hxxps://drive[.]google[.]com/file/d/1WJ-jsUX8ZUwMf1xWO92JNR1bwgKuMgzD/view

Analysis

max time kernel
83s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2025, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1WJ-jsUX8ZUwMf1xWO92JNR1bwgKuMgzD/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
19	drive.google.com
23	drive.google.com
1	drive.google.com
2	drive.google.com
12	drive.google.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\gu\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2664_1103445665\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_1154934984\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_1154934984\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_588952538\_locales\fil\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880461447069746"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{6D9AA2A2-FBF8-4DFB-A994-EBC4A2063B61}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{7AF91338-EB7E-4B88-91B8-E4E3F2417262}	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{F669C3D1-A5BD-449F-95F9-6895E44D1E39}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4824	chrome.exe
4824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2432	2664	msedge.exe	83
PID 2664 wrote to memory of 2432	2664	msedge.exe	83
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4928	2664	msedge.exe	85
PID 2664 wrote to memory of 4928	2664	msedge.exe	85
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 4924	2664	msedge.exe	84
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86
PID 2664 wrote to memory of 2080	2664	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1WJ-jsUX8ZUwMf1xWO92JNR1bwgKuMgzD/view
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b4,0x7ffc7d12f208,0x7ffc7d12f214,0x7ffc7d12f220
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2172,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1732,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:11
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2372,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4964,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3440,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:12
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5348,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5856,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6240,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6712,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6456,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4176,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5056,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7000,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7012,i,3648434717887446458,496872678747338843,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
  2⤵
  PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc580adcf8,0x7ffc580add04,0x7ffc580add10
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2080,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1472,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4192,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4640,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5184,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5440,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5636,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5632,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5448,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5728,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3460,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3456,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3240,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5984 /prefetch:12
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6060,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5276,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5380,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5460,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5772 /prefetch:9
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6288,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5856,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6580,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6612,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6636 /prefetch:9
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3472,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6428,i,16145935016744089940,829711727178512767,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5692

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
71f282b7d8bee7ef97fb56f213dce891

SHA1
04b026d5fec475ce267b12d1e570ccbec2f5d113

SHA256
5c1c496301494cbe5de5039fe4b7b7ee4035fbe1ae032882d72a8e048283c48b

SHA512
0af65a565967c0d3c56a5107084c341448060b34f1187e50bea8ade12d64fdfc96a5006d3373f270f417ebf607ef6a7adb2314177712ed121e76f52ace355b67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d6bb56134b18f22a8da59821136aa49a

SHA1
1f4ad6260f3875c94b9af249cb0eb527d97ae7d7

SHA256
9537d9330b407865444be452f5ff62f9fcd294e6973a19547b257f8438ab0867

SHA512
8c16bd1c16cd82d2d16527fd7bf35b90608dc7de792222c1e1589c36488f34d3beae4cb212cb907630b4695083a161bd722447f1bede65fc56ee59d9054d7f66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
63KB

MD5
1901d2bcbbabee4bbb9804c30642ae2b

SHA1
f31774bc12614be681c0b0c7de3ac128f0e932db

SHA256
15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310

SHA512
bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
21KB

MD5
ea2c3cf1be388bd3fbe9d0cd8afee11c

SHA1
6647cbaf7bfedd842f806549f5c3433a19eab1ab

SHA256
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

SHA512
2b260f63cd6bd0c75a3e6ee9eb5fa5b477f1ab2e107f682165c8a4bdcb9a6cfbfd21ab172ce165a3c2ebf451ab91d27070ef5e4d985ef3105ebcae964c6d8870

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
21KB

MD5
d4ff90db5da894c833f356f47a16e408

SHA1
30606044507d81b996c992895ab16b8a8d68be97

SHA256
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

SHA512
85c6305ee6973ebf449efcfc95bb10a66e5cba92d026a2ec4f1072dc8ccbc5b4a4a384fe425e53e2dade2180f37cca56243ed354033cfca5821cbb77fb8b0fa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
109KB

