hxxp://dwadadawd[.]com/

Resubmissions

03/07/2026, 17:33

260703-v435nsds7s10

03/07/2026, 17:25

260703-vzabssc19s10

03/07/2026, 17:16

260703-vtdr2ahz3l8

Analysis

user interaction
yes
max time kernel
455s
max time network
458s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://dwadadawd.com/
Sample260703-vzabssc19s

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Loads dropped DLL 1 IoCs

pid	Process
5984	vc_redist.x86.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
360	raw.githubusercontent.com
207	camo.githubusercontent.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_669936474\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_741259925\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_227972064\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1666321485\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1666321485\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1265467009\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1265467009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1296604378\crl-set	msedge.exe
File created	C:\Windows\winnt32.exe	NoEscape.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_741259925\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1265467009\deny_etld1_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_669936474\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_2078987804\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_2078987804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1666321485\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1666321485\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1373944216\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_741259925\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_741259925\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1296604378\manifest.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_385636685\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_2078987804\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_227972064\arbitration_metadata.txt	msedge.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_385636685\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_2078987804\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1265467009\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_947698962\manifest.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1820	chrome.exe
2144	msedge.exe
5008	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275731204603837"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 8c00310000000000dd5cd558110050524f4752417e310000740009000400efbe8158443be35c2a8b2e0000004c0400000000010000000000000000004a0000000000227f7c00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\NodeSlot = "13"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{CCF2336D-9AD1-4355-B200-658B805C3177}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{2AED5628-B4F7-46DF-BDE0-E134E90B409B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{4BC19F7B-F6B5-440A-AF40-4D2B8454BE2B}	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
480	chrome.exe
480	chrome.exe
5808	msedge.exe
5808	msedge.exe
480	chrome.exe
480	chrome.exe
6128	msedge.exe
6128	msedge.exe
2868	chrome.exe
2868	chrome.exe
6836	mspaint.exe
6836	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe
Token: SeShutdownPrivilege	480	chrome.exe
Token: SeCreatePagefilePrivilege	480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe
480	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3484	OpenWith.exe
6836	mspaint.exe
6836	mspaint.exe
6836	mspaint.exe
6836	mspaint.exe
6836	OpenWith.exe
6896	OpenWith.exe
6896	OpenWith.exe
3028	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 5908	3912	msedge.exe	88
PID 3912 wrote to memory of 1692	3912	msedge.exe	89
PID 3912 wrote to memory of 2144	3912	msedge.exe	90
PID 3912 wrote to memory of 1692	3912	msedge.exe	89
PID 3912 wrote to memory of 1692	3912	msedge.exe	89
PID 3912 wrote to memory of 4876	3912	msedge.exe	91
PID 3912 wrote to memory of 4876	3912	msedge.exe	91
PID 3912 wrote to memory of 2528	3912	msedge.exe	93
PID 3912 wrote to memory of 2528	3912	msedge.exe	93
PID 3912 wrote to memory of 2528	3912	msedge.exe	93
PID 3912 wrote to memory of 5176	3912	msedge.exe	94
PID 3912 wrote to memory of 5176	3912	msedge.exe	94
PID 3912 wrote to memory of 5176	3912	msedge.exe	94
PID 3912 wrote to memory of 4192	3912	msedge.exe	95
PID 3912 wrote to memory of 4192	3912	msedge.exe	95
PID 3912 wrote to memory of 4192	3912	msedge.exe	95
PID 3912 wrote to memory of 2860	3912	msedge.exe	96
PID 3912 wrote to memory of 2860	3912	msedge.exe	96
PID 3912 wrote to memory of 2860	3912	msedge.exe	96
PID 3912 wrote to memory of 2356	3912	msedge.exe	97
PID 3912 wrote to memory of 2356	3912	msedge.exe	97
PID 3912 wrote to memory of 2356	3912	msedge.exe	97
PID 3912 wrote to memory of 5568	3912	msedge.exe	101
PID 3912 wrote to memory of 5816	3912	msedge.exe	102
PID 3912 wrote to memory of 5568	3912	msedge.exe	101
PID 3912 wrote to memory of 3032	3912	msedge.exe	103
PID 3912 wrote to memory of 5568	3912	msedge.exe	101
PID 3912 wrote to memory of 5816	3912	msedge.exe	102
PID 3912 wrote to memory of 3032	3912	msedge.exe	103
PID 3912 wrote to memory of 3764	3912	msedge.exe	105
PID 3912 wrote to memory of 5616	3912	msedge.exe	109
PID 5808 wrote to memory of 3104	5808	msedge.exe	110
PID 5808 wrote to memory of 3744	5808	msedge.exe	111
PID 5808 wrote to memory of 5008	5808	msedge.exe	112
PID 5808 wrote to memory of 3744	5808	msedge.exe	111
PID 5808 wrote to memory of 3744	5808	msedge.exe	111
PID 5808 wrote to memory of 4008	5808	msedge.exe	113
PID 5808 wrote to memory of 4008	5808	msedge.exe	113
PID 5808 wrote to memory of 872	5808	msedge.exe	115
PID 5808 wrote to memory of 872	5808	msedge.exe	115
PID 5808 wrote to memory of 5032	5808	msedge.exe	116
PID 5808 wrote to memory of 5032	5808	msedge.exe	116
PID 5808 wrote to memory of 5744	5808	msedge.exe	118
PID 5808 wrote to memory of 1964	5808	msedge.exe	119
PID 5808 wrote to memory of 1964	5808	msedge.exe	119
PID 5808 wrote to memory of 2056	5808	msedge.exe	120
PID 5808 wrote to memory of 2056	5808	msedge.exe	120
PID 480 wrote to memory of 3732	480	chrome.exe	122
PID 480 wrote to memory of 1820	480	chrome.exe	123
PID 480 wrote to memory of 5700	480	chrome.exe	124
PID 480 wrote to memory of 5700	480	chrome.exe	124
PID 480 wrote to memory of 2312	480	chrome.exe	126
PID 480 wrote to memory of 2312	480	chrome.exe	126
PID 480 wrote to memory of 1176	480	chrome.exe	127
PID 480 wrote to memory of 1176	480	chrome.exe	127
PID 480 wrote to memory of 5108	480	chrome.exe	128
PID 480 wrote to memory of 5108	480	chrome.exe	128
PID 480 wrote to memory of 3720	480	chrome.exe	129
PID 480 wrote to memory of 3720	480	chrome.exe	129
PID 480 wrote to memory of 3484	480	chrome.exe	130
PID 480 wrote to memory of 3484	480	chrome.exe	130
PID 480 wrote to memory of 2044	480	chrome.exe	131
PID 480 wrote to memory of 2044	480	chrome.exe	131
PID 480 wrote to memory of 5164	480	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dwadadawd.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff9ca16c188,0x7ff9ca16c194,0x7ff9ca16c1a0
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8513937580647892066,8485413276374281328,262144 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10719537204000659258,16452002110593944463,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,15367093155867672412,14365325255165150407,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3664,i,18307838094706940043,2723087550239343029,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,11052671495098466709,3001772804601574754,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13962600282690383826,11081948595053904311,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,10071231773459151131,302463834336601398,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5280,i,4231857080259516461,15654105044315933107,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5440,i,4613299039819855523,13309278417375404747,2097152 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3140771646718100186,11371362526933407621,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3662153056995099736,1180877807919058125,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,3408889691491331550,11532596171163437137,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,3408889691491331550,11532596171163437137,524288 --field-trial-handle=2324,i,11763455348804970127,6312196146461690604,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x32c,0x7ff9ca16c188,0x7ff9ca16c194,0x7ff9ca16c1a0
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15602097006634526019,6038575043790658398,262144 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,11812400268925367364,5541841974472742148,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,9523388026186946122,4092432859944694562,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,2722187668880596300,4173668687071713711,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,16868224938395630398,5745298505740470126,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,17471820191011227518,526955224186087887,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,17471820191011227518,526955224186087887,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,8411581777532602545,5858695796505411847,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,7316862317653449155,15193672138768166592,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,14473847603267535542,16880927036966191894,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11352835108679726288,9041104876361653269,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,10697040203514226685,6383106265187397465,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11527917229809447378,14821886987575380492,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12032794584553161672,14227714713425415458,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8943471854898311866,7225459736519320663,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,9593064158924455249,8485828774811704841,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,8885196407542847112,8137606285733888227,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:7536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,2674402830168776450,14374393827658353543,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4984,i,4463471485867902799,5955531459875610644,262144 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,3100405037123986369,8163218035640872997,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,4260121918165011370,12711326291996739681,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,2541778751250379104,15014226296577252799,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:14
  2⤵
  PID:7288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,7878955127103082762,11152835397733748299,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,1531878058103310007,452005339344667275,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:7232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,15447406271906212209,13786842234171642992,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,10545575960439912095,16762870477151969377,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,15462325867973077491,3864189154695013054,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=1092 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,15247999363990567384,3698554409334659187,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,17535966824434801916,10013664734053639822,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1092,i,14326698759080649511,9774827658478661564,524288 --field-trial-handle=2880,i,14623284932553470704,2554691792217044372,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:6436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9c86ec728,0x7ff9c86ec734,0x7ff9c86ec740
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,2815405801671592880,11411655462927671835,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,16494757732925618816,2916489858558344376,262144 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,4229138303707228707,12458955015697848313,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,8394453739629090185,13577371498288844971,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,10152233741000075634,11618384890895859837,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,3043824953930271677,10405564480057205095,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,3800694313769665935,9979029631308710948,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,2482812467037403571,9313447006545693778,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,5970874368862129181,1940473034885975949,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,3429405858148499295,5921775561685913342,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5508,i,15063135604531876966,6469771113433095835,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5164,i,11189596956471500363,8603578863254161262,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,3992718679603503373,15964482387626694798,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5664,i,14632095005350564104,8519575252935288490,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5568,i,7119299546392311244,6941754952589492128,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5516,i,15915243062711615215,1222266395071631952,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,13341079176155903604,13497826977253098898,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5556,i,15493140557142731484,16569445969065959541,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,1816311931262122567,13153595299211388845,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5764,i,8791136646782696863,12494676143444072480,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6056,i,13294281768554888206,17837805395581255411,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4728,i,15283518576539858150,3551176545076412376,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6252,i,13693636334987326890,17762718540870438882,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5560,i,15044429764526090943,4784846981695523838,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5532,i,7465161212957383667,6649930407916465094,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5512,i,7137641680871870681,3125649959823939534,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3592,i,1024707285709096483,8916575651224997113,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5524,i,13651281840932261432,10617473827276952744,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5776,i,14242305524923661675,8978044257751579841,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:6308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6392,i,2123050796127456014,4512921298102421470,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6564,i,3440781333077528315,13748872157772893685,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6828,i,4023322697095732773,3872758825777285854,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6888,i,9407327103948667215,4158764792237044244,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7052,i,6412352740125946183,13238105678704785227,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7208,i,9932903361111930881,1489210212015953628,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7448,i,7726819825410788130,14544690359348524881,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7644,i,10256896929986843837,16533577613631427407,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7808,i,16483679772840247917,15250614136007902256,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:14
  2⤵
  PID:6792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7812,i,543091607559139908,14678834273250998838,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:14
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7816,i,16110850429236039614,1301322690795982335,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:14
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6788,i,895110126180409959,6302620368378543763,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7992,i,6889578261067490445,6091267334835215756,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8148,i,16597127515849488294,12838888164689072957,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8328,i,2534863733757959952,16118138158356025832,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8304,i,387623952046437735,15451895600878841047,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8308,i,7024753883163426355,7060472304712368667,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8400,i,9720449431339348690,11271403831474077078,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8844,i,17633606809441360336,2455116738891843025,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8976,i,6371172991916166824,2539867129239143083,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=9236,i,7926074089800193069,8159682100837833825,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=9392,i,8959987492773332332,1456928715431089113,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=9544,i,4091777335738077605,1748210950660910432,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=9696,i,15605542154373195038,547174508103218548,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=9756,i,10135149579376415418,9210663311257217118,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=10024,i,4421272573575148170,5827830938931748778,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10020 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10160,i,5015835358671931351,9033733445003774539,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=10308,i,13212223933363735119,10084734196367394652,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10332 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=10460,i,15548705290198058296,12315769533116642115,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=10052,i,11147320294581151360,17586728637553082579,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9988 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=10712,i,831763813045856273,9594447502203067601,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10724 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=10292,i,8959079948628840563,8777458837967589053,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=10968,i,5267985586383128203,18371118118530915701,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=10980 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11116,i,2460268347468186233,13285561772288156527,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:1
  2⤵
  PID:7396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=11260,i,5849370606994589425,518895696465913299,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:1
  2⤵
  PID:7420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=11404,i,966483921576455002,11455051622905183877,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
  2⤵
  PID:7428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=11556,i,5735728503798419194,11125854422986705304,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11576 /prefetch:1
  2⤵
  PID:7436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=11908,i,11267015579141159994,3161014574866263219,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
  2⤵
  PID:7660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=12084,i,29810113868510406,11442774250843211904,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=12096 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=11996,i,7764436993253321917,3214267857902378380,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=12224 /prefetch:1
  2⤵
  PID:7676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=12252,i,1325549721117981208,6967489935168847453,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11988 /prefetch:1
  2⤵
  PID:7684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=12256,i,7427939683062334639,13109565212154168081,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=12260 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=11876,i,6225369434937380817,6779248851991838120,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=11868 /prefetch:1
  2⤵
  PID:7700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=12428,i,47363283516476386,12700042284796391160,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=12444 /prefetch:1
  2⤵
  PID:7708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=5500,i,12179523014365444182,7023485952099761151,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:7892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7932,i,13638512283923494455,12672491633015744279,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:14
  2⤵
  PID:7696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7492,i,16968646311401535123,4433492716952843176,262144 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,17783688497566180735,2880373818350968522,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:14
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7108,i,1285201275777373141,14162497565432570816,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7036,i,11873803110880862565,14969870721588617908,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=8040,i,8771500531247460230,1561434011102528665,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7336,i,3632116913201098196,4022655527727499136,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=7224,i,4230125729432770792,9099345094891177383,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:8012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9104,i,10084315381545853805,14222455636336828680,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=7256,i,9867795734054899193,2863342345686430686,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=8124,i,12447025119811756069,14486416933160442,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:7884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=9028,i,5075175797914676863,16566016422218740389,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:1
  2⤵
  PID:7452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7192,i,8363448217894642328,17214313288326752944,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7184,i,2417577344967453361,14914443872667061309,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:12
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=9072,i,7321926528354338123,14042567443923846497,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=8108,i,425326422726111173,3866346490705967609,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=8676,i,3749982516564441619,15731849972303021650,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:6540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=7136,i,18032811441586049098,9795107389371178486,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=8676,i,18338747707416243821,10824109196899614347,2097152 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:7832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7352,i,1079748401136584292,2646538136433234619,524288 --field-trial-handle=1848,i,5842288421101362587,15722746152108178004,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
  2⤵
  PID:5788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7788

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Malware-main\Malware-main\attackers.txt
1⤵
- Modifies registry class
PID:772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Malware-main\Malware-main\STOP\stop_cfg.png"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:7456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6896

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3136

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7048

C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:7048
- C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\vc_redist.x86.exe" -burn.unelevated BurnPipe.{B0A33589-7AE7-422D-AAB5-3FB99179C2FC} {5FFAB461-ECE3-43E5-9012-FDA2FD074B68} 7048
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5984

C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3084

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 21KB
SHA256 40494c4f258c74f72424e21cd254ad1a4c577df43931500fd2fc8068db3917bf
MD5 49ec59314ba4762f13f722c4fe118d78
SHA1 970de6367ca70c3220aea0605e6ae5d647f05c85
SHA512 a476a32e8626bad6d6969ae8644c945443856c1bcfb1159ff4a35fde934f6027f65db46912d4967ac2944889d54cad59e32ffdc5f8cd05f2632345ab8e54eac1
SSDEEP 384:kCUiSoRLRaVYUG1C9IMVs8aSmcYp7f1yWm8uN2sN7Wg59UGbpQ4K:k2SoRLRaV9rVPmrptyWm8uYsNZ59Tp6
TLSH
T128A2E15B952199F43A5E0D0309B8868AE3798E3AF3F893A41690473D08F05DB917B5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000087
Size 71KB
SHA256 e84e513367a7406d0ad6aeb683564f94de0b7e8d1aa74758c7d639fd86d55496
MD5 c234b53c6ec9aaa1909a77189476bd09
SHA1 3c5059b153c5ee5419d31f8eec93cb82acd62b5b
SHA512 55e9662bf70bb10b46545f58a6ae626db799078a3226742aec5fa3da034220972abd94ef04da15c4f6688b4a146c1fc9fb353f4d336ba02008ed3aa31f743744
SSDEEP 1536:PdbCwzHAikqjW8pkBnlRGp9FY3MuXjCzMk1VlvYwyKGj9aOzm5gncbhtK1:NCuAmjW8+Bs9FY3MyuVlgwyKW9a0Dcw
TLSH
T1E663025934459D8B6A07EF0709DE2BF9241B66C2E8947DA392B7C59B011013B360EFDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29fa6c41c85f471e_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\29fa6c41c85f471e_0
Size 305B
SHA256 188e09808019ee88c07b319cff8fe79204abf3ec5cb1303c6a0b653d4bb5cc8a
MD5 5a924590963c2c016b840815d24fbcde
SHA1 06a9ee6c09e795a6bb617be3200b87e700fe9d28
SHA512 278f1a0adf60d0c7d92f2be84331f6104c7fd0b50105f6facba31efe323bb7357f8a75fbc23fceb36947203e22b4be2936a63962c273aac5b4e1945f178c12f3
TLSH
T170E0EBF304C8B250C23CCAF8E222161CA3B2500C0EC9C0CAC88051F327D12B446C4793
MD5 SHA1 SHA512 TLSH

Submit Download

a81653f334a74bb1_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a81653f334a74bb1_0
Size 58KB
SHA256 955fc7ad9f8ea82f63d235df60ced6a30176e07c93c485e830e6e0a91f6a7822
MD5 804e880b211bcd9e4352d4ccd44886b9
SHA1 6c15de16a73dd11ef0f8d7d5b5da6f5cab98e9a4
SHA512 314ef3fea666d825c1a95e51a401eb1529bce3100f025194145d4224494f25fb27a469135c2e1b42bb3e34d196804a9b9173c764d6d5417aa5fe9ed864a2795d
SSDEEP 1536:B91GyHi8EWzleu8Y9F1rxHYEq7P0LPd3QJcT/I:1GMiJ2xHR/LPzI
TLSH
T11643D5CFF2D2B37198E361F101AB8509637EA5265CC8542F7909F6F47A70987406AF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6e5db34d3e7d621ae43bb8ce6627456569ee822d526e741fdf9665cfad153186
MD5 dfa592e229117afc2a7fa83d696ef2aa
SHA1 4210b6d27f7020b09dc7200e63470b4fd81d1888
SHA512 0855c7d145b341eeef81a01a356b5188b13734a039bc3f10fd928161db176fb1d6d762cc65769c78e656442ac9f000e8d1de895095de151634c28c57179b5596
SSDEEP 96:ZrmWhK5/3VTRbpWSwAVjxLLiiFds8ltPXZ0dVkcdNTYe1Fnr9j3Bt3mi7n:ZrZUx34RAbi0dvINTN1Fnr9j3Bt3mC
TLSH
T19DE14FBDC389E2E1DF10DA3650DFCEE1397A644803434EB34452BB78BE4F3A80195156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 a2a6887178b83f933680b77f567cb8da5fd6603e08a18f2e08f4b8fdaae8cfec
MD5 edaefd234b70b0a28d413c99c42b4e37
SHA1 7af9986cf639f85bd18b8e66308dc3ea1647e3b3
SHA512 59dd295c381ed3c0e2409751cbaf3cbb0b5deb1b9ee093701782597ecd83d338af11f55c381ea3dba12baf889c4b8e12607b2d11a054df134a2a80dd51e72202
SSDEEP 192:dpoCD4NwZM+/mN0+EYlvp7sxRut9/ttQmS:0CUNB+T+xlvGcP/tS
TLSH
T16A124FBCD39BA2E1DF32CA3650DF8951FDFA84C812870E674471BA79394B318D16116D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 55f876f3c3cc00d3d5386e865aa1bb551b0d9af7bbcdac1084bf61fb008762b2
MD5 8f35564594d5274642098bf567321030
SHA1 14079eb9faeabaaa2adaea5437ce083d18679db0
SHA512 c784bbd2d414d501783dcafe9e9a342ccc6d42e2f86dcbef6075e5a7f9f3b8e3995c573be5831fde66ddcbbe2b6ffd198aa55c02d966b6104779f4a2066c534b
SSDEEP 96:ymWhK5/3JTRbpWSwAVjxLLiiFMs8ltPXK0dVkcdNTYe15nr9j3Bt3mit:yZUx38RAbi0MvXNTN15nr9j3Bt3mo
TLSH
T10CE14DBDC39AA2E1DF10DA3650DFCEA13A7A640403434EB34542BB38BE4F3AC01A5166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2f096efcd88006b4d52f539fec8ac2a86f773d3fc3a511a2f4f24deba3954749
MD5 8f3315aadb897039f7e8e0ec3ff79b32
SHA1 ff6efcabd2932639e5df8ed98478bf41d39f3dd6
SHA512 b62f5f4eafa646baf1f6ef043bfa6cca0347346a1a3615e1fb87ea298b9adaf9b1af506ebfb06a07f5aaf2d1ea6306408d9a1928f622c0a9d9b7849bdf902d81
SSDEEP 96:GBhKi/yJ9F7bpWp4PVjlLGiiFOsNftIo0dZkcBhvYe7Fb9j3RtkSm9R:GBUKyCmPai0OychvN7Fb9j3Rtjmb
TLSH
T11CD10ABDD399A2F1DF50CE3A50DBCAA1367A454803474EF24582AF3C7C4F39C41A5266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 45KB
SHA256 adc6f5ba394e534feb0b6d983be263fb7d916e09d7179720a0532243278b638d
MD5 d4e0aca25125700d7b945ef4ad89ba03
SHA1 d33a5428c112978a0cbd89e2dd68a6288ed2d1f0
SHA512 27f36bd7f7e4e213c2575a4ca7176d2959dbcda29791e16e9a09e1ad210f9084110d274e8685c5e68ece449c769a3cd8a10e90bec329e0debb89deaf55fd1559
SSDEEP 768:0SZBul0vYncll44astlo3gCAaZJaThF6LVikscqJhi85:3ZfllUqs6kVg
TLSH
T1FF23A0F783F4953ECA0191F2FA253E2FCD2A05245B1C385A85E56F87A7EA432D1815CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 44KB
SHA256 e4a68aabdf6ea4e14ca815759e35a85ead9cb5ec44b6fc038344dc659783b716
MD5 f63004afe2610e46ff16f2b2281b62c6
SHA1 824cc73c1f72a0c2846397d557abb0ee01dd2fbf
SHA512 cdf9932c574dcb13a23af7b2e821f866bc67c356372250c0aa011235c23d342a1cfbd43f40bedc2ceec689eb13126e63d4a0421f02a216991693bc627342dbfe
SSDEEP 768:pV3k/T0A6uQtLc3gCc0ZP2kj26Kuv4Yq8PSi5wAFIWy3j:duo2ApuYAFITj
TLSH
T1A413C2F783F4953ECB0191F1FA652E2FCD2A05244B1C386A85E56E8797EA433D1416CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 44KB
SHA256 908940c8ff265782084e250885cfc377c2e09dd96f055787a90cd95a03aa3a24
MD5 04b3ab7c4c248d7f61905b6367cc68f9
SHA1 ca1606ce0b6e7d191da5713a12ca02b8d3501484
SHA512 12a1e55ebc3c93d9e018c7046d750e3ee8ee9a602f4d5577c45a34910415df222fde82fc7951f7802d70d2786cbf176b629c81b1088bc46e4751537c2813c126
SSDEEP 768:YSZBul0vYn4ll44Fstlo3gCAaZJaohF6LVikvXS8viH:LZTllTqsbkVE
TLSH
T13D139FF783F4953ECA0191F2FA253E2FCD2A05245B1C385A85E56F8797EA432D1819CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 1424d91d098a4d206494594f94addf0271d86ca5858dfd47b244508d9de181f9
MD5 3ea77ab991c066abcf4d333faf3584f4
SHA1 bf6ea110bd1892ac0d75f0dd255dc1ebada1d1e3
SHA512 275d538ff43a93ee20e68c350133affa5bc754f9a2ec398b39daf3f1300df661846963ff0c04996c7168585e758e46f6fd616a57084b42b790740c0b79f97001
SSDEEP 192:lRRBBC9Lv7zGAPRp2y9XHsb+WNntb0zQeHRVyIsnAUge:lRRBw9znXJxwB0h3e
TLSH
T1D732A56EAD14653F5CDAD229FEB17B57E6F6002131D42E84EAFC9A2C11D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c94fe4d5fdc9e2a30c70a61ccaad666c95e12ece7c68a3156450bab810dbab8f
MD5 01de87255da9319093295fa056e58862
SHA1 f90f991863bb0100f5410dc5f3a85c5b00f6b4cd
SHA512 de188356c69b37c5c3be4cc547ddbd463c58dfb384f14bfd07bb56a0932e58df9b619ddcdf46b4b306dc976a04579a152410f904ffcf1eb3cebe60df2bcf422c
SSDEEP 192:/RNcBh1BCZqLv7iG3PRp4JArCWI9XHsb+WNokW6/VT04mzWyQeHRVyIsnAUgx:/RNmh1w8zNXyxwn+JWa3x
TLSH
T14C52C79BAC14557F4DDAD269FE61B71AE7F2102176C41E88EAFC8A1C02D7ACC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1826d5e8feeecb0c37e6ead4df18cbe2e49cb87ceec803ff6e4ab8c0da41e90a
MD5 452cebd1418c31ca8917d94e2c49c495
SHA1 cadc2f17c87cddf8df0da9e43e844d74c16e6faa
SHA512 ae8b1a7f11ef59c6d62ce4a49cc3c963a27df84c021da07d139ab2d7eb4824868179ba535341495565c7a7cca396e2b93103cef9af6643be2a89b02492d9af4d
SSDEEP 192:lR2cBzBBCzLv7zG3PRp4JAECmB9XHsb+WNokWwWYaJMc62eQeHRVyIsnAUgE:lR2mzBwzzSXWxwIrK2O3E
TLSH
T13F52C85BAC10557F8DDAD369F961B72AE7F2202175D42E84EAFC8A1C02D7ACC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5327bfb8d9c5599738b74633d5cf69911558f7515ae866bb51624fe1897148ad
MD5 6495ab6e9463cd5491656e486906beef
SHA1 a720bd6e01af15ce4fcafff24a8209ee69101660
SHA512 8ea59d72b738c3c9c3e58b8ba95b1d08cabcab9647a9d779dfbaca3872c895a6902d5a0675c7729f2bc233a888c7889c647d24c20e957bea78ef84b02423a9ef
SSDEEP 192:lRNcBzBBCvqLv7zG3PRp4JAECqB9XHsb+WNokWwWYubgc62OQeHRVyIsnAUgE:lRNmzBwyzSXSxwIN22+3E
TLSH
T15252C75BAC20557F4DDAD369F961B72AE7F2102176D41E88EAFC8A1C02D7ACC3203427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b2d6860a23b41dbf83427f4091d50e0d09d2bab9fc244eafa93277f72f815782
MD5 091e95cba6f323f2c9e8db75b7bb5196
SHA1 22ca048e3c5d1cb66b2734920cf17fcb341a9b6e
SHA512 fc09ee438afc992039c8b8c05eeaa7003d43220a1f94295b0aa3e1dccd3ad8c0a18eaa2121816f5ac738b4befedfc4389f0606689feb5bc1a52eb5eec27f9ae8
SSDEEP 192:lRNcBz1BCvqLv7zG3PRp4JAECqB9XHsb+WNokWwWYubgc62OQeHRVyIsnAUgE:lRNmz1wyzSXSxwIN22+3E
TLSH
T1DE52B79BAC14557F4DDAD369F961B72AE7F2102176D41E88EAFC8A1C02D7ACC3213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4f66c5d6dd630a36d01222510186d8e5866226425a985f40c98204432bf62ebb
MD5 709d0075a615e64645e07265847c9644
SHA1 f916325c710e48762d5b6987e3bd3ae260b8d99b
SHA512 325466d1adebb59278ce337d77cb7d5c7e63f47accdd5c8d64e802f85d098aabecf965d58ae5f793514c3390f7d2dc20a11c2d655027d0e82f8480b64aaf0661
SSDEEP 192:/RNcBz1BCZqLv7zG3PRp4JAECWB9XHsb+WNokW6/VT04c62yQeHRVyIsnAUgx:/RNmz1w8zSXGxwn+O2a3x
TLSH
T17852C79BAC14557F4DDAD269FA61B71BE7F2102176D41E84EAFC8A1C02D7ACC3207427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bc76fc0481ad7b0ff09c097a5491cdc1ab6c7861c4faf9269c5a039e4672929a
MD5 2265f5c846952a974fa988f9ce88f358
SHA1 833fa5f5222160715db1557aa41a0b09e3638139
SHA512 567b272dd1074d5d8a813accb81eee0ff6e74a296f4a97b2794d7094fe9a2f46342e3d1b254fd1159c98730cda2be4944e27a436dd6f23acc6fb6d40fe2d9971
SSDEEP 192:lRNcBzBBCzLv7zGAPRp2TaW9XHsb+WNnwWrc62wQeHRVyIsnAUge:lRNmzBwzznXExwdt2K3e
TLSH
T17732B56EAD14653F5DDAC229FA71B76BE6F6102531D42E84EAFC8A2C01D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1db08257318d5ed3e8e935c6b697832b8624af28bcc6787baa38923c5d893c56
MD5 9f0ffec35a55e2d465e58005107a1af1
SHA1 6ca54239f0529072d4892c098e14d5d7ddb3c8eb
SHA512 083bbda0465e4cec772ef9340ffb95fe05d8165949c64813d6bad4a83245b681fc1ee00689a1b33142014af737a977b5274918c286fac7e66e4c2882a5b077d8
SSDEEP 192:lRNcBzBBCzLv7zG3PRp4JAECzB9XHsb+WNokWwWY0UYn+c626yQeHRVyIsnAUgE:lRNmzBwzzSXdxwIXbnU26a3E
TLSH
T19F52C69BAC20557F4DDAD369F961B72AE7F2102175D42E84EAFC8A1C02D7ACC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 1d4ade8524e2cbb04bb1ac7f135b0bd6611e5a7167d82be2720e97121b60e680
MD5 9ead0b7e7a6e0c1d8c53c24ae97e9067
SHA1 eb1c918b508fe226ccd0be6aa89c3cf88a5d8e00
SHA512 2bde9c888384bef4d3de4f50ec03f7270db63f05d82459fc3f4c005d36957e58893bf78906ae2316fd074142dc322e1335c80ab46142272d10848aa918ffed93
SSDEEP 384:RLjGh7KxkXqKf/pUZNCgVLH2HfgslV5XODG5+ErU3eHHGoXB0j5h:RnGh7KxkXqKf/pUZNCgVLH2HfgsfdOik
TLSH
T13552F86BA88D9A3F0FD8D58CDC267F4FACF5015666680D2496FA9C0803957CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa98324b9597a3fc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\5c97ec4a-8cdd-4650-8be7-3bae842da0f5\fa98324b9597a3fc_0
Size 396B
SHA256 cf275ef4f51485389cb83f1d4f98ddacc57ef79b70d7b95412fcce14abfcf62e
MD5 1f5f16b0b6201ccf4f338245a2a2e89b
SHA1 bc72e2a587bf7a6a2ed905df81d568cd39c1c2d9
SHA512 17f9183bf13bef02193b4744a0029493fa6b0641d88fe5cf6845f17fd4f23581351d9bcdc251bb7d382059997113e59459dcc0250ec7946c9bad8b48180ba23e
TLSH
T1D8E0C0D378201DB0EE9B26BFEB9CC3E56B22D1F94899179E9053147C94C18B46B82005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\5c97ec4a-8cdd-4650-8be7-3bae842da0f5\index-dir\the-real-index
Size 96B
SHA256 ff42295d17074b589700f2e608369ed7967f5f99979680238cab07e267fbd2ce
MD5 ab799a0b3d424474611f31b1f4d02523
SHA1 b39786033dcc4a07b69b4237844d99f46059c2b4
SHA512 f29f17dd6b83cd06985ff8624ba80bed831e8e0b342807a61142b564772f63c2a4b564eb39472602ec1d3f89cde1550d87927a045290bae6169615edfab917d9
TLSH
T195B0022944E46D95CD90267522623285A1F30D524553DF57E19199B8CA131C281D3540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e1fa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\5c97ec4a-8cdd-4650-8be7-3bae842da0f5\index-dir\the-real-index~RFe59e1fa.TMP
Size 48B
SHA256 0f8bcaa78526a1f31298f74f5198d69715eaf9af4c0d2196627b8398fcf17061
MD5 1465c7d1a091f46666ca320aa4227042
SHA1 66814c5b02a8e94147797438d3ce98f6517de0ef
SHA512 62f87fa4a01a92a63dadef4814dc04e1c2388b3294ee8a7c0ebc6bbb5795a25169f55577efd51df72da77c55fefad5522dd7a2faec1546fb5a9d075bc38042f6
MD5 SHA1 SHA512

Submit Download

todelete_bbd76b2c554260a3_0_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\5c97ec4a-8cdd-4650-8be7-3bae842da0f5\todelete_bbd76b2c554260a3_0_1
Size 390B
SHA256 4308d0f7cad7e0277c62109e1a14e5775f564b2c9952415a55f519a2e8d1d601
MD5 94aa930d244f09da971a3352e1f397b3
SHA1 b7b9ade329b7f133ec3e46352204d4a272b165dc
SHA512 581cce315bb522ac365baef9d32ae839cb737d321c856fe0fe470948c5edddc7b83d5dd81966b026139a332a64746c2b223ee0b4099cfb01513b53c5e95626a5
TLSH
T149E0C0D339315DB1FB9759BFEE9DC3D85272A1B884891BDFC0111478A5D0874B382105
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\index.txt
Size 121B
SHA256 13d0d56e2165af5fc1140703a998471ccc8021e2296aabacf50c3458588924fb
MD5 fa1e4ed9000001c76a58b9bb8d903216
SHA1 a64d22127de5745538ea075ed8f8ef3a2927707a
SHA512 fc7637bb0b23cc69c63b2c5ec3bba93090052fef94348870a01b62f6d8533765c0a136c94b862f324f8361f831251bf12e6700adc664b3bd660fa38104a89160
TLSH
T167B09BE74051858E1DF5D7C9A258F71D8D03A9FC94C06DDCD0438C5705207624002465
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1de9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\84da63cea25174b7cfd5214c270e8fb1f6a55d89\index.txt~RFe5a1de9.TMP
Size 127B
SHA256 4b7471b5fcf3df2b85add22e00a419289d2bf034aebd0a5583de0719d5a1cce0
MD5 044e67ef8c89b668ba921d9f226ef2c2
SHA1 1246b2b0fd68e0c131b3c3c6ab9f894c8d27f9fe
SHA512 06feec0bad839e3f5bffa91a754f2228eb69207f08220c81eae7e01448b00f4a39a15e60d35cf626db7b9cdf93bf1fbd23e9874e8206d918d7d5b40df3f4997e
TLSH
T1A9B09BE74161454D5EF5D7CB9158F35D8D13ADF894C07DD8D047BC5515306234141465
MD5 SHA1 SHA512 TLSH

Submit Download

5777f95ef252345c_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\5777f95ef252345c_0
Size 63KB
SHA256 035393af866c6de6ed412ae0d85f061ac212cbc8c311b8ec3c03e5ab856c8fd7
MD5 2a2175b0fcd700d4dad26642e64c21a2
SHA1 4f44168851f5d5e88e7bd691ddbfe88865c70075
SHA512 a9e02e516796eb7d03e52a85da329612bf756256b317dde8ec5fb1ca0587b9647c45da7be0ab856ad04878f600b62e1a70fa2b22691593b1f367796dbaab62bf
SSDEEP 768:keJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVb:kDJ0VPVR5yyJxGSV4V1C6c0VVEOd
TLSH
T18F534CA633707477827BA1F1905F230B713AE167F40494E8B194EEE54A44BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa2ba9851295234a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\fa2ba9851295234a_0
Size 255KB
SHA256 c1e111e530d8fa696d203bc6fbe44c7401172314838e287d57d498b11a0050c7
MD5 e5bd38ff80e183157f80cb4a60ea1885
SHA1 48d86cb950ca37e6f9c83c9b391600f457b252a6
SHA512 9853cebdcba52e0244f145357d6910657ae6e091d2a83ebd4d163d844d165839bfaa2a52cb9fccd795ec5f4b31c7ce4c90c25e61a3aea4b814875e7945799f66
SSDEEP 6144:SXmPn+3hduKHp4UaD2hLmX7ICIf2c8LTN/PaG5f5W5V5Gww+/8uZIn:Imv4JteICID8LxPagRQXGwF8uCn
TLSH
T13C447E723300A13FB8278DA5E67E6F4D3825F217DD2702B8E6E4E9358FD6DBA1412548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0ddf9dba36a2c47aa67090eddbadca9a2a2b9bcb032ce113b15c62776ded37dc
MD5 e87c9bf7d1190c6ee9aa60e68bb663a0
SHA1 c6aeb3641a9fc431b026148ffa0dd76c55759104
SHA512 0c12539316659f61142c7634f853b5daa14e2cab7a29ac9c2d7204c3fa3847d4db594e14647eb26d0e0604cf489c84f93ba86ab84c977063611f07be53554f01
TLSH
T143B0228030800C8FF003BFBAA8C2C0C2332A3CF00302C30320E80C88F832B2E0B82002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 dfb20193d725dfa72630cbc7d06238f1c97572f45c01514abb6732a8883612c6
MD5 5f065ca7cae4ad2e8a8f9702dd45ac00
SHA1 31b6f1d042a2263c29fa1a3b43f23e8f366420e8
SHA512 ed3fe1582137ec80f04c44156f6e6de6ac59b29fa2fd595946c3667e6a33080795db680bd091dca5ee0eeaf942770377941745503d2107d1ba39c10d10b00ea9
TLSH
T1EBA0021471404007E4001FF45985D192767DBC30051107417BE4A84F98E06495547111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7514e3340fd8fc039eeda29828551ca7b1a685ff812eb46d42c6919b3fcdebed
MD5 def6f2b298a78abe973d403ffb32b2d5
SHA1 0779223284e266cd94838e3bb432d29e87f48a8e
SHA512 be232067f01fb6e4508a89aab1c0c0ac8e23f0673b5450bed5693b20714f1a62f52e1ae02cbd5b3bea402fc9f2b4672e10f0a585dffb02db636c6529aac1aa90
TLSH
T13DA0025441E42411EE0092B6A161554173514D1A3651439359932448BE5F2C18505912
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf6e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59bf6e.TMP
Size 48B
SHA256 ef4237fcf26882b49729a54b47067ed068f233fa31e35eac7eb5f6cdd8cad0fb
MD5 b8ae5830c71aad2fc5a0a8ea24695669
SHA1 b8070bfc8eb4a81b9a6158343da0b551694d28ab
SHA512 edae31b1673a89a4340e6b58d8b05c6f9da62ecd383a103dab35f27ba6c7e693ac1e18de7d4929cbc3a99e2fb96c1cf0ed944074a12c212d4ed5a8ba567b46cb
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\7c6858c4-c936-4686-974e-31d458584309\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 76B
SHA256 5a4c156e40caf101ec0a0cc726e631af8baee8c05a74c2822d16a4d9d824f541
MD5 568e7e61523398473af556dae2918fb7
SHA1 4091b1e52408b3ab3d34683f0b442fa35e661f9c
SHA512 e58b30b6b81c7992eb7754974941b789b465e9caced2cb4fc27709c77da9eb0ec6375f1f4294ed2d3419abb7d13224dbb96bb93008ef94308670f2daa580cbb5
TLSH
T187A002FB1D04809F0F30E8EC203CB22DE45B928C8CC4DDF8C80881532178F370002868
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 157B
SHA256 c237479e2baa35cf1705c2d826bd874b5b79144490d43d653d096a2b25da6d51
MD5 af3f571d9b621aa009919df35c07be19
SHA1 12a194bed314a062d60da4d62700d587cce69ea4
SHA512 1fa95aaf0afe4fef1a5c371f6bc3257a3a0f6f54d424d867f035efbfa3fa5f8e36e4db25c8e7420a8f73223cf4688b913bed8b52a053619a6e9ca89f4c9c53da
TLSH
T135C04CFB1525458F0F30A5D55028B65DD51B8D5C8CC8CEFCD41970423574923851597D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 556e35c58633d4a2fcf67fb0b8929e8922cc128f1af844f2423173d6f47eb8d0
MD5 2597009f8ade4218cc8f6a8aa07c9b63
SHA1 3808392cd5b011bb135f93c6b7bb2f6c9d3d0ec1
SHA512 f762f21ca8764c13929ec3e3855486636807e741b98b1289745bd069e0568b5d8ff176fa4a8d0741cec904158f561254527457f562b37456512e4d405ec7e39f
TLSH
T1EBC04CFB1525458F4F34AAE8102CB56DD51F865C8CC8CFFCD41850422574962541297D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 fb5749963d8411065954598f06b2488352d6411605e15c909642ef464bca969f
MD5 81dbb8f62354c83fc0adb96dd8f89eb0
SHA1 9183b3e0b4efa3a23ac7faf8cb8d6d6e70db0466
SHA512 251b5df1e37a3f20da46b2673be085d053f1a19bbd65c51033f46f6e6a750fdcb508b39ee57b238bef8b226c215c667b5c2d3899d08a92a8425bb165b1e9cb5b
TLSH
T108C04CEB5929894B0BB5D9D81018B22DE517864D8CD5ECF8A4544442267CA634541969
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5eab80.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5eab80.TMP
Size 157B
SHA256 46f3e6c4666125467d9b2b8b655e0b99c49cacb45c044e6902c8f89ee182b850
MD5 b4582cc1f7518c17ea1f697a7108e346
SHA1 29f004e6d870a4599e14d31d15c514d26651f898
SHA512 557d28bed243992d20f773efcd7b81323dcad93f8947c451f2a7c3e98d1fab0a0cb4962b9e63b1a93d625f107a42107f868b68c03daa96a593e2a7aa9b85290b
TLSH
T163C08CEB082809470BB2D8C41028B21DE0178E098CC4ECF8A4153442323CA234640968
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 58eb6905dc2ff086898b573744ee81d387b9b8c8e770822a0c68efbebfbf4756
MD5 6fc3b738109b245b9e97ad13b9faae7c
SHA1 8ccf83d5d12135ba1e304e5899c487fc624a4853
SHA512 b1cd62713a0f9632b03500471305b1d492c009af6be6fca695165745241403531f4bcdd45101be50f553d1ec0ba2c5dd71b30a57afa89a6bafae70ae9ce4b853
SSDEEP 3072:Ih1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5E:mmg1kQfATCFbzQACjT
TLSH
T1DCC3127B49E449FE172208D121422EA5AED5A73FDF123E9C926A1FF616C7C4A1347422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 9456a11e62082c9bbeb255fb164cb58d699cd9653ba7527667a1c63e56ff79b1
MD5 f833a652572268337fd152d1f75722e5
SHA1 9e4d5ce78bfbd4e8c2c7e74b2af5f8d69cf961a3
SHA512 6366eb65a89c7aa5f435227368472b5be275a4391e04a87c3a5d50f2734603ae1c360849fb44a471acbdd2028af6ff726c2b2faed6c9349682298eb7787ab62d
SSDEEP 3072:8R1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5E:mmg1kQfATCFbzQACjT
TLSH
T17DC3137B4DE409FE172208D121422EB5AED9A73FDF123E9C926A1BF616C7C4A1347423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 ae7a64bbf71e313d32a316e199b6d49f4b59fd550f55e26488a47d57607ad8c9
MD5 d61175f3331b74ba03502c22725a7fda
SHA1 3d415ae6922183084d9f16000f6d5bb22a717749
SHA512 6c50d6827e63e5763addc82da69d7ce811f355fe10bd5de39a9bf477fd8e74e1aca0b6e7c9ed1f25c8f9ba9eb005d059637b501a91168ae9395fddfb9e630102
SSDEEP 3072:jR1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5E:7mg1kQfATCFbzQACjT
TLSH
T1BFC3139A89E44DBE171204A121831EB9F7D6673FDF532EAC936B0BB626C7C461387412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 e766d463718e48b780206f04185253292488b8a8df3959f7014e326dc1a4dd74
MD5 e9d3af2f01780b7b2f2ac0eaf3b84585
SHA1 0edb252623db83e6d73006c1490f3178929f5fba
SHA512 220c8c5612be02e2dabff50e21d7b762ccea0216679da2a02b7b7b7826e1ff014246704acf5cf5b95cd48c50a78a16ac4eadf5371ed3458a8f8005f512a3f262
SSDEEP 3072:8R1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5E:Img1kQfATCFbzQACjT
TLSH
T136C3139A49E44DBE171204A121831EB9F7D5673FDF532EAC836B0BB626C7C4A1387413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 07b6193f1213d2f36467f003153a9744955ceac6f8b5c2c3a74fb77b6f39e344
MD5 970cf92b3bb26af2b3aef866be952af1
SHA1 ac0a25fff03a3182c4b0c8d706a4910a1359ad95
SHA512 b945e102a92f6fce96ab9c94210ff3bf79fdede2edfabe093869d14ab7a098193ceb296026d79df31b8be0a7a8359483f5b5b5f7f9eb9e1db15fb17ec71d072c
SSDEEP 3072:IR1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5E:qmg1kQfATCFbzQACjT
TLSH
T1F0C3137B49E409FE172208D121422EB5BED5A73FDF123E9C926A1BF616C7C4A1347423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 82f329ea97d5dd1bbfe8bf5561640f161996cd0d1a0b5df66c3f3648d0762e2b
MD5 4a15ba3245c3eece826ba11b24e10f5c
SHA1 7542dd16f71c85d22905afcc8cb382e8b8ac34ba
SHA512 7b076e8400efbee00a626e10040a7be71fcaf14a6926da951971bd7a74b725d5672bd834c9f549461c8ce78e53585a6a987883b7249e7796e12e0dc7733e268d
SSDEEP 96:VC68d+laPzyON3b/fVvMxRRDotok5mODgB6VddGyvvwjNEwb7v4a:VCPmaPzyONr1vmDUD1EQdwJjNEwbf
TLSH
T14CA118B2A028CD3759B6D485B1976F478FB461ABB6219F98D9ED2F0C52F71EC0302523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 569069a5a567b10ad5204858dbca774ad8379d6fc45071f0ec7047a97bf83ab3
MD5 80d0c6b2b0f98b02db0365941583a8c0
SHA1 b2fcc869531c94bf6d8a00b639d8be79db024efc
SHA512 1ed1721210ccce8aae65fd0d33d074b467cfbf36e8400f5c7ee11c2c7ea3c219c770301701f273f13bd768c4234a187f1bca5e457f04ec423fdb5eb380b3d76b
TLSH
T1B7D0A730B62D7E85C1285475542086007A650492365A82596328440D8DBC4C556CF59B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c2a2d5aeb3aae0f4ab58e690b63029099abee6a6379d4a93be18b824a4fe203
MD5 ddace410b8261c9bfeb9217ec5411b92
SHA1 ba5c8681baeff0e049c81faa8e5c911b6713d54b
SHA512 06ecaff5b54983e366ade7068650727edc674bdd67951a5e9752f5e4c812557f7a27f8a36ab7230109e9c7aedc3b32874df51d9748879298e031dfdc89970365
TLSH
T138D0A930BB2D3D06C21AB8716810C2227BA156913A0AC261A338400D9EB86C5168E09B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a495410bf0b0aa8a6eae688311ea6a1d3df47378cad1c1a4cf165ced91ee3c7f
MD5 67e3beb3c8e7fa54bd42e7d1dac02c68
SHA1 60a9980527a5f26173713ab0f509d2098ce6b2cc
SHA512 ce2eb4aa9183144b029cba3d01839cbe8824cc11ba2564a6c321c0b94b3f172aa632692dbc5056409c668a6b5f4e27237eda153140eaa6431e0c7f8432e8f0ff
TLSH
T172E02BA6D931EC2B19FD071870640786E71413177F91459FBA7CE20CCFB15260A9689C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b181d238c7166ed23dd2634689286384a40c71a330bb837527932d0abdbc8523
MD5 9a9045a7477f8502498e43d2da3f87c5
SHA1 8279b5d800254d3cecdf0e5d709b4eba293babc2
SHA512 d00701617595476e0d863d360881225488d7a9a9d492595338fe91c9d681eb199c87c6dfb763e8649f88151db5f580cf735cb844f39ab8a969f92286fadc7b5a
SSDEEP 192:f8QJN9NvDBFgikJiBCdmb6r6fbiChqYwu0uZl7umr7k69EcDl:ZvdFuJ+bA6fbVhqYW6umrwZc
TLSH
T16B13F7BEB6D98D66CBC20A3C414B1B75EF30D7A2C9C984A7227A37348725F5A5D0F110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c5184949209d4b16e1a301944870e262da27cf9d8491d01cf20604075858326c
MD5 1f82be59c242e313e296abece84cadee
SHA1 03b170ff22e4e4f25cc126cb095900623d984a99
SHA512 81f1e7c04bd31e5832cc4347309c0d5f7057a03a11b9a75c83c9443ed0475863ce2f19304a4ff37458dae13521ae04cbd23fe2cd5f904fc6e5291d331527e245
SSDEEP 768:naN+L/iD6L/wDBn0Ea6FQbNcvsnqDvlgyDsmNjsRjpOi0iDD0tLddKpaMcAe1KAP:bL/i2L/wkcvsUNTi0if0tLddKpaMNeQ
TLSH
T1644440FB0951A01BCBA842F5D2033E3DD57B061E7CD1F8E9D2784D852829F21B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 849262f291f60eaba523169faa169345f63f1d5573a5c2ddcba62f148e344d11
MD5 7243c4df412deb70e50a98222b64a019
SHA1 2e6b830f2addb8a78c72e3b1f55977bb875581f5
SHA512 d461de691186adcfb80670eb963de451b62d6d04b8068b1ddc665565049ea6d1459a66d9a631e5b535c308ab0a63be88fa6b65eb3eea48a0bf339a814ad5e9ed
SSDEEP 24576:eHcc5HBZRA1nQ1C2HTdqXONPxF/JL8HLT6xgZATB60:e1LC1Q1C2pqXOPF2Tkk0
TLSH
T199167DEDCA7858C3CD639A30B4F0E9477C7413D3F994C1D68C98C584026BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5378a4c444f93dfdd09fb9940fcaf457f5c09f4958c71dc9b36df8ea338cc010
MD5 18e4d312be870665870c8f7737bb2d30
SHA1 95065dc777afc495c15e2c6d9758e60886075f71
SHA512 1a0f649cc1a014c8e2982e74bb21412e1976d8a77845f0fe26e69ced55bebfd514edf3ff942b2edc6d13abc9209b4ed9cfef553da51c6b2574293e2113a81b1a
TLSH
T1A351A89D35ED0969CB2608BC50F1518BFFFAB4C9C6473F0008AC937B9A86FD5E0410A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59406a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59406a.TMP
Size 2KB
SHA256 158e0a0f877e1d49e20fb5c9a11b33daa72fb588b5896b2c854782db6805b324
MD5 711be39d6725171b6ff49ac023e8307f
SHA1 11bf938cbd0399f87888d02f2ceacbdca9ce9ef1
SHA512 3e98cd99184619f965a622c38848ac8d4c4c6a44e2732d988ca0306fc652e08ce78157919714d3db41077ed8d908ec60f102ef76d6e5cc65c30ca2f484f8c3c4
TLSH
T19151889D36ED0969CB6608BD50F1518BFFFAB4C9C6477F0408AC937B9A86FD5E0410A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ce86cdb0bd2a806287ebeaf55624dac6e207844d22729858f0d97e39e07f6b2a
MD5 498b724fb2634b5a1811b414fd18de9b
SHA1 1af0613334638f0aab17f9bdf32a6250ad3f344e
SHA512 9c2f7eca136e0b719bb2ce3e3b5c76ba94c88b5a5b3e8eccafa74afb70476cf5b70f8ae9972301bc29ed3ab97417a7e0f9436ebc580d4a03446eec6e44a18150
TLSH
T112E0D8E4A5C7C55D6D5474E743646748D3F13453D685AD436714CCC4BE02011B7479DA
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 e9cf20cef5277c4ccf12d9d0d8c6a9474916592f4fdee2c87a2a10916493868c
MD5 d961861b560265baf576159f81be29b3
SHA1 1278fa4a5145dbebf2c182eb9084cae05251a3ff
SHA512 46708dfccc5053315c859d031dd26051a44033af5b7f1ed2396e1a8e056a3dd22778f1d43c37f2f03ac65969136efffd04dad34218bdb64bb9861e6e3012bceb
TLSH
T113E07D8419CCC929FCE468978368670893F035A2F2883D42B718A88C7901271FB876D0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 05b4c32157cfed9e847b04c1d09f8a0826fa4a80c82c86f1779db1900153d593
MD5 e79d48b1a1feb23354011b89c05492ba
SHA1 fc48a2cae0f242cae2ea3eb00d701c57bbc35f8d
SHA512 9f241f2e4b6b4de134a14dadc478a2de152dbbca709eb3a870526ba76437cd4000d0e8f866c79388e90ee8d4e5a5951ee6f3996a826d173c57f1acb088856710
TLSH
T12AE020A499CDC13DBB4820C78234770DD3F03416D6883E426B24B848B843008EB875D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f83fd271d32dd78ab63f00d1d716de2357d2e4ac2ea6a7c13ede5bdfb3e29b9a
MD5 8607883aee59d184e51796b50ebcbba5
SHA1 19aa5e3980a7fa13cba81c86c9e63600502ca348
SHA512 81b336a4b2ffd2039655164f5cbc9deaebebaaaf858f166e55f8b71bfddac8514b9891f7680553c09c1dee7ebfb73d98ae860e7a179a5a16135b9a7329f59734
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oZwN3H13:qDeMatha9RA1Q1
TLSH
T1AAB21F4D1F306221C1F44B77DDD089662F7C111DC3B3374AA96860F2CDA2AAFF50A46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 56b5b70901b1aeb9eda582b73e88f1771b7a1e256bbb458796b5686105615ef0
MD5 32fb4d542bdd7f5e09ef200936d9d08e
SHA1 b2288a9b7644bace5426531881318f099ce8f5a3
SHA512 18a6087bf55c2b5f898f0c303ba07549b24c2a191d4d258b8ddd4392835fca9dedf99acf3bcaf8cec729df8fe843f54bb4e1ce987e3541d40e40b4b740b7dbca
TLSH
T19841C1F7C3E8857D890185F4BB146E1BCE2D0955832C3D56C4D49E1B93F2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e219293233de52b1dcc777c7fd0521eb8bbed27a783c55584f7a5ede5cead0d7
MD5 46b695c8c8faedd0381114645fe2c07a
SHA1 6607883e97dac9d139299d6b7febcc21dd2abcfb
SHA512 855a802ddd58d22945d8808228f27120e566f58684399f8f0523362a05c5aa23a4e7bf7e262a6de4959a6825817b92734ea81279c2c3f24af0ebb7fa45480384
TLSH
T16741BFF783F4856D9A1185F0BA187E2BCE2D0914832C3D9AC9E49E1B93E2471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e282c7a78ff3167c651fd6a7ee427c9f027926f5d340eebbd5d9b3fd4af9ef41
MD5 ac4dba436b8c8fe18422848ab26555f6
SHA1 dff47bc43e7994183499a383f5f2691b814ba0aa
SHA512 593a3d8efe4d9aee8fd57f6685655b9fec9a88ebd50f65b8906e01dd6455dca175e024dbf5b0d7c1d9c69660ee7f352a2f08c6cd5ec144cdb6d5fcb83852da44
TLSH
T16851BEF3C6E8866E8A0156F4BB147E2BCE2D0914832C3D5AC8E4AF1B97E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d8b74bf1e1d464ac939558212a01dce983a1f47e6973c7b3e1995326d7cfce6
MD5 8ae21ab5b73d8de69593755caa5647dd
SHA1 dea37eabb0b3c7f722978e76e7bf55dba7fdde26
SHA512 71160c15e57bb4e4aeb525b9b97db097d7c9279abbea5ea5399ccd7449ae7db9d72c029b6358189fe8d2f71b59be9dd5341e614311034d4c1d49396d2fd44273
TLSH
T12551DFF3C7E8857EDA0186F4BB147E2BCE2D0914832C3D5AC9E4AE1B97E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 df6a32e9a3e92037646aff788c735a231d82eecca2ebb71029a1b9467acbd947
MD5 380cd7c74f282abe6a9ace749aaaa554
SHA1 24ded990dd647767c5b9d92358d8cd969a468931
SHA512 1052fec5435d0fa02a0614f2adb76d399e8fa8404dd723149e5c5e60e1795014a24c09dd73919fee5681128eac570b33f96474f4eb72c20b365dc9566339de45
SSDEEP 48:T2/IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cScld:i/IEumQv8m1ccnvSNS1zOf5nFXE474g
TLSH
T15AF2BDFE07276205D98444B0E4009F8EAF16000B47B6B6EC76D447E3F7A21E2B5B979A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 3c78f3a3fc217dd692ea4554c05868069afa185df110ff8841bb340b5600cc7d
MD5 a1362301d68d3d90b720d8d690f367fe
SHA1 5bdf89309203aa353eb932ca26465eeadccd7c7d
SHA512 99c395eae82809150a78b072dc0616aa0b18ec5345fcf9c9a584b702ecbc3a0bacf946758250775c815bbb5a3b30fb96dc31905c34388d554edffccd3e804710
TLSH
T1A0C01252D4F9E4B65034497D1984B881BB75D43D104494E2E995933CB1910BBEE1113A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 104994d6d32e88bcec6de0b3fb9119b23da493eef63f5d3faf3b8eb208601792
MD5 0880880337bcc4e69ed59b289b2dd55b
SHA1 b32a39b5fd4746f879e45b6cfbaa99962920f4b1
SHA512 3801819525c118374736982afc860b5ccd001aef8d9537b52fcfabf9c1065faded5d8fdefbf2ab5d9d739ca3baef0af272c6e8ae82614b3845bffcc109575f0d
SSDEEP 192:sxR62RcFA/frsRoWpVVgXMZQ8zoA8pj1/qW6+WNIYQqAe09K+GHIgtJ:sxR62YA/frsRoWvVsyQtZ/eIde09Kx3
TLSH
T1B5429516A928A93F8CCBD21DFA65BF53E2F9103261D15E48EAFC8A0C05E76DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 24a18d9f10ac01abb86a7ecd057f727dfa620c4f7f49f8b5f81db595eefc5227
MD5 85f8102e1f044ceae405ea718ccb1eb7
SHA1 7f1565af57d722a4a6ef4cf444359bb4bde3dc50
SHA512 454c557b0d12aed10da76fa8458391734b20e70de95938e3d84f2766809c72030008f797206e1756611815f1ac10c1cf40af967479ddf43d1764991ec5e899d7
SSDEEP 192:sxR6BRcFA/frskoWpVVgXMZQ8zoA8pj1/qW6+WNIYQqAe09K+GHIgtJ:sxR6BYA/frskoWvVsyQtZ/eIde09Kx3
TLSH
T1A642A5166928A93F8CCBD21DFA65BF53E2F9103261D15E48EAFC8A0C05E76DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 def1841b6a3b65174271963224e43cad13c4ce2e5ffd26396e334e00bfea7719
MD5 ee94f91ec51d7e5a3884ae430ccc6f93
SHA1 2b2c4fc1453a402540044cd2f7e1077dc92e603d
SHA512 e534b670cb877c6a48c4f222296cf69e09dccdca1189c823185d3cf6e1a1f67b58c8b38447008590b80ef4cda5980f76df8062919c2aa1f3177514368af87828
SSDEEP 192:sxR6BRcFA/frsSWpVCgXoezoA8pj1/qW6+WNIYQqAe091gHIgIJ:sxR6BYA/frsSWvCsUZ/eIde09os
TLSH
T18B42B656A928A93B9CC7D21DFB65BF53E6FD103261D46E08EAFC860C05E76DD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cf1b895eaeb8f5e9d7b1c46e89d5d74b743ceaea84b4f63ae820d8ac43df0f83
MD5 bbdcf525b1340bf087b506498344243f
SHA1 a6960dbcf07e42f26a018e073e47fa78f249f5d6
SHA512 0a9a5ba62b22d68c6cf1c5dfab5447de092fbf70ab8cd322c31e393c641e926aff31ed5096d73f6eea3b02c5e7290c0f1b96a5004eaf5f569d4a2398e018a0f1
SSDEEP 192:sxR62RsgFA/frsRoWpVVgEMZQ8zoA8pJ1/qW6+WNIYQbAe09K+GHIgPJ:sxR62tA/frsRoWvVTyQtj/eIMe09KxR
TLSH
T1F04296166928993F9CC7E21DFB69BF53E2F9102261915E48EAFC8B0C05E76CD120791F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d34237c5e450ea544792e8bd8dac06e1c156e519f65dadf3f735be70ec37fa2f
MD5 475c8bec08e3214607826c8aec254d06
SHA1 8e711731653b3d0a9708d5236e8bf1976764ce63
SHA512 4cff0a6315c8143a01e86b16ac0b00d64eda77a8c983d7619ab9025104b0eadf60d355647f8583b44f3e64af7e0110408125577b983f0038d2ae5ad4fc0512ea
SSDEEP 192:sxR62RcFA/frsRoWpVVgEMZQ8zoA8pj1/qW6+WNIYQbAe09K+GHIgPJ:sxR62YA/frsRoWvVTyQtZ/eIMe09KxR
TLSH
T18A429556A928993F9CC7E21DFA65BF53E2F9103261911E48AAFC8B0C05E76DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1798d69a3453624662eee97c6dbaf80dddc6880ab87386e3d94c166fea8fe5d9
MD5 f2a1ad563ab05838de34058a63cbcd3c
SHA1 4402c31d5c01a7f513b8401d57a22feead2f5fea
SHA512 71d5483061818c6fe3449c8355aa3e997525b91a5b3c32146a68511da4f891740636f67cf96c3db3d71f232dad5c5c77ef704fbd891060ac1148998d4e837e58
SSDEEP 384:TTbs0+/fCtgNLFfPzKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV5J9N/RK0rons7:T/s0+3WgNxfPz8F1+UoAYDCx9Tuqh0VM
TLSH
T15FB2DA2F644CCB7E5F800AADEC1A6F976D9802C796988D4047FE994C03C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a11d459d8f9a801ba1eb78a99ca125258caad20104bfc6e60a7a807ef508ebd4
MD5 ee68bee24149cad64866de76b39638d0
SHA1 e08c83dbc60edc72e193f6dbc7af11d07b035027
SHA512 5937a9b641e0e43936b2360b22cd2e0de713b40a62571f447246abb2fdcc6f3ff5f09452dc70f1e38538e39515ea823208be8814039087bdc5c1906ee97d8811
TLSH
T167E0269057C8D17D789A20474266A70C82F47437D3C83D867F20F9546582604F7932D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 6ecf6b3cd0c8e9349336219576142d896bc14e48281800c42b944fd4c8fbc38b
MD5 1046c91c9e162f0a0957b201aa57cd94
SHA1 fda1702f011d399dcafa6ebc87f599870c013900
SHA512 b7655b44cc7013d10f94b59dd3c779b9f98eb484e741f1a15f6e100301bb7ac456b3b1c5fdcd524f5f81c224b1c8c0b166429c8279b30d3dab440f986ae8c8a9
TLSH
T1DDB012107B21A941D8CA487136988FD47310F402117048374CA44F17CC6E7E4BF11DD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3e3795cf2fdfac2c223b77ab3253f91a9c92edf6297c0cdbfdc7f1ae31b6dd5d
MD5 cbf04f9772a32e1c026aabe66874d604
SHA1 7f4f72616b85b077f3f821da34516e5b27e7b34a
SHA512 8f0d6fa4fc673d9e8d279e874cfd1c5ec7aa2dc862b6265569209a5c58bf912253c137fed07400a375296b05f02a5870979bfd21ca3ac11b9a6d144ab514f501
TLSH
T112E0DFB027C9C73A7A86208B8624F70892F27466E6D82D527B28F484B64A144B7A7690
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 36d9e4ff2bd980f647be0a7f576802e5682bc8aa52c8fd280b7131f0a75c4428
MD5 27903ec6bf4b315412f558be86b838f7
SHA1 3511384382faaf9e3688d38862b1000fe02ffae6
SHA512 7c802720f15cc9392bb2c607cd1eb6d0ec113edd3d9955313ffbff05a6b4fb89516be0afccc81dc07fbe3419344f3bfb67d7b13f15f7e7bfa1da794c35c4a09e
TLSH
T1ABE086B057CDCA79684464C38664B70DC6F0782697C93E86A71874BAE541144B7A79D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 113da9cb85dac9fba11ed909bed5637f8aad06fce3bbc71599fb7d95ca547aa3
MD5 9be580c17d97168950bb0c9090b4c52a
SHA1 536c87f30c75e045f3cec2497ccfa2000cb27bdd
SHA512 35a2135c0c9269b20a460f648e70e055075b4432ada139e58db69f87b7ac1870a819cfb46983dad6dac8047029a84a6fc610efb4facc208381781a3a6902ab63
TLSH
T1E051E05130B71781783D254BA4969427A2C37562301EAEBFB7A872A10B66E038DBF5C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3c7d8ebddcf1eaedabfb6f6362e34e76f33ce4b25ff765059c95b42b4f4ff8e6
MD5 aba86c841b9a7ab62958fca944fa5aa5
SHA1 ac3d275cb47de18640d970dd12cdb5fa8ac2e633
SHA512 68986b2a05d73f3d3f9dfc3630d44869ef6d8c3bdc80be45d86d66201eb4274209d344024da14233240c34f9a282826adedd0d5d6c97b7e33f0d1e0d616e14d3
SSDEEP 96:KRPY95PNtBWZWcghBK4ogPBcX/ehNCHd0dVdAdEd+didmdkWdidvdPgdMdkK4dB3:CPY95PNtMZWdhrogPuX/ehNCHm7KmgIm
TLSH
T1B191305170774780783D350BA596D42792C372A2340EAEBFB7A876910B66F039CBF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c19a74a0cf20bdb1d0154e3fa62669dad6758af5e4fcc14bbfab9e102dea107e
MD5 e81cf8c337ef8f3046050141e2a0c911
SHA1 e80fb675d75314dfbf051f648c761a9d6b85d14b
SHA512 38225f12927d383cbe4335020d6ec05cd8cd6271be9d01217dd623651def4041cabd78404896e7ff4ceeb729f60ac843791cedfa6b59bea03ebadbc22284756a
SSDEEP 384:DNrRZyCSDnxTICjMEhIKyll7svbFKfk7:xFZJSDni9yI1l7svbF9
TLSH
T16D44850A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 363b284a69a8435794228b55060dc97fcacda654c1fb7107102f03d49f5c9166
MD5 af9a1d6c248faffda41a3507deb5f9e4
SHA1 92f54d83e7f3de588ea65a1c7629ca828521d2c1
SHA512 72dbfb9f9990d2c7f31bc1b2270e3815edb393f361bfeb3746260981c3adfe8a4527779304d028865525b739b8dff24a59f58610b5cdfb5e0d9fab74e17221d1
TLSH
T1EDE04FC1536B60906A8CA953E2062803F0C57F55250F4EFAB35D76984B44C1BCA2FFB2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 1afee4f07a883cc7c096a9f059b6d2679519f7ff2b9aa8f18f25ae5c5ef7ddf1
MD5 31eeac59c0609b808f699bcfa808f8ed
SHA1 b8c2e5165a07c4ea013849b8dd5eb986b971bf04
SHA512 db9291c0979cdfef38e363ca35105da65f1d5abd045dc356458fbb638a6b717c610f40acc9740abda560789bf4703561d00ed21d58d09657d89e330925beb38a
TLSH
T177F0C2D76E020677DC02613540336783FF2589CF042464A753CD206B1A1D2F1C9CC1D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 146c50b164b387d0807b6fdd3f3a2050df6df37608d13d9395749efc47962372
MD5 df6969a6269ffa449b9b56c49b23e981
SHA1 9b1f51d3364095fc8052f8cd8b838c244fbb8003
SHA512 aafde4f2e4f02784d64bf4b88623190ce3768032a3412fc73dc4af264c7c3c8bcab41b75492135119f50f7e32569c723c73a51e0e7b59fbb21c1b4c93f289926
TLSH
T155E026D0BBCCC1AEB95420874224530CE3E03823EE882D866F20F4ADA842100F78FED1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2e7c83b28108f7c91d01677e9b78e4610ecbc9f8d49551d5caa2aee42fe7c1c9
MD5 59b70cfe57fa23bf59b23e9237eb368b
SHA1 7af5828d64094e2385abb01b3082f6896e8b9ebb
SHA512 8850224bb7fc5ae6b2901c5009c67141a08975dbfba1638f54b0fbd91bfbc23aa4649715c8be54f00c2d36eaac61767ee646b7b6942eb54ad102257a547397c6
TLSH
T16A21B155F330C008E24A827D603B9B251739E8469FBCEC0F85B920756E76F090E4BAE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 3b803eaba36ec41274bcd98c24a15d974eb8dba244114931abfb4143e697e3d9
MD5 0404113aeb63425f6fdbb0de92c7b2e7
SHA1 745e009d8a550c9b4a8ff66d9389418a967c18b9
SHA512 d7590b863cb5e7491e4f421e5edd7a6f763bb460b9f211cc747b87b1e39171fd5d9f72abbedb2938fa1fd90a2675056ae37ba67d5ac7fead3d7e139896403fe8
TLSH
T19AE020D076CCC15FE55130834164934CE3E13853EA852F416F10FC5E5502145FB479D1
MD5 SHA1 SHA512 TLSH

Submit Download

a0de5007-9da2-4ad7-853c-49df418441e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a0de5007-9da2-4ad7-853c-49df418441e5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce02c653672b700c7dd7fcd3bb35c9fbf04fde8299027591fd4caf14d957231
MD5 cc9afbaec5c082b8958ee2511f133752
SHA1 8c71f74e9e9702514ce7eba7aa23c0d24f429ef8
SHA512 934a3a0573ef84b409616806fda004d723ede0050577d4da7aeccaa8428ad8770542ea02d0047f937139fc0cbeca47708b9dd09b54ebc2d0c5a5a3002cbd588b
SSDEEP 3:MsEllllkEthXllkl2zEflFDi:/M/xT02zV
TLSH
T1224404047FC00407C500113451D1C3D45770D5500731574334D10437DCC75400C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4c83e9b9c8fbc1c0a7ace16606e0338f082e70ef1e7720c1046924532cd46316
MD5 ba38e7ad92d16e41732114158f8608e7
SHA1 a14d9901d7359a7a521de0476a169437cc2fa515
SHA512 92f4a8978f50e9a4da5b0734b36329151445cbceee7c91cf1ec35367022ab3c255dd93a4bb6ef3e4f582f64fd7d93a90d2c30ee91d60ff2ce41371e99f94a69f
SSDEEP 3:MsEllllkEthXllkl2zEfl7kl:/M/xT02z
TLSH
T1D94404057FC00407C50414704171D3505771F5100517775337D104335CC75414C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0e432e6ea9fb8cb477e8d0b953465d9ab2919d15949c83cf77360040b7606a80
MD5 1f570614fe611ba23160b29e3bda6b00
SHA1 2ae8c3baa0918abe146974ca54010157c7eaeed5
SHA512 9ff1f2a58357026f98a74343ca2e608d79c412b73700b39775f218d42b9d9ac1ed63c87f1d0a66d9877cb3cc1a0fb0e25b92c80b23ae9259d3e48404e6eaed23
SSDEEP 768:Hj+9u3gXh/oAthz+AW+152MvSCaiQvKjxuF7b9M1:q9u38/npx2plvKjxy7b+1
TLSH
T167039E3C9C55DD7F48AEB784724E3A66AEA41277C4B10E48CBC49B0DC1B364CF74692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 21ebe39ed13d5d8efcd64a6a7441a0f830054b9fa557c810b1aa12515c1ead5e
MD5 b09bc05f2192bc89fddaf2b4c7f893ae
SHA1 29b624e178775593724a3d6d55bade5f6112ea1b
SHA512 155a0ea0817780e769a8bd0b7f4721edb6adf481d2c7e79f31443daa55f22dd2a91de40a62b97f50f4fb0a7c8bd2140ac63afa9dffaa2963ce7d55fe84c7ce2a
SSDEEP 768:qj+9u3uXh8GAthn+AW+152MvSCaJCyyfBuFN9Mi:J9u3m8Jpx2p0ysByN+i
TLSH
T1D103AF39AC559D7F8CEAABC4734E3B166EA0127BC1910D58CFD85B0D419368CA347D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 54c101b5719e6fadfd2e5a8e65573b452bb6fc05bd61cd3debf8616adb2b42e6
MD5 34c202207ab2546f80ecf7761229ad66
SHA1 1d92f5ca6f9447f00ebd946ebeba93a353b7d5bf
SHA512 fca149320b9f0d23bba959a57a9573fb6587645c7c97255366b1b063abe5744397384b5b4d43465ddf31c44c92b67719227cf5100c115e5b62a725eb4b8eedf4
SSDEEP 768:jj+9u3dXh8GAthX+AW+152MvSCaJDcb9Mi:m9u3b8Fpx2pxcb+i
TLSH
T157F2BF32A855ED778CE6C2C4B74B3A46AFF0525781851E888DDDAF0D02CB69C524BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d40d22e35b39bc96342372f49bf196e9ed14ae773bac4deaeb4eda8b0d1b49b4
MD5 10e6845ea97022eb775a296418e1ccb5
SHA1 5ba6b6c523a665c7e1a8f0680b64ab803198c628
SHA512 0f8a93f51a5921f7274ba13825cc5c5b37e37947a9b28cac2506d0277f8c342ea4ac1da8e3f31a0003e64f9edcd54a06c55320c62ff53d0beb9ae676e8a9f6eb
SSDEEP 768:mj+9u3uXh8GAthX+AW+152MvSCaJDcb9Mi:19u3m8Fpx2pxcb+i
TLSH
T144F2AE32A855DD778CE6C2C4B74B3A56BFF0525782851E888DDDAF0D02CB69C524BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e06a897f5f3b5dabb3b06598b31fb3623ad62ce6c970138f4a0241818f684d95
MD5 0f737d7fe38218c3b8f5380fcd4567d4
SHA1 be5205723820fc85491405c51d00e08bf2f00629
SHA512 8a57d8ce5c0b3b99a5c7c77ac408515f27b4880b32527b6fa52b80625e1ed49240e616267884a2ce8be78be48f43f466ae93da47e062882da4fb7e035b3e9c77
SSDEEP 768:Arv+4UNbd23f+YPthx+AW+152MvSCa2HJ+8rir9:Absbs3f+Epx2paJDriR
TLSH
T15A03BF32E8A9A9778DE686C4764B36037FB0529385C10F94CDD96B4D029B6CD230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 823442e91bcc7973adbcba9e53da9b22e5a2f1f92d0b847fa1d990a0dd750094
MD5 ab6e6355d5311f793c4e6973113e7853
SHA1 d73d730c31c8a6cd52410b464d50685aade9632f
SHA512 e973c0a2331be3165ac853efbdae5a67a0a8d7ed28b191a36ec9730a61c3a3a654b46decfcc695e6b2058e50ed9eaf662e3292a1975a151b4cdb5d7285f42761
SSDEEP 1536:49u3U8lpx2pEgG7HDq1aztTfdSysBy/+i:4Wt/dgmjltTlSyso/Z
TLSH
T17543BE3ADC65DE7F8DEA9BC4B70E7A56AEE01167C1E449D8CBC89F4D109318C8346C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a7726c2bc63d9bfd8765e0b8e0f776dd0bd07ab07cd36da8657a964e6caa236e
MD5 62fdfa3b95e87933c4a36123335a4d20
SHA1 df4079af9308e8ff05e56a57b4a7757ade7f957c
SHA512 ca0a41013a188d4f16438dd952761246bc596246894f108235e2b34020b7bb2fd20b1fe4b5699284e15097b64cf655ea22a5a0b7a6c0c8e971d5fc8bc870a806
SSDEEP 3:MsEllllkEthXllkl2zEfl4LN:/M/xT02zfLN
TLSH
T1954404047FC43407C7401070C351D3745770D5500D11574734D304777CC75440C40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

3d54672b-a9b9-4a1c-92d5-bd87cfe22c96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d54672b-a9b9-4a1c-92d5-bd87cfe22c96.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 4KB
SHA256 ed20cd4b8b4aeccdb75b6afde075d096e33ae1236ee6148ec4946ddc06a25939
MD5 ed312caa763523e3d945e7a516dc9597
SHA1 0f775efb02e216af4bea379e8a02f375fbb67c45
SHA512 199549c7f0e54c7f68c6bed5a3fa364ae5c15d6c0e60339c093d3bc0802fc8534d9e9d76a00f93d19c05e980e76082ea111a5c5513d9de4a12ef371117f7050b
SSDEEP 3:IlpHlFllQ/8QuQll/lDAL6SlreqNcSFYojpuyOV9RUIU:Ypg/ZlCzetGy2
TLSH
T145911243260888B7DC84273F35C2009EBFB239000F81EC04417488B65781704660893A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a146848-9f20-442d-b078-01f2ec0e6ae1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2a146848-9f20-442d-b078-01f2ec0e6ae1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 928B
SHA256 aaf2eadcdc9b7be9b7909f5d4df20f52f2bb802327b63aa76cf3d2217277b69f
MD5 aef208fbe556bf45c933866f943f0152
SHA1 c81573bfd9d84d0fe1cc4168257a454afb47aea8
SHA512 45073e5abd6a239e47fb72e96bc63f2902893f760e8e0fc6879d579579973d05326f23ca0eff42d501e5f57ba366f1c491a14b0e70f3c6ddf6391a2c57bff1e1
TLSH
T16A11B2E13122A33F73874BC9A1650C846920E9A5032F6A9CEA565474FE5CED0A32D7C9
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir480_354263474\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5808_246453576\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

Spongebob-virus-main (1).zip.crdownload

Path C:\Users\Admin\Downloads\Spongebob-virus-main (1).zip.crdownload
Size 2KB
SHA256 0419d9a9972aad42984a93f79548122e66d1d47a719889dab9d2fcd510d3ab31
MD5 201a3fcca405528e0fb806971a187251
SHA1 658db2b53f880a173f5c63c5b27c89e2fe68b75d
SHA512 cb58750647a31d3a84b47546b996a22122a3a2481e1d2f53d07feab8bb1df8f86507a4965195e40170a02e4ddff2e54ddc67c9a30c97211fd012fe20b0982b2f
TLSH
T11841E91CE6765D5AE19484FFB3AE187FE8647C0A85618F4A0D2BD03D4CD1436ED0579C
MD5 SHA1 SHA512 TLSH

Submit Download

ᙐᭃ጑ᢙ⪢✉ցሐ⾻トᅸ୧઀ᬔᘾႎⰓᏜᶖᛨ⡿⦯⨬≁

Path C:\Users\Public\Desktop\ᙐᭃ጑ᢙ⪢✉ցሐ⾻トᅸ୧઀ᬔᘾႎⰓᏜᶖᛨ⡿⦯⨬≁
Size 666B
SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
MD5 e49f0a8effa6380b4518a8064f6d240b
SHA1 ba62ffe370e186b7f980922067ac68613521bd51
SHA512 de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
TLSH
T11D010292F2C309682B19FE75C76CCFBD4B5A12A58AB7D19F0D84034344C0611599D76E
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_741259925\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3084-3330-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/3084-3691-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads