Program crash
        
        PID:28148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12180 -s 640
        8⤵
        Program crash
        
        PID:28104
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\t000z" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17336
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:16784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\JKEGIDGDGH.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
  - - C:\Users\Admin\JKEGIDGDGH.exe
      "C:\Users\Admin\JKEGIDGDGH.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1928
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:60
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\CBKJEGCBKK.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5616
  - - C:\Users\Admin\CBKJEGCBKK.exe
      "C:\Users\Admin\CBKJEGCBKK.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\WsMzwhKWWh0A50GU.exe
        
        C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\WsMzwhKWWh0A50GU.exe 0
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\177wGYOuyJPIdxGX.exe
        
        C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\177wGYOuyJPIdxGX.exe 6120
        6⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\gmX7tDSz2TnmvORs.exe
        
        C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\gmX7tDSz2TnmvORs.exe 4472
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:16060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16060 -s 724
        8⤵
        Program crash
        
        PID:30156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 1160
        7⤵
        Program crash
        
        PID:10060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 884
        6⤵
        Program crash
        
        PID:18768

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\WsMzwhKWWh0A50GU.exe
1⤵
PID:2644
- C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\WsMzwhKWWh0A50GU.exe
  C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\WsMzwhKWWh0A50GU.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7624
- - C:\Users\Admin\AppData\Local\Temp\yfJVfgWZ\zmuBPmlTa1MfFIS5.exe
    C:\Users\Admin\AppData\Local\Temp\yfJVfgWZ\zmuBPmlTa1MfFIS5.exe 7624
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7664
- - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\lgjTp4LafuoI3sx2.exe
    C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\lgjTp4LafuoI3sx2.exe 7624
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:36208
- - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\okCYtWbSuG3OJQrS.exe
    C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\okCYtWbSuG3OJQrS.exe 7624
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:34484
- - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\Op4QNzrdVJR2sQEG.exe
    C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\Op4QNzrdVJR2sQEG.exe 7624
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:36700
- - C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\jB6LQZcLNBzyqK4T.exe
    C:\Users\Admin\AppData\Local\Temp\P3TD4oUu\jB6LQZcLNBzyqK4T.exe 7624
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:34168

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6120 -ip 6120
1⤵
PID:16088

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:11572

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:19412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4472 -ip 4472
1⤵
PID:10140

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:8528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12104 -ip 12104
1⤵
PID:24272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 12180 -ip 12180
1⤵
PID:24324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 16060 -ip 16060
1⤵
PID:30124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7664 -ip 7664
1⤵
PID:36164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 36208 -ip 36208
1⤵
PID:34544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 34484 -ip 34484
1⤵
PID:36824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 36700 -ip 36700
1⤵
PID:36140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AAKKFHCFIECAAAKEGCFI

Filesize
40KB

MD5
dfd4f60adc85fc874327517efed62ff7

SHA1
f97489afb75bfd5ee52892f37383fbc85aa14a69

SHA256
c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

SHA512
d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4

Download Submit
C:\ProgramData\FBFCAKKKFBGDGCAKFCFH

Filesize
56KB

MD5
1c832d859b03f2e59817374006fe1189

SHA1
a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42

SHA256
bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b

SHA512
c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef

Download Submit
C:\ProgramData\GDAEBKJDHDAFIECBAKKJDAEHIE

Filesize
96KB

MD5
6066c07e98c96795ecd876aa92fe10f8

SHA1
f73cbd7b307c53aaae38677d6513b1baa729ac9f

SHA256
33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53

SHA512
7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\t000z\trqqie

Filesize
6KB

MD5
54f4311fd69321972d4cd570cb2e4d35

SHA1
969aba6f63a0fc05f9e71437a3ecb84ccee79db8

SHA256
1c3ecf56a9b9089bda8d66b9cfa393f6af1bc63719107c58283f581a87c2608e

SHA512
30b3c10cb0319bcdc4107335ea55ac2891c041f1d29c5568b3f98f2f399ddb2aee29f65df165fb1939c5854fb678192a95c5a6e1dd28cacf3488648b4e222023

Download Submit
C:\ProgramData\v37q9r1no8.exe

Filesize
736KB

MD5
18e5e760b807fc2b05172215540398b3

SHA1
6a1b4d3227088473c45869469b68a1737b26b90d

SHA256
6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd

SHA512
23430597753696466eea1c54337b1d37a734918433be2e0637aaf022c0ef09d5f8b04a3793ccb1a296bb83d13fda832d677cb926730653d78b0833f96737fa04

Download Submit
C:\Users\Admin\AEGHJKJKKJ.exe

Filesize
634KB

MD5
d62b289592043f863f302d7e8582e9bc

SHA1
cc72a132de961bb1f4398b933d88585ef8c29a41

SHA256
3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

SHA512
63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
34c29bdb9e41b1f47f2d2786762c12ec

SHA1
4075131b18c3487e3e848361e112009c897629c7

SHA256
67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17

SHA512
ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
5eeb51e9e64e555e4a7d2705eb9976db

SHA1
742d0f4d9a77575115f5c5ad9ac8a133bd7abde6

SHA256
47b9983eedcea6a3828388e3097617595b69ff60543180b2411b20b0444085aa

SHA512
32c4630f6be0210efa8330dd1286855379c169c048543d4bc1a985eba6fdedb67b3c8fab522265f667276f74fbd4290013588d8233003bfbce63701fb8ae3581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
daf68e1fe854e03b7746816f213a6d20

SHA1
fb25f50fb2f6ff0f953a426e41805fcb258b731d

SHA256
48e058c7bb11658fbf9d0c029b605e4dc869e06ee562ef11b0038aa187925120

SHA512
26a7566a5944ee35bd33a39b53694e93003fa6d5f893f7bd44ad16856eaeec331adfc448d75ba5d8b00eaa03a5490468d44a5af1d42589c26863ab58259a9f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
6712b9bd41a3677f91b4c41d2d21771f

SHA1
5d2a3d41d1010cfc94e78a17809af61c0f1b7653

SHA256
e69513e36769ce1bb1b813d3ffbbf9a97a02254b1b6a65430ea26b638e48f7e9

SHA512
fd4a4d565f4d15edc105df6371680c81c505a9fc0e1c339da50e9e6ea9b37459c7de1bb40804af3009350d06864215a5886c53f740076de920530f63d919e9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
e498660814541cc35a9e00d36696926a

SHA1
847c7bfa06fed0237f35e70125a939c52fd47359

SHA256
214a228ab1c69b57df0f00c06a2733da37821a09438a84cb1bad4a81cb6b1b05

SHA512
4e4ba4271b60077975081ccc0f4aa451f7c856cd88404894f0f8e158ebec22f26e852f2e2a43a7d3c75845750648550719524aa909739da99c0bb1b5fcd401ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
0605b75c5c345cc202a7885499cc09a7

SHA1
540568cdb245ba26bce8711347e456320012e83d

SHA256
8ed5d8964a977a79c5aacf34853c9e5e00a06de2f2f0964a56c4089805a2dda8

SHA512
dae16a98e4cf861b918d684f0d7660e1c6647897afeded6859253a51f8dd95c41f007e3f20fe43da0292b493c170cb94fb8370d7b17b4f23cf2950cec477f9a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
2c7f5a4022c2c5582db8b529a8c51c8f

SHA1
883d1146e9d04f3dd0ac7dee846d2acdcd39f82e

SHA256
c01b800743e60e68261b2853d4d6c3d56cf109232037b7feb47201e9baceefad

SHA512
b3bda041e58622cd265374ebb9bd1467b12907132d1ef889375a6f5fab6485b302ee3ce5f97c6ef60a120baaba1507bbf3a4f16f9765ba1d204540cd31a172b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
35KB

MD5
6a65c258078fb0f36d991be43e6ce9a7

SHA1
7d1652fe5d94c582ad9e7760302e9b8b97be34be

SHA256
f119d1d136c8f814d28e8ad99aa206012964a592ce9723a3e76d420492fdb81a

SHA512
e1081f47938506d66eb865642a1a59f544b1f1043ce4df03724204da60866c7a4e612c51e1d5a9bd6314b093039267e26d29ebecd2e0d6c6592bd44c34d6fb7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
63KB

MD5
1901d2bcbbabee4bbb9804c30642ae2b

SHA1
f31774bc12614be681c0b0c7de3ac128f0e932db

SHA256
15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310

SHA512
bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
662951555b8fee68982c32ce8d686804

SHA1
c51dff96c0258c9861632667042c98731ad71a7a

SHA256
7ce769d12de2fbbdca480845c80416811ad70941f413fb0c1ef1dcdbcae51816

SHA512
5cdaad0ba66b5c8e6122778e2723889d551187a0fa9083c2a118acffaef83439dc94e404607cea92092fb0c46be6a206144d9eaa07441776254d4c33a16ba97c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
3KB

MD5
f6450a594089474666a0a985f3e4cbc2

SHA1
d9c30a92dd42de664cd13d89a57a84d394dfa4ac

SHA256
3f874dfbfc6987548fa5af8be3ec2b0c3945e340ef20f0b5953e040caed8ad93

SHA512
cbc353a5a2b11ae153d7b3430024eea1a3a6078b2c60881a83cfcf78f2a950e325d029498692c6b47e275ce44b58fe2569dbd046bdbee56535921fed0680ab50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
336B

MD5
a11fc9e1b0137d1cc71d9390ab8012f3

SHA1
efc4ecf664e0c669085c89258de5aff34fcebe6d

SHA256
4d067056d68f068707ae830b9888e1ce7f0f410f4704d485a690cabed0cc8e92

SHA512
fc3dbfa6ef40f0bb97b2dec25fb5451181b02f3139c97f8b2fa243a5cf5d94fae2bed7019fdf2bc9f74778b21116282f40b184b6cdfde0d932821dcdefc357fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
128KB

MD5
ad5500392a3d6dab62cbbed72729419d

SHA1
74b1d039a44cc37e62dc573d0d14efe2ead9e391

SHA256
aac955452d846e19791a2c1f30dba6a9c1ebde5b20547d37c6e7ebb6c62154eb

SHA512
454433c661570990955c25eedb52ebdf5ae2317ac062cb23be3537b1cc8b5afc2a1d3d1e370951641a473cccb0f3ddee9db34dee2bb7f52db5bb4c9a609a1872

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1

Filesize
343KB

MD5
fe0afab9e43167cfacab107f21d040b4

SHA1
6448a3243f17b73cf4cb5fa0c0d13e8e59751f83

SHA256
3cbdbe25233c061eee0a1826abfbd94d5e4cbd3a1af33b36cedd7c330293eedd

SHA512
eaca957714b139b3da6fd096407007b0940f280a1aea7922220678958a37869a5640422f7acb232732b6ee2063fbd8f9de080ec49bb5d8c0210b859a8b7ca883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
e6bb6a2c88195d6a427c7828ee941d74

SHA1
2e5a1a5b0f33915975709f7d9afcbf3909c9d484

SHA256
920d14b523a392f9ed89deb411e821dd9fa1b3f60a27a3c78f581d299ed0553e

SHA512
0c8332785429b58c958a8b26e56fa49ba6d7323aadfc6868a39a3560070aa638eb358e3a390741ca27b3b58b0ea9d0532131a4a5701ec542558cc37ee221794c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
513cd1c8bd616dde424cad37ac17cd1c

SHA1
78ab082a6b13f454aead49a65181fa07e3e227e3

SHA256
07bc1088dd8e8ba45ce2272f2e25abc601a0d49668ca8a9565afbe794cb2c96b

SHA512
186224d168a61e5381af14765c1575d3a773eceab0c742f092a374c7df7de9dbf5fbfe027eebc237ce953493c3defb0fcda8995fcf593143e001c91d2659f94e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
7fb13f9df269e21227bb09be4362d7af

SHA1
2be2bc34287245769777f27f3f9e008ab4f5a085

SHA256
10dfb42f080f0b2b0c79f8806450a06e60c4a5b36e973e26402d6b9c532bbcf0

SHA512
6495d301cca37636c887fdf45daa8f58dce4ce06397fc5bd88a22775ebad4b242e594c6b21515976a8c2f3e02dd9b5e17f746daa9f38e3c73bf4434e00be7798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
130KB

MD5
26424faf03acd272cd68f350b881138e

SHA1
e75fc57d237410c6705c37e87b370dd15aac9555

SHA256
ff081f0ac8c69107d1bdd10674899170c58312e1f330fb7651cdd287480937d8

SHA512
cdc59551616ad6a7402ff2419628f6ee534c7c8e68379ae8535919aa2c22972fcfb0c3faa0f4238d6ff88ba646cd58542073f1c5d6389e195052d51d03f5992f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
12KB

MD5
dd65f72d6fcb91a8b8a69a3d3df02780

SHA1
165911d7ed1fa3c7e324e44454d718b5e6aec44d

SHA256
49a69fb667d2ec69c7409842e689d5ec895b3d52646d92ed2e82ee8f48fa53de

SHA512
5ad4a55d82a7b439ec573830de2333b8fa3cfee05bcaf82b2cca7aabadc02e7de537fbb31103ff73937cc451e0d973f53294923bf87182ae0d31652aa62e5394

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
24KB

MD5
bcf53187714b2dee0a46ada8936c98fe

SHA1
b9a16eb87b15e1ccf2107016b318dc6f81b17d69

SHA256
4aef7e51d1fe014a3da3f7c143a8fe513fd63c6e0043e0af671eaa45236d7611

SHA512
7f249efa7baea7fd15de4b636ca1f007da9b6055eaee0490e3bc726552911ab9ebe9a49e12096b52ee837c985f200c03a20371331c596f956e888932264dfeb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
8273c75a97f0b2373d828a638e7d756e

SHA1
22c9d376639195a50c4885496fb1bcf0669dc4d1

SHA256
7cd07c4edffe3cdb4d8c1dfa584362ced2876d44f45687eefed08d7e0dc896c8

SHA512
c61f4dde545d42faabe19848ac4059211a666ff992c93783e6efc1e87bf89fb2da94e73126eaef4b2132a572735994b2d510fa9d9872ebf1e179de474a41f9df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
7f4ccf59f42e24f58f0d4bcc9d33dd03

SHA1
2c17ee0932c7e8d30485f7edefb9c21fe9c8e681

SHA256
593bafb278cd978df6efd6ba43d606592aabc868c7d537660d685ffbfe78b499

SHA512
2efda8aea13a617dc2f3eb7a6215de6b53bf4a4893ae91e31a1c9ec3b9cf1d9cc280ba801cd8d462b115ddbbf004636faa542ee6d56ae367328226f6ba7d0ec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
feb6b05ad0e108f12882cf98f300a172

SHA1
b41316af9dae8d33b22c8a390a5472ecb620b0ff

SHA256
27c1c7588a4942f6b3999777cd9c8ac27d93e400a08a0db89edbe6af6ff0b1a8

SHA512
a83c313b32aa1ea45ecbccc4320242e4ce7a2c290557d8929089c5a4daeea5f4cb62b8d5e4806b91d6ee68f726d159fcf38d698c01a14ac792dbc2de84c24574

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
2e67c1551fcb094f90e2c66026f090f4

SHA1
1c538f9125a43e1c15f0370bd7fb4de4b419d6f1

SHA256
bfeb54df9da5dfe4979d158f65d89b8d4fcaec1d379d7610eb2bdddf82fc2484

SHA512
961c89d943fd8db1444de0853e108e37804ad98668785239c61d7ecc7ba8d9dde2306928ddc83cbec8bf62c4a59c6d7867296bd1f73e9f169114dc9a51b81039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
4e50dcb01b04b7ea4070e7b53d9fef45

SHA1
8ccaebbea206bb4bc57cdf96d0c955b5b8784214

SHA256
3c0f38f1ac3ff68e5d758374fc7729beff9ece55e97b18ba9f58ddde9b9a71c3

SHA512
ea671106e17ef22744bb77bbebe34a01a2a0e10285aa162e3227166469d64bc2711486ac00a9ce2c2ac5ddd29d0ed87783286e6f3a7a4c598417251b2e8f0c8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
baab0fe3974da21a0013963306f7d431

SHA1
4d8a4762df238835af43d7602c299e709abbeb13

SHA256
3ebeeba6e07e4ba339c557e1890e92fdc6a875010c63d07b0b83285e6a0b408b

SHA512
25c59da0cd0d7f30b7525830a068225f3e04666367b71442be4c237d08d85bdc400c32997fea239e5907c6bd8615e9085582fc7c7c2728adcbb1f0d1e7574df0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
34cdd9de244f1792d0d1ba612835c191

SHA1
51f0946d260b74e62b72e8099a803ec16ada2137

SHA256
3df0e301343b6ad9d221a4f7ce51afaeb1b2428af9ae4313a3ce353d71259035

SHA512
12181b24b2b23d065ef3368661b0e37c65d8d5d915daa9f876f8069d9c7515a0442d4a923fedbbb9610ebee68cbdeda1286a9e55df2269f69256ddbb27506dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
89ef50c45b72aa08e917be3e18bc3b78

SHA1
b42e77bf104aeb85dc7a9eda39cda50154a706aa

SHA256
310842091c275f2683e22680dedb5cde6cf7d1f1a0aa677048d2f6ac9d178cc3

SHA512
1f20f549383bfdd741eb68057c7a3c8c9aa239f1d72e2d4c4d0a319fd4237ea0dfb83fd58104a28545e830433a1069a27239ef2014f991fef6295848f40f9acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
886fde6fb1f645100f44965f90c9f4f5

SHA1
4b97927354aafa06879f19aa8a0f828aabfcab96

SHA256
17e8b6c7f9bc7a0759b27fcdb634872ee4c6ac01a4a9856b4d0a778c05e215fa

SHA512
f1383cc1e8f9208a75f8a91d0d8a0a08258d89e068249326dd83a3d2f576d352f137e22c9d91ffaab5186068dcb2b51d4a53e3c0eb0c5c375faa4c4e0866d706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
2de6aa3e9ae78cbf4e4853012d1840b5

SHA1
eb0338a3c9e487a31692c46319bc1a42d258079e

SHA256
33c3737357c3760433bfeb09b843d782b89fad496c75b3daa07668404fd07527

SHA512
57d0e899db5273213aa6c4fef801b8e291ff5d6dda90a70061213c0b0378dde2695cf157eefdf11547a3a4ec4cc410ff893748a64ce09705c8edf21f9e70fe2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8625e8ce164e1039c0d19156210674ce

SHA1
9eb5ae97638791b0310807d725ac8815202737d2

SHA256
2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2

SHA512
3c52b8876982fe41d816f9dfb05cd888c551cf7efd266a448050c87c3fc52cc2172f53c83869b87d7643ce0188004c978570f35b0fcc1cb50c9fffea3dec76a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c35ae24-d1e8-43f5-be18-6c57f666279a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc

Filesize
29KB

MD5
9606b72a59d2447f654af8af287a05d0

SHA1
c1e63592f12eb37d75a84df3db35b9e6ec319982

SHA256
c51af0f5cac32f93b404fbbdd8b4830fa079080f472409fe2ac68a9208b55833

SHA512
753d7e45657d2e52166dc2eb1cfec7ff3b83e29f8538ea57cc6fc417be551d5e8b59b4dbe5868d2d4c5806039799a69914594da70696f4a1406298e3a924c48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce

Filesize
22KB

MD5
79f821593bc23418981840e5537ae299

SHA1
a1c6bc4bd38a7e97e1ead6246f33282b831a1a89

SHA256
7859c5097c68a6b824fe4ba157f0442470708fefd1a1fbba9a2475e0987049dc

SHA512
0911db271b677832aea456c9e8ee44399310d137ce322014403919c84bdd097b9437b8ae067d5f7b011511eb250729814e72f28c1aecc995b2585ebd257ce2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1

Filesize
29KB

MD5
9fb74326f824778cd1dc23a34094c437

SHA1
d9884cf3b7c190c9585ec7b57d51bb97a0a73564

SHA256
6d3940164f27bc6990892503d6ced5bfa9f0653419651886fe8ca5c34c52037d

SHA512
227a0ab046a437e19faf341835d9e45cb7f828dce833f186cb01dbded7fa2435c4303593716d42a01a5b1a1c52f108e3d473fb2c2b28d8bd20017d73ade27c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log

Filesize
49KB

MD5
6f1f674a0a50718fcc0f6cc81f3fc635

SHA1
ed3491929ef5684751b18a25ff86b9f82180e844

SHA256
c08b6120ee9329713940262e8c839d592bc3ec78e1d0a3e104f4863896bd313d

SHA512
2de44bf131d320e2db0dacb2376074ca349c8b78e773b054c37304fdf12911ff66f3c1798dd9f5f74e48af15a094a94e98c5ff431b3ad733781a52ec4519092b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f491ede9f41d9d1fbccdccb39098d423

SHA1
90f4ebb2e594fd5d1716959107991d785830e86e

SHA256
edd22136c65bce63cc1b12ce88904859a9374598093dc7ffb4371e1d4e42e0f9

SHA512
284610ac628cae77a73e5546d70266e08c567899be81809ca445610e228f644babc85fed6c306e33db0f4f958abd6fd5889c0a1b6df4c199942e52dc3d61c278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
97d58c86775ab1bd8e31d823b8eac41a

SHA1
1a9b40fb399de5d349e729d89ac3771343bf4bc8

SHA256
de84d60e38a34e16da5907a9b883550e8862da19ef57f7ea816d5bc3dbe33ccc

SHA512
ad0f1671fb1794a83279f03cba2b0992440e959f90639c19a4943f12c2a52a60b512203c5ab12445c9575c86c8f9c8a01b76c7df9835a598c20bdd061c9018f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\528cba48-1c87-4b58-b3d5-c55597a81447\index-dir\the-real-index

Filesize
72B

MD5
826084419c4f8b31e7fb86964365a239

SHA1
dabb600618179a23a5dfbdadcc01413f1e905dfe

SHA256
15d28a48d8d37c186c38bbb2976cfd82616b911b588ad575ee5f00d342930187

SHA512
60311e35282629b7b59be3e3a6471557dfacd925c8be624a5a2cb26565d077a2302a70dabcd7e4f9be16badd79a4e30d0987f35daf9c0a3c17ff03d94c027570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\528cba48-1c87-4b58-b3d5-c55597a81447\index-dir\the-real-index~RFe595ff8.TMP

Filesize
72B

MD5
8164f6e4fb8e50a794a1f3d99a853970

SHA1
0f0866c125a55f61f1a8fdb25ae7197c93919921

SHA256
df790949098e6b2b3e17a7c745c2ff19cd79ec7e7a5dfa2e2b879e1de0301dac

SHA512
a0ec2798243ff3c032ad9a61b49bae3dd41248404e7c70fa41e9a84b5c14234655c65d9b72df3a94d447a8352a4b746b818277fbc66a629bcac84e229a0b5b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\551e402a-b44f-4b78-a1eb-9e88f872c0ce\index-dir\the-real-index

Filesize
72B

MD5
a714971e6915cb72e2b7ef11b24db414

SHA1
cfff63e5f262ae31d4e7e88f1468293047c661d4

SHA256
04b8dae92d891e6198d671fb1e471ec5669bfde688c64b62fc05abf03eecdfa8

SHA512
57b95787b21ba4739a356afa3d14612063143a4d29057a9f73146a897898cf6ba2a1e1bf6d14badfd14f26901e7611b27924f101dc5c7269a34b8724805568ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\551e402a-b44f-4b78-a1eb-9e88f872c0ce\index-dir\the-real-index~RFe594da9.TMP

Filesize
72B

MD5
61c5d7b7d53e283c80e489e5c411a65c

SHA1
cfb6834f695f5c78d2d183876362d56e894a353a

SHA256
b55840a20f1611c2f5614fab0aa03918dd03613d7c6dacc100d1a5afed1d6f44

SHA512
25d4503590cebdaf6b6504d45afaafd13081fb4b274ea57a7a3e1c15465e55a9fa28159a7a7ede2a960ecbff0948be9bc508678a9522c3c83c596eddb0ca092a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\897c5d3d-bd12-49c5-9dfc-73ae31a1afea\index-dir\the-real-index

Filesize
120B

MD5
3cc6e2b5a8fb61823b9abf2e5b49b773

SHA1
47c1f7b2fa4726b883d3e2f4818eed1a1e8538ae

SHA256
6dfdfef8dda38e1ddbcb26b267b19372d400ff31c518d2a6d49818c45b44bac2

SHA512
7aee0e77547a6f489c50606ca924633ef4c5ff769f454c33dca49db8f1c2df397ef0d19845b76aa58c7897742c581ca3ed307437136cb0485a634936bafdfdde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\897c5d3d-bd12-49c5-9dfc-73ae31a1afea\index-dir\the-real-index~RFe595c10.TMP

Filesize
96B

MD5
b8991bd303384fbb1d491efa2975448d

SHA1
2d720d7a8e0126a6861979d6360d67f95527cabd

SHA256
0238ea3c66f9b66ab783cb83fd3122dc32e70ce26e5f4ca647371dd207100423

SHA512
944341fb361a7b2c27ebc8f7dc973bd68e439614b8cf33e0a9dcc98a7c8e07360afedf96da85e3a63481f2ba42fffc153463023b7acb0d785426f6ac5a750652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
9d020a5117ffb48993efdd093898ddc0

SHA1
168bf4f8aa0bb9085bb866deeb9e7f66a3d93165

SHA256
4b553a68345ea17c27427a454f3919661d3f85d55fae5def2bb43d392328ac22

SHA512
68a7c451854581bd8974a7e49c87c594c1e17f837621c708b1a9eb6a7bbd0d3a71796abbf67aea6b2044516a1cdea4dffea06dceb6c3e58691515b3d1c23be43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
6782b918f7010483c2c339d31ebca90e

SHA1
f3984c5e4bad0bc10b7ddca240a68bae2f08f829

SHA256
ddec77fda6155204a7938d23b830b622f38b1321d7a3f8914cc2e67343b5b25f

SHA512
27280ead8b4135a381f9dec92517aeea5e15481274c1a3faae85435c2b67819b2439cb5d61f140abb3ed5849ae7d31324379c17b31b0d69fa82ba217531d2622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
35KB

MD5
6476ee16b130eb98d056abf2202b15b4

SHA1
fd2bb34b125d9f7cf85aff0d044cacf10c756be6

SHA256
d9753919a5b44f0c469913dd165ecafa1709931ec9f722f07713af29f96cae38

SHA512
c94439831920d794d6ea1efbea5c5ff3dddf2f42c46f820e07b3074581cce1a95a3e2f8e1c789d7a616e266c1d3cb15d019e0ee0b82f811e2ac6c1b0f69bab56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d84d8ebcc438062ea5e80921d0945c83

SHA1
930f3f6fc8a10b147a01266fe1c0a65311082944

SHA256
13972ecc3b87b6b9bf5fff35c56654e52ce92c8ea1c7579ca2e47aeb6723990c

SHA512
f7b29b23ec0122c54080d67d7d61dfb8d827b62b90ffc1678c0923ba9aa8ad355bc20c3ce928c06384d739d64c4f0cebb4877b9ad5c940ad6678fbdc57be087b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\af\messages.json

Filesize
772B

MD5
7bc8fed14870159b4770d2b43b95776b

SHA1
4393c3a14661f655849f4de93b40e28d72b39830

SHA256
aa12205b108750cf9fa0978461a6d8881e4e80da20a846d824da4069d9c91847

SHA512
7e943b672700edd55bfd2627f4f02eb62eee283e29f777f6660fbdbf04f900757272c5fb8a0c8744c197a53eadacd943598b131fa2d9594d39e20baa2a9b79f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\am\messages.json

Filesize
1KB

MD5
83e0e58d0752ff7c3f888e6406413b84

SHA1
14a8981e4355301bb3073db6d7ffb337ef8482e3

SHA256
64e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef

SHA512
fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\bg\messages.json

Filesize
3KB

MD5
361b516edf253851044dae6bad6d9d6f

SHA1
d64c297cf1977cd8ad5c57d9b0a985a4de4fd54b

SHA256
22bc37b47ce8a832f39701641dc358357676e9be187a93a4c5d4b016e29238ae

SHA512
b2614c53e93e705a93b82db9fcf5259ca44b10b5e5237967a34f68607ab2380ea0c8e5df4ffd941d914617fa3538fd40c18df7d3c9808c5f652852f01e214c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\bn\messages.json

Filesize
2KB

MD5
b1101fac65ce2faa3702e70fd88957d2

SHA1
06ebd889fad9ee2d5d5083b10abf7b2a4d0e1724

SHA256
3e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8

SHA512
398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\cs\messages.json

Filesize
953B

MD5
48663a88dcf0ef6c9fade9bee4935b91

SHA1
af7cad1498bb4b0f05c1468abe3563d0182a97b4

SHA256
5a701d67910ba6c7ccedc26e02fa707cc86a1be57cd7d36290a3d268732a42c7

SHA512
3c3e5b9e56535efe1e20d6024b6fa46d3ea969c971d5ec8f5af1c933c1feb75d25e7f26c9e2bb8d200bca70ea1f1bd7e93e4e1c09dbc447340cdbeefa91cc33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\da\messages.json

Filesize
764B

MD5
0e451c9c8453577e513aabf630c275f2

SHA1
5912cc58aa82bc75691540c8aeaca7c68641539e

SHA256
94cddb998c2c5ab40b6f074c359a60e6eebaaa2d52a9649c22f4ea4c1b9936f2

SHA512
a89dcc1ec8c79e7cf702692e20ebc952907b2fb1d76a3beef60d7415baee24e055e2988b55e12ce00bc112c115ddd9d46d63bf0a1c511fffb041da7054391f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\de\messages.json

Filesize
927B

MD5
5daf77ae7d2b7dbef44c5cf7e19805ee

SHA1
48c06099aee249dd05b268749836e3021e27cfb5

SHA256
22e2828bfdbb9c340e7806894ae0442bd6c8934f85fbb964295edad79fd27528

SHA512
b9fe759ba6a447ebf560e3ac6c79359e0ad25afca1c97da90f729dcd7af131f43c1f4bfcb2cd4fe379fff2108322cf0849a32995b50188b52258bfff9e5ca34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\el\messages.json

Filesize
3KB

MD5
32886978ef4b5231f921eb54e683eb10

SHA1
9e2626e158cbd26a2a24a50e4e8cfd98a49984e9

SHA256
728d8cbd71263680a4e41399db65b3f2b8175d50ca630afd30643ced9ffe831f

SHA512
416832f007470bf4d9d915410b62bd8159029d5ddabed23d2bbc297e4bbae46f4346feb68c54163428a6932c537967ae9ef430b9fac111f15cfb001a480799b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\es_419\messages.json

Filesize
880B

MD5
94bc2d5609f6d670e181e1ff0d041869

SHA1
58d2c17878e7b6e73daa544b8ca7774e5d902a17

SHA256
e848603b7a73a88e3fe7bffa20e83397f5d1e93e77babb31473cc99e654a27b7

SHA512
04bf79f675888c79b270c82e3a0e7a07e24205e2159e2d98eb4585aee5c0d14c6be3a3d169d4ea702a74a76f9e622e70a181dcd9ae0cb9f2472550fb33e9565e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\et\messages.json

Filesize
914B

MD5
b18007bfc2b55d2f5839a8912110b98d

SHA1
842ecac418424b2fff4db81e4385d59e098b65de

SHA256
7ccc7b17bfe01c3c7dd33eff8f80d0b57fc9b175815e766c9c1c1e893725e20f

SHA512
166937891553597d585d17fda2e7ff2bffbd3731841ea6cdcb7add528a55aa7c257fc191d029dd1f57afd4349194c0cc7413c3752641e8217d465674b62b8ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\fi\messages.json

Filesize
840B

MD5
1d4778e02337674d7d0664b5e7dfcbbe

SHA1
fe1763ac0a903a47446a5896a2d12cce5d343522

SHA256
a822b0e66d04644d1cfbd2517736728438743162c3213f15d986e2db85bd0213

SHA512
771c7ba7f93a6e9db94593897d495e190e58a9b9c490523cc410059e72538005e2de96864dbbed8bd1f01eaa4d1cd022443dddbf759a606e2903c9ddecac43fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\fr_CA\messages.json

Filesize
901B

MD5
681422e3fcf8711af8eefbb75a607c8e

SHA1
3d3576a989c8010a397888429476f2800052e79a

SHA256
af889c1deb6f9248961c2f8ba4307a8206d7163616a5b7455d17cead00068317

SHA512
2546c274749a75c09e8255b6fa53a080a14bb141c748a55ebd530b6f2ac8adca3111320511628d4eec2b39a8710578ff16929b06ffb1f9c2093d3f1ee4c6f601

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\hr\messages.json

Filesize
863B

MD5
eb6c5133c1fe7f9e8e4449a917d185d9

SHA1
9be42ac75487a77dfbbf01ea2098886e69956356

SHA256
985976b776e729835e047c81d3d731a6c488a6459aa8918dbc8ec808c0bf73a1

SHA512
1aba115b30c99e786845c137ecb8beec4b5162c59d10724dcc083ff6b91a47af45ca850fc0b3072d44be189b31abb67423c88369171b0c411ccf7ae884fd831e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\hu\messages.json

Filesize
1KB

MD5
fb8d08676aa88683f27a2759c5837529

SHA1
80badd0de6a8d87a8e14232f71fbcbe231eee443

SHA256
cf26310b073b0891996ecd761c6cb53f00193dee524213a9fb34225d636ec4b7

SHA512
5c4307b653cd841af14a4b57f225938be54d718c979fa4008513461fa6f8409bc82e050f0b32e587f8e52d5580aa7c6d667aa94b30a588cb87de585b015fe176

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ja\messages.json

Filesize
1KB

MD5
113a674f2e4c66cc4d2a9c66ed77adea

SHA1
f5d38b743efa022d6f886bacd3afa850557e2762

SHA256
c1094a1d8457e782f229910b70fc7aece356aa779a423e869104946814660d35

SHA512
e7cd847d87dfea3228a1899aab7f27f59d7ba2919e81520501a9236c55fcdea418f1d29c3c9eb36e34cdfba3278e3bbd149ddf324c94295e029031fcd5a75677

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\kn\messages.json

Filesize
3KB

MD5
f55ce2e64a06806b43816ab17d8ee623

SHA1
27affcf13c15913761d0811b7ae1143e39f9eea4

SHA256
5fa00c465c1c5eed4bea860ceb78da9419ea115347ba543ddb0076e5c188feed

SHA512
a0e7d0f7beeca175c67a783adf5ff614c8e3b731311f82bc24eb0f0798938d79f15a5cfa012b3cf06d7a138d88e6f78eb3d3d57a3edebb60116de2dc706e2b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ko\messages.json

Filesize
1KB

MD5
e71a91fe65dd32cac3925ce639441675

SHA1
91c981f572497a540c0c2c1d5fb28156d7e49416

SHA256
57f81a5fcbd1fefd6ec3cdd525a85b707b4eead532c1b3092daafd88ee9268ec

SHA512
2b89c97470bae1d55a40f7f1224930480d33c58968f67345ca26e188ff08cf8b2f1e5c5b38ecfdbf7ebfd9970be0327cbfc391cf5e95e7c311868a8a9689dfb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\lt\messages.json

Filesize
1002B

MD5
8047409dcc27bfcc97b3abce6dab20ef

SHA1
d85f7a7a3d16c441560d95ce094428973cbad725

SHA256
b42ebfe071ef0ec4b4b6553abf3a2c36b19792c238080a6fbc19d804d1acb61c

SHA512
4dffe23b4168a0825dc14ed781c3c0910702e8c2b496a8b86ca72fdbba242f34fe430d6b2a219c4a189907e92b1a7b02ce2b4b9a54088222f5af49878e385aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\lv\messages.json

Filesize
959B

MD5
20fa89ba92628f56d36ae5bd0909cb15

SHA1
52d19152e2d5848ebaf0103d164de028efecdbb7

SHA256
80d64f03dc2cc5283faf1354e05d3c3cb8f0cc54b3e76fdae3ad8a09c9d5f267

SHA512
5cb534fdba0f66a259d164040265c0e8a9586bb41a32309f30b4aab17e6a99f17baf4dada62a93e34cc83d5ec6449dd28800ee41c2936631484cc95133e3956f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ml\messages.json

Filesize
3KB

MD5
ce70315e2aaeda0999da38cc9fe65281

SHA1
d47fc92d30ec36dcc102d5957bb47a6c5b1cd121

SHA256
907f2709d1d3c8fa26294938f4080bc477e62281c4c50a082c22db0195cda663

SHA512
af5c78feaacb689d9d50d0196ba9428e4f02b07876995e8b77e3bc0fee7fbf43f3ad2848d58940f193966c54f13652476e1fcfd6a827465caad32b0b2d3f97e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\mr\messages.json

Filesize
2KB

MD5
34ce3fa84e699bce78e026d0f0a0c705

SHA1
5c56d09af53d521fe4224a77aa66e61a3b0165ca

SHA256
275e7fadb93a810328e3adead8754dd0a19a062d5d20a872f7471ffab47aa7b3

SHA512
3a6cd2ea06b664689f089d35fcfa41b36c22b1d77cf78f66d0f5dcdc52a6bb29f7566d377b81edce6001b71cb7f1e1247d3d71965baa2e8ea9e6deaa208cf25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ms\messages.json

Filesize
796B

MD5
db4d49231c88c11e8d8c3d71a9b7d3d4

SHA1
4829115ace32c4e769255cf10807f3bdb1766f44

SHA256
9b32c491d0bfebdca1455f73c3c6f71796d433a39818c06c353da588de650f81

SHA512
c8b4a982abf61eabb1b7280f3e10fdf1350b20f38ca9878f33ddaf979fd617ca8e5ff4df6099c395fbae86c8affbae77653ba9cb736af22466e3cb85d4d92e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\nl\messages.json

Filesize
771B

MD5
d448e11801349ab5704df8446fe3fa4c

SHA1
6e299363c264fa84710d6dbeaedc3b41b7fe0e42

SHA256
e98c5cfe277a338a938e7277deec132f5ea82a53ebdb65ff10e8a2ff548ac198

SHA512
49c2c05207c16f1c9393f9473cc77fd28e1b1f47686ae1eeb757676019a0ad4a6478e5a76004911f4ae299b3b7331cb6dfdca3eed2078baa5da901ea44cc4668

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\no\messages.json

Filesize
758B

MD5
66439ba3ed5ba0c702ef94793e15de83

SHA1
2b3ca2c2be15207deae55e1d667c9dcdc9241c74

SHA256
b3ece279943b28c8d855ec86ac1ce53bdfb6a709240d653508764493a75f7518

SHA512
8b393f3be96020181a12a16fafdae9df555b09a7b03cc855009b26a48b0c7d583476a72bb28224e419d300013fe272316c2cb35de8d67dbab454b7cae8df6b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\pl\messages.json

Filesize
978B

MD5
10ba7fe4cab38642419be8fef9e78178

SHA1
fddd00441dccff459f8abca12ba1856b9b1e299b

SHA256
6538f562bd1baa828c0ef0adc5f7c96b4a0eb7814e6b9a2b585e4d3b92b0e61d

SHA512
07e490d44f8f8a2bdc2d4ad15753ad16e39d17693219418b02820d26558fbe3fce8a8583bae0ed876acc6326080867d05a732cd9a4c24b620753b84bda4ac031

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\pt_BR\messages.json

Filesize
832B

MD5
8e24ec937237f48ac98b27f47b688c90

SHA1
bf47d23436a890b31799fff14a1d251720eced00

SHA256
a6ad5d5fb7c90736e04f898970d2cc9d423415b54b8e572f18c05d6ebaf46f68

SHA512
060f9713be6cd4262e0c490e50198a33026b00a80c8a3c7c87f2b05893280e1b32d1df2536054f4544f7a014ecbaf5f2e299b49dd6f45705cabfff068ef50d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\pt_PT\messages.json

Filesize
855B

MD5
aa431ec252b4339a49d172c6b9292ba3

SHA1
26fd7003368d5342620464a53af547ddea7c7328

SHA256
156fc7ba9b5728908e1a74950b97474f73d8f58933d345c8eeea8284565c8357

SHA512
c47c2e530ee2dd0bcc1ed1c2f8c54aeea3dcfac277bd85026dcc6c07e2da693b35577bac4924c45bb8423ad9aaecba324eec74291ef5cf2586a8b0b9f0084cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ro\messages.json

Filesize
930B

MD5
ee122cf26ebe1ad0cc733b117a89ff3b

SHA1
a7c21e40ab7c934b35d725b3e21e4cb8ea85bc1e

SHA256
4ecedb9c1f3dd0d0e3aeb86146561b3d7e58656cbdbed1a39b91737b52ec7f2c

SHA512
4866fbea6c8698eb3c8923b9875186c800519488784683c18e5e6523681c52429e7ba38a304e0d1b17a3997a2f4c8c3a5e9fb518466a910b119f65d7dd62b77d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\sr\messages.json

Filesize
2KB

MD5
c2026342237e7686b1932af5b54f8110

SHA1
5af235b29947c7f770070f0a693979d9191fadb5

SHA256
a3eb276fbd19dce2b00db6937578b214b9e33d67487659fe0bf21a86225ece73

SHA512
2ce6fffa4ea16aac65acc8b5c1c9952eae1ac8891589266735c3ef0a0d20e2fa76940e6401d86eef5c87a1d24c1cc9a1caaf1c66819c56505b0b2860bfe5acfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\sv\messages.json

Filesize
800B

MD5
f008f729147f028a91e700008130da52

SHA1
643fff3dc0694fd28749768314150b30572caa54

SHA256
5f4229d18e5606330146ee13bdf726e10c1e06cbb15368c47f1ae68abe9ce4ba

SHA512
f5890cc08a9a40366cfffbbdb9b14e8083897a2950deb4bb23566d641dd4b06ab02479a2b83bd5001c179abff889506a3292cd92e31a6b92cad917dff760ab27

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\ta\messages.json

Filesize
3KB

MD5
24626ad7b8058866033738380776f59b

SHA1
a6abd9ab8ba022ea6619252df8422bf5f73b6a24

SHA256
3fc7f56f6d6d514b32547509b39f6380fc786efbcca4b9859f204456ca2e7957

SHA512
4fa2f084175d71923ae3186c8195781e1946f6c19b1a4bf659d3ae2dc45f1ac2f84d794b4487ec5e030ea899ee1decf07b3cdd3eb0d3dda996c5ff8a272cf97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\te\messages.json

Filesize
3KB

MD5
50ab4deabad394d13c265b8b80d9f9c3

SHA1
ce9c786cc92359ca34483bd57ce121f699920ddb

SHA256
90868a8a4a4dbf48770c14a161faea406ef9a453b75f4cb7a53c1b4e96a88599

SHA512
3ba6498cde1fe4c8f012a75ee546e9793b812cb7306c927054427fc697cb729549196f8e45db1a7a7dd1e485e6a3d3950168e33b03b669f5d4676c372f519a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\th\messages.json

Filesize
2KB

MD5
0875b0bad81161ccf2c16e13ee49af9d

SHA1
686663983a022689dedf5ba22c0f169e1a654e64

SHA256
d299aa0c4f29c5c8248a1c51afdb7439f4cf7bc28ee02408a598f8aad9f70810

SHA512
d569dfda9f0851fb0d5b2b8454704461e0185b573f3839416f3237f2d89c372e58fdce7d871f44f6f3777c7f4177009bb1fd3cdbe2f4f3d62015bd130851e8ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\tr\messages.json

Filesize
1KB

MD5
3104bcd0d4ad6b47fe36f36c1b5aa333

SHA1
36ec46c7230487c0d26e185aa82f340d8312a265

SHA256
ac2894cea6332450095a7f8fc9b97550da87e4b4b6e6fb95df1a1f49f25e0e35

SHA512
873a8e1ec1eb2b482794c51dbfdd5b96cb9e8e2b5a74db3c3b54ae78a396585faec402a054ff332551b5ebcfc4a57bfc5bd92d08f9f73acb433efe9a18d89cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\uk\messages.json

Filesize
2KB

MD5
ae938164f7ac0e7c7f120742de2beb1e

SHA1
fc49041249eaef40632f27faa8561582d510d4e3

SHA256
08978a1425dec304483bbb7dd0e55a7d850c4561abd41bac1be5d93d70465174

SHA512
b3f252885f9d7e4d74a5880b5fa60447511d4e2dce64db8ede5bd1b144f0f09a3c784649c2e1623a034ddd50b6b7ff990a3a6fc58c3ae124646c31f35b0b20fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\zh_CN\messages.json

Filesize
1KB

MD5
e910d3f03f0349f5c8a6a541107375d5

SHA1
2f3482194c98ecbd58a42bd29bb853267c49a39a

SHA256
3893c066a36fe95f06f3c49091a20290d4e071183755f40af05455660beda2dc

SHA512
387ca0727ad0869041296182f17555f55552245d38284a1d5d2652b72959cc94dd345f8a1d6d15f7f5477817df9afa045f2267269d0d66938c7d401b4ca2eb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir14032_241612107\CRX_INSTALL\_locales\zh_TW\messages.json

Filesize
1KB

MD5
b571e4cefd96a2651ffb6621c4d3d1b4

SHA1
9fce97192139d1ec0885fd62a059fa81e473f9c5

SHA256
16b8f7be42b982d5ad9f638e71da38d134394b9bab9255f73cf514abbfaaf146

SHA512
6a315031b7c3e7b2cdee7a835aaad7fceb07d2889e4401e3be6b3a8c6492a47a9a065aab85fe2a69a1eca6bfe4a733f8ccfe8c5ec2fef681aadb77c9f5e57eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4700_845878628\b6967478-e793-4bae-8267-b255ece38144.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir7456_1074052547\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir7456_1074052547\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir7456_1074052547\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir7456_1074052547\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk

Filesize
1KB

MD5
7b6216a31eea8db3ea6c3ee4ee2ab988

SHA1
750854acbf516f8699468ce2a10cfb726a5195a8

SHA256
93908cb721de9458bf9e4d9b741294a42ab2ec6d2d41a9fbd8e141cd3721b955

SHA512
f132c1103e76d81401dd60cba3ac76806bce3a350613f0cdab6f90361af257c3baaa978974f17122cb86b0ef6fbf893c69655a4a7d7c6cb57ba3a1f184716f30

Download Submit
C:\Users\Admin\CBKJEGCBKK.exe

Filesize
251KB

MD5
58d3a0d574e37dc90b40603f0658abd2

SHA1
bf5419ce7000113002b8112ace2a9ac35d0dc557

SHA256
dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

SHA512
df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

Download Submit
C:\Users\Admin\JKEGIDGDGH.exe

Filesize
850KB

MD5
260faa08dbff4bc7ca6346061f42b956

SHA1
ccef508bb2693b097510015ef89ebb8f0289c5c1

SHA256
c47a55b842177445756163ca2d5cadaed5cdd4d313d7897b9aaac8e1d1c6e810

SHA512
ae30c903720f58abef12b9e091872d4a6470bae5ba246fc1d35dbaa4aecad04803647a0339490090a037de780b09df4282d5cc6247731729bf24e8fe872c42dc

Download Submit
memory/60-771-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/60-770-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5040-789-0x00000000007E0000-0x0000000000824000-memory.dmp

Filesize
272KB

Download
memory/5140-824-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1166-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1331-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1326-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1325-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1324-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1323-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1322-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1321-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1312-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1318-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1300-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1296-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1189-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1179-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1178-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1174-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1170-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1169-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-762-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-1165-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-998-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-860-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-828-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-763-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-823-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-822-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-818-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-815-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-814-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-809-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5140-798-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5184-791-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/5184-0-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/5184-394-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/5184-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/5184-3-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/5184-2-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/17524-1364-0x0000000000550000-0x0000000000594000-memory.dmp

Filesize
272KB

Download