MD5
78bb705482d8b08e17dc4f1205d93ca6

SHA1
ba6511173d54c54ca24d9f0ccb9e1de25778d636

SHA256
3a709d97d1673cd8926742124d67e4f41606115f36c530b797ca63890a23eb6e

SHA512
a1ba7fadb42f9ac5358b3626d14041e5a4a6ae164d0fea9b7a324fd9f3de86c269ae42c68e15a9593b9a8fda69bf6ca1d5f01d6c1da0ab0e2ebc8c2c3c0f8485

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
37KB

MD5
9f4e2b84fd554d87ea5d5f3ceb827080

SHA1
5bf9aa9be620dd8dd8fb9b66855cbaf95eb38fc7

SHA256
2709a9e1331b3ae04fd54d88197963881fd6b5ba310f6c8f91ce848c282ea5ff

SHA512
089293df87372355fa5f4b7d844b19b240c19ead8e28b5d0fa002c065f76b9b6b2c5be0a794081421592214f07c9649241c9972207cf7346caf256d59cb82c93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
21KB

MD5
9f69c29ae87e4f66a6d4af08393ad5ce

SHA1
6907f618b8ffb57910434b99d0c2cacd826442c9

SHA256
c3f8c3da4430d08cda67d76bb22d139eb22bc7f85fb703e2121163dd2ffac787

SHA512
e9ad138e598e95a4ca6cef01b14ea8459076a9fe6c84b1db4902c8893a499f55323ffd00673971158ed031f725439b07c2165862ee6f8d38a9a0c1cc51e957c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
22KB

MD5
bc5d9dbff2ada65f31a6ececf5840f1c

SHA1
b7c51c31c4a290ab037b45363872dc1ba99a77ec

SHA256
e7b23606a03faa33827b847cc9750926ea701b8011b48fb89fda2b3cbfd0a306

SHA512
fe111cf950ad3254b4297f29e569d29a11b343021a7ba82d59e9e86580a4837a6077533fb443c653d5e1ac83b636a4c283bc7c1ecb50858c7f82ea68fe38894b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
22KB

MD5
baf8dc12d0df9d43ed3c300fc74c8066

SHA1
3b695acc657260f3d84256284e0b91b0315afad8

SHA256
534d6ba8455f4511cc0634d819ee19b35cc771f802dcbab9d2817be0c2a93ad1

SHA512
1acf55c4a8d1d17fd92c2983e3de02d8351acd4bed80217daf97741bc108933920cfe03008e9f105dea18cfc74c383cbd4171aa8ae106c47ce6048930dd55eec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
31KB

MD5
a9437e0d26ef1d5c1ea54773711b33c4

SHA1
b32f14d4a3f2059d428b0f792ee20b97385c86ee

SHA256
b36a67a3760d8510ed470e99154d4256991522b75ef3769692b8e382ecf0ef0d

SHA512
c5832cdc96e62f4cb4727f28f8784db20594c8717519690e8d1b1f8c75033dc1dfed78345a67fcbd74ba426340bd265b00e986a98460a5ff65ac4029cb3481a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
42KB

MD5
99f9cb6ece1c506229793a94ca0d5818

SHA1
3b68c6fddd1b278e14c6abc398edb381a33f1542

SHA256
44f5d1d26855fe9888c901a8fe4a1e40406610ed4c292aad42f9ed2f7035c331

SHA512
67787c17f5d7b88049d3e61238f572618a182841740da083c63471523e059b247757ad572a6d312edbfda0346af392ccf5bef3437db01fb191d1fec6e19176bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
92KB

MD5
33ebcedc433542e1158e3336bb962feb

SHA1
e9ff479737b3fc0fa35cfa6fb61dfa91f6aaeb2d

SHA256
8af65407e0e685d83c79e951a07933789b7e31e0f13cd2e1e95680b96722d579

SHA512
175acdcd46a1cced3595aa86bffbe546082f75002d363e390cb51e4193814c43e0b8f72e07c4227255f8abdfade0398d3ad7e93c88bbc065a9b8a969f50de5e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
25ecdcd9fc818c16e538a27b56671d45

SHA1
fc31297e45c0272ab77fa3d92392defdeee389de

SHA256
3bbe3873db236dbe42e08a1d8f1b1c57ee1e596900949ca0594511100769906a

SHA512
7a89a770ad07e2a650514186378b626933516f82f7b148f7a37b29419eff9ecec2b6789dc3e0e1a0ff2f4a4a14194016ca22d84ea689a090651eb721b9877f23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
54947c0415b5bc604ddf78692dd3bab0

SHA1
51af0993d63d7d56c591eb2793699ea75202aef2

SHA256
a526788fd8ead8311133d40af1e38b4d546e87fb5d5a6dbe73f1ac7828ef8c30

SHA512
d5683c7b4f387d18f148cde00c32249c7a3a59607697863b463089b5c414b82f687b40291b72a262d8622102eb69ae85cea20cccf5966121633927e38c301919

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5ac25fa4e11b6fc3568e5f738b4bb7f2

SHA1
fa38a31d53de9e6a113c26f81c77f4576bec44a2

SHA256
bcad17f557dc7ff715928d48ad62057c2a3f63aa7697b7fd7446afce88ea31b6

SHA512
3db77c50839e2e4d545a9fde1927bca7b5805b992eae277b19456553173cd95ef66545edc8bc07718ba084eac06748545580247706fc367397ff36537cd95a96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
ef5f121ce044c8e1aaaa19526e2bda1c

SHA1
9903ff95b7064eaaffbe911d2c87718a4bc991c3

SHA256
39e42b95339a8706742a5b242f0e46ea69a21f1c46de0c415462e7542925ff7d

SHA512
20eb54e703751015bec8dba0fef2b0cecaf471a74d5ff7b77a02f15721861be6d13b3b06dbc2b07acec5222c408775c929fe29dd48bc94c092b6d79af5c53b74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5234ee60e2c2bf728451ac6af3169417

SHA1
b01e6322264c6ad2aca1c49a2a2215a1e30a7229

SHA256
e29f0d9021cb0f3f6aef6f4b589bc63879bf2b62e5e1b7c0d5464522be479726

SHA512
c34062f66d662b63ed649a60d79b193bea52fe2417ccc24b1a6e7b3d35585b583440a58d187923e0200bd93bb4fc425ec1cf79f3192b8e9177c2575ea5cf90bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
884160d667529b6c5d131d19d6713dde

SHA1
bb8dd1163aabef19c3242b89d33cd864077364a0

SHA256
6524deaace56e6a4cd82d0de16001ced30d99e1e9d573554d04f2e51ac234db5

SHA512
34fe979c007eca75d84a00fd249336960714f1a7194fa4ec1b9c606932e02f715832daa51c9d68226068e2d01bef7f9478a95abf4c41887ac4386a6ec4ee93f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587903.TMP

Filesize
48B

MD5
7ea93e930b903fe47a7994ef0dfb9117

SHA1
c750e16285e1d3f86fbb1f4379ce6da8ea188c3e

SHA256
43f14f490899dcf2b8a7276e8ec48f208a83852f51cb377b296d1f2f5588ccc0

SHA512
192776ee8b9119081672f51c63b70c25dc312f027b5585fc6064f576d0e7fa1be2cb8a937c6a36069a3e80255a79a9c8e2379efabc3015b0862a701f399a24b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0dc4ec8-e11a-48db-b958-1e6f786f49c4.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
1ecfc4618705c0ee5b21303592036c1e

SHA1
20b63698b6092b70f42442962f04d688ab665ae1

SHA256
f370e8d49f1932281541ee30b59efc6f53403128246234556fe360467695fda6

SHA512
500aa93fa51b0b37028dda6b4799dcf97b074dfc0bd2c18832f0d366728505725a87cfa2402a10420d1c3654d26f20dba6db1f1f7f4f36520909b0a354bdcfbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
072c965b2d70ca95c30573877192c991

SHA1
2de55be01f0cf625427d045d6c657c7a4e60b7d0

SHA256
69b22ff2f1e3fbfd93de5adfdd9f0a268ebf1c83260527cb3b2a75c85256bda4

SHA512
449556f5aec5025f44894617753c1b3f530cac522742563deb1f5dd0ab69993d4017c511ba274f56c3d730903e34bc40a8ad38a233fd7b4da77bd50d2c39f069

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
e3601035ca3686616259dc8ea114e4c9

SHA1
eb1b47faad7c8105128136a5215d4a02ac98f7f5

SHA256
22b1d29c6d51b0a3451405683b1703fc9201d2a1b46bc6e5e6ac76154a18fc55

SHA512
f278fc75a8b914e8b25c2201f5ff0f6bfa76b4e95c93e39e826b1c7d0e9a06183d34b6d39fdafa6cb623f46e1b2ee23aa134efe0f0dc23c74cc738e1dd64dfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
682ff716e69471147f7a0e231efe86ac

SHA1
937de827ecedfb18ed3f399ac647f88f2579c6bb

SHA256
11e566a5d7934e7f13ddb561000aafff386430a3df22a36424f2101e9ba76662

SHA512
4fffcccf9a78aed772e46ff48f817d586934c8d46434535d25b080c4fa264e018e6c2fe389d8d42b1f3b911e402abbf00affd9b890b77ae68d7074a31ee3e93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084

Filesize
24KB

MD5
c22ffa130868245aeadd35c00bb86558

SHA1
b802b30c3df2d4a8d198c204e146d8e2461a12c2

SHA256
4cdd79dd720fdb9762157661aa682df45e68d5bb8f6cfd74ab1bf2f8db68c8ab

SHA512
ae3c0dd8d553ca6a795ff8331c5b0fe7a5a0a855293af3514a6f1a1951701e22ee29498458860be959b3e8f41eb385ebe93bfa0d33d546c5fad3a91fa6a43aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
79ba6639e1c7642ed543b9eeb17b93a2

SHA1
ce117c46c7cc38693ab3d9943e5552015d8e4e40

SHA256
fea0bdef027f1bdf2fa5c312b795ada0b78367e03bd46951c99708d60726839b

SHA512
aa3bcb4234b09c66cb9d26259683ce0154e4d4269404654b9078331145f91827f722a76c30bf65df4cbd145c0d8d6587fdb8fc302ee8b812ad2c1353325172db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5857ef.TMP

Filesize
3KB

MD5
ac81612a81d0d8d01438063f12b67a2d

SHA1
d2e45c90d13b4df2f4b53a2e4b64fcb5a5342118

SHA256
9407a32fa03e087e79443b40b2b3eef3fbeda63079b9c24b7e85682490c185b1

SHA512
554f26cce83f8e0ff1be004a47a371a7404f7aad2b791418fefeecace859dd4a7d5a989dcd6317d6c5acd9bc15f1137bf81446dfb94d55d5b207fad958522509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
28ade0725d8b057427c1fb90085c85d6

SHA1
14d0f48b56e103bee5d9b056a638e56738dc340e

SHA256
5c93e69b2724e97553435266aa063fd01530f504a1304e293b8845c897739429

SHA512
ff579f91e7117a0f693d015fefdeb898d11915707bb766b9736b9ead500fdcfa76ef0bbd419bee6d91948be42aa765b4ab3cd41eef7ca98409f1a4bea139a629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b5e8760f9b622b9eb11d221ebc5b508b

SHA1
3faf37cd97f70603402337bb35be782e47855c09

SHA256
86c806135520a9582ffac96267a829a44e9f97bc3b5d8acca1702b0ac2dab70f

SHA512
4e14af1c64d55a6cf583d12af869fa6d3dd24a2a08a057c54b55be400f46d51be9e2f925c20cd4295333f766f76f5f04d11b60450e39cf3d7e36176e71857c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1660058cf2ec02b24eba668afaeb6279

SHA1
d00a5df06836c5fb1e8f00ad1b3242ee7a5dee83

SHA256
38c0f287e68ef545d2c5299b387dc597c6a437c5710ea8b15c38cb84bfeb26e0

SHA512
22f6a02ce5fc9bac0e0e75deec524f5ef3eea91231523d5c599174ef7de031c0f0fd130400ba6928aec54a34c17beb511c26923481eb1e2c7871403e96bdffbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
eff3c2fc414ab040fee81d963371fb24

SHA1
52ae855a2da1553346f14506a67c4ee6f15d28b0

SHA256
7282068b7800bac9a868d6d74b56af5482d67ad4468d5e762d7ac7b086d66f8e

SHA512
ffae36305eec3c7a46abf1ca137494d790af9e9d430be95bc8c7153e284e80c6c5ae0249b20cf3106cc76a17005bea3eda53891e4710b819d98862760a135bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
590e89da2fe6a7370689a6edd2428756

SHA1
fb5fdc2317e2e7271d2f653afbd585a846d4d088

SHA256
fa0b1b4fad4abf789ae8731feb449e94b7b47939f275c2fa86b75e1c71c270b9

SHA512
33f85f477ccd1fe98574db47c55374e02721f2c15828415c065a32298529725a8affcc5f07758d8057e665185eed17957f75e24d213d25cdc2299d4a11912941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b93647a8-081a-4629-869c-2a5341b7ad14.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
caccb162c99616b623a86faf54e3a32a

SHA1
edaac8bfef7a1ceb033a34ee63964af64bf2d9e1

SHA256
1fa6854aa7945030ac6536c4cf5354f1c94269798c4889fa55659c3847bc3d8e

SHA512
34e515319300134b67e11af61bc81ea342a6ca71edce5606d877ef2c94279749e532b522d9b91522dc0c23b0c3d87b089573cefa850a401bd3ac36bfcccc5e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
dfa84de01df4094c0ec5427a97bfdae8

SHA1
868acfa844ab3119a96d54378cf59ad227f0f05d

SHA256
b72a80823bae0d6f221ab3ff012917a111772a4a1e96a16e06def17e308a3218

SHA512
d7c04a11d38bd6211ad2ce7f7865576447b4f179b1c2a77ca2ba96a01c7367a86c7304ae418db728cf856372c76d74c1a7a879c85a0d57b0ad8893fd0afa0771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
bee9588db0409e27bbb93bf92a534d44

SHA1
18ddecdb83cce4d22a5a55c0737d9bc3dd5a36bd

SHA256
5aa63a42d673abe6e246caa75d0244f2faa5c1e59c1cc31a33b50d784d1c0218

SHA512
a5ef9f1b3503f69e221e44571ac72ebd91e2163fe41fd70b2a10f08f792f61af49dd195e5e9a365ac39f21426d06b0c8831b6d57db281dccd555e3b9dd69915e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5dea5e33d095b45dde0c8251f6693316

SHA1
01a529d53fe945b0ace2c7847de2c66c45b9e15a

SHA256
5ff8353efddbeb156bb9f29ef2400b2d71f95ec0abeda3cd6c2a10ac56a6228b

SHA512
e931a2e1f60a7d7a35853ef5643a803b85d9606750b78dd9de5db25973012522816f984587b1272133c4405bc5ef4a1dbfe4e59e3ac249aa108b931f723fd994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
206907ee553b5d1de50a67828e19b65f

SHA1
25399317214ffa22cb99ea5669bdd4414db2ddbd

SHA256
954a08978221fff0e21510623f174a7118498596fe8d4b4128eb6ef74cf913fb

SHA512
c395a6f59a6dcff9caeb31ab8f9130eb3ad162ac63302e3dd3a5a45f2d542432c2c509a5aa39703ca51952f2fde8e6ff8150a3a0403c729f8d89c46cbdf0d71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
dd67f1b40342730b2d9f4b6febd4b78d

SHA1
1bfbe1feddd2ef6eb68b2bdf9b8e9126a819a353

SHA256
de2297c8014b2f1ef6b1794813ce8745166d325d06b96b87dc1476b8dbdf6370

SHA512
c64fad9b5c9d91ef70ff858c08d3ebeae78d530abdd56ddade524c64a0a74849d6ad13d6464775c4838a23593336392e16736804b05210c092dd8204e1a36c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
9a6a6dc76bd1bc0301bce7bc53373a8f

SHA1
58bee3206599bfae275e369480ef357dc093b906

SHA256
fda001d8aef608b5e36ec54a8d54d4db398e98e7135474b681262baad285dfdb

SHA512
8c6ff2c9d99a2858d0ae95429677b7aa3fb4ea50db97b1826269d38eb818294cba722f03388825e503cc26396d2edcd201ce182fdd7d49e88c7767d62b04d78c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_937205379\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_937205379\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_937205379\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_937205379\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_1154934984\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2664_1154934984\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit