hxxp://google[.]com

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
930s
max time network
1142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://google.com
Sample260710-eabkkadz7v

Score

10^/10

bootkit credential_access discovery execution persistence ransomware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 48 IoCs

description	pid	Process	procid_target
PID 5308 created 6084	5308	Monoxide.exe_Virus_Download.exe	140
PID 5308 created 3056	5308	Monoxide.exe_Virus_Download.exe	141
PID 5308 created 4916	5308	Monoxide.exe_Virus_Download.exe	143
PID 5308 created 2676	5308	Monoxide.exe_Virus_Download.exe	142
PID 5308 created 2656	5308	Monoxide.exe_Virus_Download.exe	145
PID 5308 created 5324	5308	Monoxide.exe_Virus_Download.exe	146
PID 5308 created 5400	5308	Monoxide.exe_Virus_Download.exe	147
PID 5308 created 6084	5308	Monoxide.exe_Virus_Download.exe	140
PID 5308 created 6084	5308	Monoxide.exe_Virus_Download.exe	140
PID 5308 created 4916	5308	Monoxide.exe_Virus_Download.exe	143
PID 5308 created 4916	5308	Monoxide.exe_Virus_Download.exe	143
PID 5308 created 1688	5308	Monoxide.exe_Virus_Download.exe	85
PID 5308 created 3844	5308	Monoxide.exe_Virus_Download.exe	86
PID 5308 created 2608	5308	Monoxide.exe_Virus_Download.exe	90
PID 5308 created 3152	5308	Monoxide.exe_Virus_Download.exe	88
PID 5308 created 1780	5308	Monoxide.exe_Virus_Download.exe	89
PID 5308 created 4152	5308	Monoxide.exe_Virus_Download.exe	93
PID 5308 created 4476	5308	Monoxide.exe_Virus_Download.exe	98
PID 5308 created 1628	5308	Monoxide.exe_Virus_Download.exe	106
PID 5308 created 2056	5308	Monoxide.exe_Virus_Download.exe	109
PID 5308 created 1876	5308	Monoxide.exe_Virus_Download.exe	111
PID 5308 created 3212	5308	Monoxide.exe_Virus_Download.exe	112
PID 5308 created 5032	5308	Monoxide.exe_Virus_Download.exe	118
PID 5308 created 1144	5308	Monoxide.exe_Virus_Download.exe	120
PID 5308 created 3028	5308	Monoxide.exe_Virus_Download.exe	124
PID 5308 created 2052	5308	Monoxide.exe_Virus_Download.exe	125
PID 5308 created 2564	5308	Monoxide.exe_Virus_Download.exe	126
PID 5308 created 1076	5308	Monoxide.exe_Virus_Download.exe	129
PID 5308 created 5808	5308	Monoxide.exe_Virus_Download.exe	130
PID 5308 created 812	5308	Monoxide.exe_Virus_Download.exe	131
PID 5308 created 1572	5308	Monoxide.exe_Virus_Download.exe	134
PID 5308 created 1688	5308	Monoxide.exe_Virus_Download.exe	85
PID 5308 created 1688	5308	Monoxide.exe_Virus_Download.exe	85
PID 5308 created 3152	5308	Monoxide.exe_Virus_Download.exe	88
PID 5308 created 3152	5308	Monoxide.exe_Virus_Download.exe	88
PID 5308 created 6692	5308	Monoxide.exe_Virus_Download.exe	172
PID 5308 created 6608	5308	Monoxide.exe_Virus_Download.exe	173
PID 5308 created 7596	5308	Monoxide.exe_Virus_Download.exe	174
PID 5308 created 1624	5308	Monoxide.exe_Virus_Download.exe	175
PID 5308 created 6616	5308	Monoxide.exe_Virus_Download.exe	176
PID 5308 created 7840	5308	Monoxide.exe_Virus_Download.exe	178
PID 5308 created 7764	5308	Monoxide.exe_Virus_Download.exe	179
PID 5308 created 3832	5308	Monoxide.exe_Virus_Download.exe	183
PID 5308 created 2864	5308	Monoxide.exe_Virus_Download.exe	182
PID 5308 created 6692	5308	Monoxide.exe_Virus_Download.exe	172
PID 5308 created 6692	5308	Monoxide.exe_Virus_Download.exe	172
PID 5308 created 1624	5308	Monoxide.exe_Virus_Download.exe	175
PID 5308 created 1624	5308	Monoxide.exe_Virus_Download.exe	175

Executes dropped EXE 1 IoCs

pid	Process
6276	譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
240	raw.githubusercontent.com
241	raw.githubusercontent.com
242	raw.githubusercontent.com
436	raw.githubusercontent.com
528	raw.githubusercontent.com
688	raw.githubusercontent.com
689	raw.githubusercontent.com
92	raw.githubusercontent.com
534	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5308	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
3280	Monoxide.exe_Virus_Download.exe
5024	Monoxide.exe_Virus_Download.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1044	chrome.exe
4216	msedge.exe
7464	msedge.exe
3152	msedge.exe
4916	chrome.exe
1624	msedge.exe

Checks processor information in registry 2 TTPs 43 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Monoxide.exe_Virus_Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Monoxide.exe_Virus_Download.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{00611776-ADB0-46D7-96E3-675A3D09BEC6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{881C06D6-504C-415C-A783-E795E54CBEF9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{D8EFAEFC-1B2D-46BF-BB2A-AE50F3FD66D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Monoxide(1).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Monoxide.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
3608	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
6084	chrome.exe
6084	chrome.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
5308	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
7868	Monoxide.exe_Virus_Download.exe
3280	Monoxide.exe_Virus_Download.exe
3280	Monoxide.exe_Virus_Download.exe
3280	Monoxide.exe_Virus_Download.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6692	msedge.exe
6692	msedge.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5308	Monoxide.exe_Virus_Download.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	7236	svchost.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe
Token: SeShutdownPrivilege	3708	chrome.exe
Token: SeCreatePagefilePrivilege	3708	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2904	OpenWith.exe
988	OpenWith.exe
2052	OpenWith.exe
7540	SecHealthUI.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
6276	譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe
7040	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3844	1688	msedge.exe	86
PID 1688 wrote to memory of 3152	1688	msedge.exe	88
PID 1688 wrote to memory of 1780	1688	msedge.exe	89
PID 1688 wrote to memory of 1780	1688	msedge.exe	89
PID 1688 wrote to memory of 2608	1688	msedge.exe	90
PID 1688 wrote to memory of 2608	1688	msedge.exe	90
PID 1688 wrote to memory of 2608	1688	msedge.exe	90
PID 1688 wrote to memory of 5640	1688	msedge.exe	91
PID 1688 wrote to memory of 4944	1688	msedge.exe	92
PID 1688 wrote to memory of 5640	1688	msedge.exe	91
PID 1688 wrote to memory of 5640	1688	msedge.exe	91
PID 1688 wrote to memory of 4944	1688	msedge.exe	92
PID 1688 wrote to memory of 4944	1688	msedge.exe	92
PID 1688 wrote to memory of 4152	1688	msedge.exe	93
PID 1688 wrote to memory of 4152	1688	msedge.exe	93
PID 1688 wrote to memory of 4152	1688	msedge.exe	93
PID 1688 wrote to memory of 4408	1688	msedge.exe	94
PID 1688 wrote to memory of 4408	1688	msedge.exe	94
PID 1688 wrote to memory of 4408	1688	msedge.exe	94
PID 1688 wrote to memory of 1724	1688	msedge.exe	96
PID 1688 wrote to memory of 2016	1688	msedge.exe	97
PID 1688 wrote to memory of 1724	1688	msedge.exe	96
PID 1688 wrote to memory of 2016	1688	msedge.exe	97
PID 1688 wrote to memory of 4476	1688	msedge.exe	98
PID 1688 wrote to memory of 4476	1688	msedge.exe	98
PID 1688 wrote to memory of 4476	1688	msedge.exe	98
PID 1688 wrote to memory of 4368	1688	msedge.exe	100
PID 1688 wrote to memory of 6136	1688	msedge.exe	103
PID 1688 wrote to memory of 2668	1688	msedge.exe	104
PID 1688 wrote to memory of 6084	1688	msedge.exe	105
PID 1688 wrote to memory of 1628	1688	msedge.exe	106
PID 1688 wrote to memory of 1628	1688	msedge.exe	106
PID 1688 wrote to memory of 3084	1688	msedge.exe	108
PID 1688 wrote to memory of 3084	1688	msedge.exe	108
PID 1688 wrote to memory of 3084	1688	msedge.exe	108
PID 1688 wrote to memory of 2056	1688	msedge.exe	109
PID 1688 wrote to memory of 2056	1688	msedge.exe	109
PID 1688 wrote to memory of 2056	1688	msedge.exe	109
PID 1688 wrote to memory of 4764	1688	msedge.exe	110
PID 1688 wrote to memory of 1876	1688	msedge.exe	111
PID 1688 wrote to memory of 3212	1688	msedge.exe	112
PID 1688 wrote to memory of 1876	1688	msedge.exe	111
PID 1688 wrote to memory of 1240	1688	msedge.exe	113
PID 1688 wrote to memory of 1240	1688	msedge.exe	113
PID 1688 wrote to memory of 1240	1688	msedge.exe	113
PID 1688 wrote to memory of 444	1688	msedge.exe	114
PID 1688 wrote to memory of 444	1688	msedge.exe	114
PID 1688 wrote to memory of 1800	1688	msedge.exe	115
PID 1688 wrote to memory of 2300	1688	msedge.exe	116
PID 1688 wrote to memory of 1800	1688	msedge.exe	115
PID 1688 wrote to memory of 1800	1688	msedge.exe	115
PID 1688 wrote to memory of 5032	1688	msedge.exe	118
PID 1688 wrote to memory of 5032	1688	msedge.exe	118
PID 1688 wrote to memory of 4664	1688	msedge.exe	119
PID 1688 wrote to memory of 4664	1688	msedge.exe	119
PID 1688 wrote to memory of 1144	1688	msedge.exe	120
PID 1688 wrote to memory of 1144	1688	msedge.exe	120
PID 1688 wrote to memory of 3028	1688	msedge.exe	124
PID 1688 wrote to memory of 3028	1688	msedge.exe	124
PID 1688 wrote to memory of 3028	1688	msedge.exe	124
PID 1688 wrote to memory of 2052	1688	msedge.exe	125
PID 1688 wrote to memory of 2052	1688	msedge.exe	125
PID 1688 wrote to memory of 2052	1688	msedge.exe	125
PID 1688 wrote to memory of 2564	1688	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffdf3ebc188,0x7ffdf3ebc194,0x7ffdf3ebc1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,8690235075301726140,9633941514906722556,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,18267392238009519209,8485218872983561943,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,54124011610634666,13772907240918768410,262144 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,1099190139270673442,6833039952165504271,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14226885571821319109,3943025653560372483,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10192925289995961933,1563201028187835682,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,14655790235020024727,10352312298462877381,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:9
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14793903992864798388,4413315886176472152,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15911437489498573639,8659610479492846418,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5932,i,9695956782243736059,11047983618594466443,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,18358633768008873301,7119014453652716346,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,18358633768008873301,7119014453652716346,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,445997681655286329,6917623416955625400,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,9189260143134216886,6736686246702982410,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=1220 /prefetch:14
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,2692664041691010685,3231677486971552363,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,16981282526448392783,11376320877020365441,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5680,i,3266907749693464793,17104346591409454798,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6692,i,17099817794212913411,4656016073592878988,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6844,i,363584324117244826,7077390315148560907,262144 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,13148042518840622826,13433785631009726417,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:12
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,209729373447280496,6550464680481530793,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4952,i,5520061250475305231,2729191494940134289,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,5182789194819586932,17847137264688106368,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5564,i,3195016162340235063,15083807972951780481,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12796418641703395540,17510177093531891196,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,15008013713392511021,6381802006382347614,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,8919363065341623310,10282475862983180910,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,17506842827009146170,5254270842257023381,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7464,i,1978197492791035566,924074924811989935,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7568,i,17804718327420104838,16765657954322190606,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7860,i,14820429127336300509,18303828935783778709,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,10114022883815908506,2629700331247994798,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=1456 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7940,i,15492334272454685608,5134994769927123873,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7699192802809935936,17049685292455846992,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8220,i,5657337474503959877,8993651084437114459,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7876,i,14847223420008589547,13175184206225572601,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7400,i,15601536138277899028,15491614042228160208,2097152 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,3046096209859181112,3508127813001368723,524288 --field-trial-handle=2828,i,3903379167016666851,5160297821873632758,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:14
  2⤵
  PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4308

C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe
"C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffde76ac728,0x7ffde76ac734,0x7ffde76ac740
    3⤵
    PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,3762610314790135749,5136202483692202589,262144 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,13734468138172997824,11559955492295671891,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,9230741550089977349,5757752197120508879,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,14631005615513811419,4171001239120258818,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,6473277323711782166,11613273761370837250,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,583584092642540080,6407544021686886727,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
    3⤵
    PID:6420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,6865469671464915320,2031921669717251473,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
    3⤵
    PID:6484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5420,i,15043688009504990741,16618277604953248318,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:6720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,1732621731233519807,7494800859998820188,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:6432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5600,i,11398370599475403732,7169847017791048394,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:6756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,18437314336461269055,9566624821951708609,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5148,i,1969322575354640015,446814940882258543,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:7136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,9875059023656706574,11671109465140439975,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:6616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5716,i,14647132765601974535,7519687753876777361,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:6512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5948,i,6604405662157475272,3499663421690337837,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5056,i,10999390532937568822,12094513698043063468,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:6536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5436,i,9673296106336243962,513592467106593168,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:6868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,1132536423564000173,5765772931459107691,524288 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5852,i,4220268714286346633,17741260967925370674,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:9
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3028,i,4471069239873265192,17153868113788423154,2097152 --field-trial-handle=2004,i,2640099580594521365,10176925137642726971,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:6288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffdf3ebc188,0x7ffdf3ebc194,0x7ffdf3ebc1a0
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,10144564423094819885,14509790173521071520,262144 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:7596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,2634120514801938197,16283385927364792247,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,10221405117255175520,16769734926880391823,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,11834904049361263321,144980305084968242,2097152 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:7840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,16059515960038129134,9573305313777668038,2097152 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:7764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13670509889692417643,16942953159241888415,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,15031064781999318437,4978416360217187068,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10961488574860155249,5036950114233721692,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6847300356298251552,2496531159301824898,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9949791030316181310,5220439301939221887,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9949791030316181310,5220439301939221887,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4198126142868299311,13614628434753543053,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,1164165608413406872,16575573907938402210,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17057783747013050979,8694847908942751638,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4873029976495770911,17613821335024882372,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6951974529817924954,419852748757124000,524288 --field-trial-handle=2304,i,1279790123635543946,747988350147382911,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:6876

C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe
"C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6312

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:7540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:8060

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:7236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6768

C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe
"C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7868

C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe
"C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3280

C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe
"C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download\Monoxide.exe_Virus_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffdf617c728,0x7ffdf617c734,0x7ffdf617c740
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,2044899116363130791,14826038470480325143,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7602263393550274598,9508957149366986512,262144 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,8121409316997285337,15557269172514982957,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,16555474608399512577,8836238904810458768,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,4294102806272321615,3360641927244013348,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,14745945982982694376,10498446955672848020,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,15984692654898714309,16266066249427416346,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,5199033804549943624,8308837407818183230,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,15427288127855463255,1009669695987351197,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,12368714896598437612,2998557320120645912,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,5059994553192663865,4973319020467221678,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,7104006120815766491,11097528204553560269,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,309487733960499306,8788601585837000148,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5436,i,2700570827337322137,15748688992995817345,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,5465279667150913222,7235435146932801284,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:9
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6476,i,10949274965657717093,9559636518628724529,2097152 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:7484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,17138473026588770691,8392630926764961030,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
  2⤵
  PID:6364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,7753839139649316443,16508141644311720801,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,4410579907171712920,9175897805507447109,524288 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6044,i,3237806626633384724,9575720704840750655,262144 --field-trial-handle=1936,i,11015025623802290773,12728336910208006053,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:10
  2⤵
  PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:7040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {6f0d176a-a04c-4fe0-a4bf-049cf1f0f91a} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {aa49a1c5-7f5e-4839-b219-56d866adde93} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27323 -prefMapHandle 3732 -prefMapSize 270279 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {306058f0-f293-496a-a161-d206f56f347e} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27323 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {40c81361-d7ec-428a-9aa7-876fee892cc1} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 34822 -prefMapHandle 4564 -prefMapSize 270279 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4576 -initialChannelId {4f3dd3fe-e6a4-4cc5-a842-4f4a298b17be} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1612 -prefsLen 34903 -prefMapHandle 1616 -prefMapSize 270279 -ipcHandle 3008 -initialChannelId {53c2bf31-1680-4247-9593-993dc2629bef} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {55826c22-07eb-44e6-bc12-44babfb510c0} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {8b3b021b-3fb9-4f8b-9085-21e9273f6b2a} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5900 -prefsLen 32952 -prefMapHandle 5904 -prefMapSize 270279 -jsInitHandle 5908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5916 -initialChannelId {b090af29-a82f-490f-954d-5bf22338cc18} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 36836 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 2664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6288 -initialChannelId {35ce6d6b-c7a9-4c2d-934d-4c9cf6850c43} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 36836 -prefMapHandle 4964 -prefMapSize 270279 -jsInitHandle 5508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {237e0df9-5ae0-46c0-8db6-3c23639db051} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:7724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 36836 -prefMapHandle 5968 -prefMapSize 270279 -jsInitHandle 5972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2588 -initialChannelId {316b076b-d782-43bd-b0ac-96ba62268933} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6220 -prefsLen 36836 -prefMapHandle 7172 -prefMapSize 270279 -jsInitHandle 7008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7164 -initialChannelId {e20ee071-9f7f-45b5-ae4e-f1a863f6bf6c} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6036 -prefsLen 39973 -prefMapHandle 6884 -prefMapSize 270279 -ipcHandle 7216 -initialChannelId {f2346be1-afb4-4268-9132-1ea7c8dba941} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7236 -prefsLen 39973 -prefMapHandle 7240 -prefMapSize 270279 -ipcHandle 7092 -initialChannelId {d1d544c5-1a6d-438b-abf2-e1787d9a5c8e} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
    3⤵
    - Checks processor information in registry
    PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6564 -prefsLen 36836 -prefMapHandle 7216 -prefMapSize 270279 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7588 -initialChannelId {4c64e9c9-8331-4c1c-b563-b74d16fbb351} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6868 -prefsLen 36836 -prefMapHandle 6872 -prefMapSize 270279 -jsInitHandle 6856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2588 -initialChannelId {c1320adb-70de-488a-9afd-b4b9ebeb67eb} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6936 -prefsLen 36836 -prefMapHandle 6956 -prefMapSize 270279 -jsInitHandle 1848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {0a352242-1ed2-4877-bf8d-8796947cd1c3} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 36836 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 7100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6968 -initialChannelId {9114d9cc-e28c-4817-ae6a-2bc60b4026b5} -parentPid 7040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5292

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6156

C:\Users\Admin\Downloads\Monoxide\Monoxide\Monoxide x64.exe
"C:\Users\Admin\Downloads\Monoxide\Monoxide\Monoxide x64.exe"
1⤵
PID:7548
- C:\Users\Admin\AppData\Local\Temp\譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe
  "C:\Users\Admin\AppData\Local\Temp\譯錣湧嗍懹擞擴贚墕叭鿰湾妟鏮芜兢.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6276
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini
    3⤵
    PID:5852
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\br.txt
    3⤵
    PID:572
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\el.txt
    3⤵
    PID:2096
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\hi.txt
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml
    3⤵
    PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffde768c188,0x7ffde768c194,0x7ffde768c1a0
      4⤵
      PID:7300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,8046275842270668608,10553823537262924842,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,9688114192478734850,4188753401150966485,262144 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12822954402328472375,9668186669331352238,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,17390084454278037266,6300204869387571073,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:7724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,13135754940806393549,11420071000577066455,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,13389277997486519994,9395361573826918954,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,6119419462228070946,8681174283911090588,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,9377122926760738821,9197816683508506634,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,8750890961346700839,10389562558950763846,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      4⤵
      PID:7896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,518130011661550137,13445130479799673826,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5488,i,17857292040041189134,2621237875375464406,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4836,i,14685158909570230304,6604799081360301657,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3696,i,13193572017253432558,7945057666129657765,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6020,i,7368493037369911613,7672504602418377698,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12847135107885011655,1647506726526644291,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,15536403951682982854,17507614511886088106,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,18378591581628497050,14403254993132897942,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6832,i,17475343868196975396,10403978084834253253,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
      4⤵
      PID:7124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7244,i,14017173169721520403,323752267549018525,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
      4⤵
      PID:7512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7556,i,15037134812732894086,11807073241546160282,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7260,i,11767618863218326936,17119523802854969742,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8000,i,14136873914589704452,16248091018485562655,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8220,i,12318089363539917385,10672339042968518593,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8524,i,6410855595035607219,13065588133432693675,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8448,i,2912794951743557444,6551950070911487158,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9068,i,17115313802507438064,8701927961130533284,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:14
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9308,i,9165814837688677501,14163514542941230676,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,10624888847523775019,1701724206533751577,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9588,i,13567297208289088323,7465068407633915822,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:14
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6600,i,12134746546539557736,1663225209568024461,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9772 /prefetch:1
      4⤵
      PID:7852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8728,i,11466388969099745778,9973513732598100395,524288 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:14
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=10036,i,16419848993383782404,2475575067188707355,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:1
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9304,i,15758707036719766523,10917495496578846306,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6508,i,11714938857713941282,14437481923693548508,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6376,i,3561504646025616641,11542123118755799676,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6532,i,7410324441213384066,9089544567654341683,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10404,i,3875643758901293347,2344886934246447258,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10584,i,5008410643962528006,6378352194863910571,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10608 /prefetch:1
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8764,i,2793038209482892755,13109870323142053059,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10868,i,16962358931678800606,10170673321718494636,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11080,i,4205248309954233191,904304942852879197,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11100,i,15150354761250939678,6091987819675721908,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9688,i,6796872238725152360,2659749975693748433,262144 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:10
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11076,i,8723948547498106702,10657053691745661597,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11668,i,3239898047786303057,9981042784418467786,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
      4⤵
      PID:8528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11872,i,17451368330820520196,9030924164609558520,2097152 --field-trial-handle=2656,i,1963420131157572856,1446895904888275225,262144 --variations-seed-version --mojo-platform-channel-handle=11880 /prefetch:1
      4⤵
      PID:8896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:7864
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe"
    3⤵
    PID:6812
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe"
    3⤵
    PID:1752
- - C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
    "C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe"
    3⤵
    PID:4896
  - - C:\Program Files\Java\jdk-1.8\bin\java.exe
      "C:\Program Files\Java\jdk-1.8\bin\java.exe" -Xmx256M "-Djavafx.home=C:\Program Files\Java\jdk-1.8\bin" -classpath "C:\Program Files\Java\jdk-1.8\bin\..\lib\ant-javafx.jar;" com.sun.javafx.tools.packager.Main
      4⤵
      PID:4112
- - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    "C:\Program Files\Java\jdk-1.8\bin\javaw.exe"
    3⤵
    PID:2432
- - C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
    "C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe"
    3⤵
    PID:3912
- - C:\Program Files\Java\jdk-1.8\bin\jstat.exe
    "C:\Program Files\Java\jdk-1.8\bin\jstat.exe"
    3⤵
    PID:1844
- - C:\Program Files\Java\jdk-1.8\bin\policytool.exe
    "C:\Program Files\Java\jdk-1.8\bin\policytool.exe"
    3⤵
    PID:2816
- - C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
    "C:\Program Files\Java\jdk-1.8\bin\schemagen.exe"
    3⤵
    PID:2344
- - C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
    "C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE"
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml
    3⤵
    PID:5828
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi"
    3⤵
    PID:6652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Integration\C2RManifest.outlookmui.msi.16.en-us.xml
    3⤵
    PID:1372
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt
    3⤵
    PID:4444
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt
    3⤵
    PID:6252
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt
    3⤵
    PID:6720
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMailNaiveBayesCommandRanker.txt
    3⤵
    PID:6404
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\OutlookNaiveBayesCommandRanker.txt
    3⤵
    PID:2380
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt
    3⤵
    PID:1988
- - C:\Windows\hh.exe
    "C:\Windows\hh.exe" C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM
    3⤵
    PID:6540
- - C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
    "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe"
    3⤵
    PID:1092
- - C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
    "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe"
    3⤵
    PID:7492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml
    3⤵
    PID:5876
- - C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
    "C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe"
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\ROGERS.COM.XML
    3⤵
    PID:7496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.UK.XML
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.HK.XML
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.PL.XML
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML
    3⤵
    PID:2524
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt
    3⤵
    PID:7184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
    3⤵
    PID:7056
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"
    3⤵
    PID:8488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml
    3⤵
    PID:8508
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\EDGE.INF
    3⤵
    PID:8804
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.INF
    3⤵
    PID:8864
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.INF
    3⤵
    PID:8968
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
    3⤵
    PID:9076
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js"
    3⤵
    PID:8704
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Mozilla Firefox\platform.ini
    3⤵
    PID:8872
- - C:\Program Files\Windows Defender\MpCopyAccelerator.exe
    "C:\Program Files\Windows Defender\MpCopyAccelerator.exe"
    3⤵
    PID:6212
- - C:\Program Files\Windows Defender\MsMpEng.exe
    "C:\Program Files\Windows Defender\MsMpEng.exe"
    3⤵
    PID:9072
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Windows Defender\ThirdPartyNotices.txt
    3⤵
    PID:8264
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps1"
    3⤵
    PID:6588
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.strings.psd1"
    3⤵
    PID:6900
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt
    3⤵
    PID:6488
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.Tests.ps1"
    3⤵
    PID:8520
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer
    3⤵
    PID:9128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js"
    3⤵
    PID:7452
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css
    3⤵
    PID:3756
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg
    3⤵
    PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffde768c188,0x7ffde768c194,0x7ffde768c1a0
      4⤵
      PID:8820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4498283403509963620,1661087975493692610,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:11
      4⤵
      System Time Discovery
      PID:7464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,9397578296713776659,9989023945719072984,262144 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,18346977935610328129,1465437641094730556,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3724,i,4413872285628958503,3437487539981386095,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:7328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3796,i,6058978412883538022,17870601575148240491,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4432,i,14356370920948300179,5434923763654415625,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4656,i,12746661054097372451,9825730476516156688,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5420,i,17514989134457191442,5687269814068722342,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:8752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5616,i,12203190308874732404,17415702544986481372,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,1628398939429619912,13427514552217203631,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6032,i,17713482687001257560,3856721365023508192,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6216,i,1181213719650184287,12096028848860849793,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,1248115060745417749,18273256981967272636,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12408318234452228224,2368441450814590689,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:7828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,425248590936553019,14640692229266405814,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
      4⤵
      PID:9288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,425248590936553019,14640692229266405814,524288 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
      4⤵
      PID:9344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7548,i,17720916294783319261,6098736171767838491,2097152 --field-trial-handle=2820,i,9122971207964135230,3427687246397896562,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
      4⤵
      PID:10232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\move.svg
    3⤵
    PID:7584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview.svg
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\download.svg
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-hover_32.svg
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg
    3⤵
    PID:8292
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js"
    3⤵
    PID:5024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js"
    3⤵
    PID:6448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js"
    3⤵
    PID:4784
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js"
    3⤵
    PID:3112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js"
    3⤵
    PID:8640
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js"
    3⤵
    PID:4616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ui-strings.js"
    3⤵
    PID:9088
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main-selector.css
    3⤵
    PID:7000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js"
    3⤵
    PID:8544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_fillsign_logo.svg
    3⤵
    PID:1072
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\ui-strings.js"
    3⤵
    PID:9208
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js"
    3⤵
    PID:3832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js"
    3⤵
    PID:7860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js"
    3⤵
    PID:1916
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js"
    3⤵
    PID:7588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js"
    3⤵
    PID:8096
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js"
    3⤵
    PID:1732
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js"
    3⤵
    PID:7940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js"
    3⤵
    PID:6884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js"
    3⤵
    PID:7120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js"
    3⤵
    PID:576
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js"
    3⤵
    PID:4012
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css
    3⤵
    PID:3240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js"
    3⤵
    PID:1000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js"
    3⤵
    PID:9024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js"
    3⤵
    PID:3088
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js"
    3⤵
    PID:8504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js"
    3⤵
    PID:792
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js"
    3⤵
    PID:1948
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js"
    3⤵
    PID:3040
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js"
    3⤵
    PID:9328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:9388
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js"
    3⤵
    PID:9424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:9580
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js"
    3⤵
    PID:9616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js"
    3⤵
    PID:9800
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css
    3⤵
    PID:9868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\ui-strings.js"
    3⤵
    PID:9932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js"
    3⤵
    PID:10008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js"
    3⤵
    PID:10044
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js"
    3⤵
    PID:10076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\af_get.svg
    3⤵
    PID:10132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
1⤵
PID:7640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC56BCA352BD574A01EB9A6AD169D4AF
  2⤵
  PID:5352
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5A5DCEA034D9D9182F7D12B025174363
  2⤵
  PID:6468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C8AAB6FA4E7EAFED36AB23F7A72C6DB6 E Global\MSI0000
  2⤵
  PID:8160
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:9624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E666114A205D33B1603CFE6A3990AF60 E Global\MSI0000
  2⤵
  PID:9020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e25db8bd0e15f32c0b5222151ce6cee34f5deec9decc42b90281755337be1497
MD5 7a607af3b1a12e26bdf1738d90c863b5
SHA1 ea47b654b7b772b3662683d5bd60c94c6461cc21
SHA512 f86f11f5e185c9cdb6f80d214b233e1e85b706fc42d7f7d91bf26d4fccf704c20f67a8db75e6434e6d3d84ce7ee3c7706ca3e029e6268de7066cb30d2fc69a85
MD5 SHA1 SHA512

Submit Download

3ff85ce4-3776-46da-9455-9dd0dddac6f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ff85ce4-3776-46da-9455-9dd0dddac6f4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 41KB
SHA256 cad87a0bebbd32e72790b58d28513b2b54783bfac3c09650fa7711087b263dcd
MD5 a9a2fe43d6e338ec6de2c36d01098638
SHA1 772413ddb3d4ea8dfe8405ad2b6688bfde1259fe
SHA512 85dcfa7f9a2e3269b154db5ee1d4e3671e3bc1e3a686acb38a303067e4d36df8db38acb6a5b5441152877fedcdecb6340449968598b790cbbdaebaf4d274268b
SSDEEP 768:BE//qZdqVxGDRsdtKBVYEe4h42aO0FzDzEUF2TUDCDn+eiOM/ylYM2rbe3Fv1WmQ:BC/qZdqVxwI7EZh4/FfYUFITnhvu02iq
TLSH
T1BC130214645DD419FE4AFC7FD9B20E5C1098779025840C807A2360BE3C9ADBEEAF9B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 0820e62d0aa1f658788b4474e828d683680266cd558ef19732d7d93e0e8ab169
MD5 97a9e2ff84ad8f3528f0c9f606883a5c
SHA1 f5a5e65fefc725dd95c2989cebd4484a44373115
SHA512 18bb4c37e4fe8cbd4ff7920f1b12ce60df8a4b4dd7faa36d432e639fa6aa709f4cf299bc35283b0a27b1fcbb50c8d8637512222948b4bd434b59ddb35734efa5
TLSH
T1E4C0926122950031C7BA457809B35460B0A03AE81886996BA6E0229DFCA2BF0689959E
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_128.png
Size 4KB
SHA256 149fc2270389655ee20da9cebb31ffde75e16e3ad371b9b907f62013ed45e705
MD5 7424a1046f7a440dc5e43b9a3c5d791e
SHA1 0672cf5b67820e81beb23010f62123e0b362e3ab
SHA512 2836cb5b4d682bc70e74c88af21e0ce972679eb07e88aa0b80db5990a68453e1c9580e530eede390c743d7377ea8ff3df7b78a7c5ddbde124d7782c63cf329bb
SSDEEP 96:jzliICMC5QmAjL7eTu3Ay1Hnn5IlQRU19x0tfo4CPmukC0:jzQzAjLiTK1H5IlQW1Xbm7
TLSH
T1AF916BA01EB4FABCD449F179A423BA2CD4049904D83583278E1DBF7626247A633C94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_16.png
Size 582B
SHA256 15b1cc630202324ad6b3b142a22cb1a55de8d6d9a0bcab78d5b14cd997a5ddd5
MD5 b323815b176657da3933a39e5658177e
SHA1 27e230c6d7b1774a9cfdebd6271e781619e797eb
SHA512 c049c8c8ad36fef941ef3917fee911d632923f41e8d2b3caea8938c87dda229c0d632f8f07aa3334fe79a31de87e75bb73d45d4811f9e81e0f261238bc41014b
TLSH
T105F0E1E29628FDD8C20AC13E4619AD21BDB258D85BA04B380553ECB13DA9AA9C065195
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\manifest.json
Size 1KB
SHA256 f52714812d68c577a445169d11e84df6751c2d6886bc429643072bb5d61c6c27
MD5 01334fb9d092af2aa46c4185e405c627
SHA1 47ad3c0e82362ffe5b881df8d71d6f79ab7f5796
SHA512 888d96adb7a847abe472145258c8c46950eb2fa3ba7d596c2e90a17c8fb06fd0155c56cc8aba5d076d89368417464bcb2d236f9e40e53241950a01f9f8ed548f
TLSH
T1F721CAE72455C0BB16B0DBD9B8A8620BF733130E8490C6CF793C404DCFBA8E2524A668
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7031ef59a253a130291759cb9cedf9f2a363be2b52109fa919148ca0e5c60762
MD5 8686f6e88cb18280a71f266296b4e083
SHA1 ceee4fc26530d6651d2ff4af9bdbbd7cf3adeebc
SHA512 f03754b25c5dbccc1b96152dcaa832133f4820dc7a130e914ee5749b8f4fae8fb3c97566c2b7cb198c07a5be9cd6f367f569028fc678b3852f3c516d57964f9b
TLSH
T178816CF7C3D8D92D891156F89B256E1FCD6D0A18522C3C26C8E8BE5B53E2972D31035E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c85387c585a3b3c295e36b8c7e4e628bf4844a0c905f74d18f24ba44a493467c
MD5 46352f82a739b13c2764aa794599b9b0
SHA1 93bb915f46d7f82baa96573df4847042f09b1cf6
SHA512 d0b19f59b520825ad396ec2a280861f2d606d6ab9b5ad392c130641eef8c7f3fc8349df1f173d19cd537af1990a08e0765be249d7ddd7a5532b3c07e900de283
TLSH
T116817DF7C3D8D96D891156F89B256F1FCD2E0A18422C3C26C8D8BE5B93E2972D21025E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f10d098d41b627c87f3ce8355c03f433dcb15716b1b9c392e9b0d5baafe860c1
MD5 fc8e3f43de502a35a438f4ad6f49fd16
SHA1 ad579fc29f4a023328940faf6a42c03f1229aef5
SHA512 4f81616ea467d363843e5e648d0afff3919cfb6c1a5ec84c4f3b4265826829c96454c381ab40c99f75c65cef77d3e8dedd9fb14c197cbc5d11ca35f40b37a7e5
TLSH
T198F050A7F66DF453307945EE4D0CB80978B5F43501616CF4EE5B42ADD1C19AB0B17453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a98114ddc8d982cf9958b50b5b2d0fbd59b1932957f940d689deed365511ffb1
MD5 64e15c4bfd8e08b4d705439301f35713
SHA1 7faa72137555bb0e4be5886d12e931d9d4f225ae
SHA512 724e65fcf7f0225c8291938105c3912142d4fc206288a0d7256b706790e4adc93256ed4444222d3da7fe7833e5b849112d986f4d55be0fa03613ddc4160b85fc
SSDEEP 192:/RvlGPtybv7jzPRpDM19ZHsb+WNn53r9TglOcVyIsnAUgE:/RvlGlyjDXcbwVlg44E
TLSH
T13732741EBD15A93B6DCAD21DFA25B792D3F5102236A42E84EBFC8A2C15DB5CC3117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 334d08a8e8a9d070541a20bd884bc7f0bfdf480630c06702b3ae0dbf34c38505
MD5 2263cea3bb4d46f68d678c5677df7642
SHA1 31ad09614590f3b8f293acc2e84cc51b7c4e02b5
SHA512 a3962e980cc8b368f2fd3e4fa5fc7635273d0119668b25493e441ab56659a8c86f088a32d3165b8873f08c30b8ae1cbeb69b52b29b19d99f77b06a5c1ea6fe65
SSDEEP 192:pRvlGPtiSv76vAPRp2e9ZHsb+WNnWyP6qEVyIsnAUgR:pRvlGli+G6XdbwDPXAR
TLSH
T1B222842EBD19A93B6DCAD229FA217793D3F5102235A42E44E7FC8A2C15D79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 38bdb543fa8ab1de75b7aae884244f236498161cab4b5ed5178ee3bb14dabb07
MD5 9cabb56251280bf0795bafb71ce9632a
SHA1 786ef5a4558a48c61651c866e6e8016bca382328
SHA512 dee014769a7194a4eebdfb6a64cca63d9437ab787ad3ae0ca99606630960131c1f8c0f92c5e123224a12482c791c5f06e32d296e3e2a3ceed4ec46f82f4b6023
SSDEEP 192:/RvlGPtybv7jAPRp2e9ZHsb+WNnDp0aqcVyIsnAUge:/RvlGlyjqXdbw9034e
TLSH
T10122952EBD19A93B6DCAD21AFA21B793D3F5102231942E84EBFC9A2C15D75CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9cadfe649db211251961abd5aa98a6e627e971039fc67e690052e383f7885981
MD5 13f4de481965b71b545277fb18fcaff3
SHA1 4f7743199235a69e2e1a78458995bafc90ce9f1e
SHA512 5818e0b0c2d52aaf9e64a335b94a1c3ed1cbdc11c67a3d0e54cfbeea668983fd0842e771d4efdef8e4e602a9fffe01a096cf227397e4f5684e17a109181ed1bc
SSDEEP 192:ecv4K6WE7KxkXqK4I40pUZNCgVLHrKHfFKslEYUWXzKD/ls+ErUkKN9iBWepdsrq:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWZ
TLSH
T1DA32C727A88E9A3B4FD8D50CDC166F8BADA542937678092493FF9D0403A57CE114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4549754b0187f18145184f27afc8af850672470eb1f1b7231e64d30cbe3755a0
MD5 2ed6423e300243020c57bb974fdcd26d
SHA1 7daff0853c2c4f162b4e29722ad64caea93c7aba
SHA512 c1b7e6bb2cca8690c11e959e3332a54f2d40bf39ab1fbe79a74be46874a5cce696b872ab82704b69b884f871af854f23cd18836890a74a19df54cb540eacd110
TLSH
T128A00210C2C42815DD74827465B18D8162D16D181A61430376E1245B885B1C49925540
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe628fe6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe628fe6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

a4f65d1b-b39a-401b-ba24-46db6fba33c4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a4f65d1b-b39a-401b-ba24-46db6fba33c4.tmp
Size 414B
SHA256 765257205178a3585a5e89c55baab738ca06ae7b60f4d530ad05b9130fabfcc0
MD5 a0eebc706535211c118d6221dfbc6dee
SHA1 64a2828af61efcfcdaeb07678ecca52a02caf293
SHA512 d8b751c4d4331eee267e8be42cbc73e6d73c48a1ca7e4cdfb516eb3f6b4a9d65a3adeb2d2eb129696d70e0a86632810c8791f4cb48013f6029938fae99f79ed9
TLSH
T1F0E02BAACD21AC2B08FD075C64944786D74513573750844F3B3C550D8FB863A418581D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bfa2307f3feaa9a3f540bea84713dc458e8a0d06593d30825e9413a858fc2103
MD5 1cdc8f34f1de68d2fe84e0b277d58782
SHA1 0a29cbf5fc71f1010a74d596b22247d1eb3aa2b3
SHA512 926858d1e3fc6baae0d6856f65e3653fadcc7df2d24f3bf5dc702f3f2a83974f48329de9dc3200ba8641d22e8e5a83e8e43874193f93c32d66c54ad74488683b
SSDEEP 96:0C6Rd+x7oIU1fXfBVMLHRDotok5KdDwB6nGyvLlAPZbdOv4a:0C+G7/qffEDUDM0vcAPZbe
TLSH
T129A10A31A42D4D3759B2D08DFA526A53DFB4A0976920AF88EDDE1F0811FB5EC1343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 0dee39f418998a47990ba357223fb0800e796fa74b47a94d3b4ed851a406ed12
MD5 c1cd4f5523f92da616cccf565b2b85e3
SHA1 59a54c55b993b7ee6681048e7cf2f9b3bae342f0
SHA512 f12e1cd408435317674682f9dbb904ec6735e63d9f0d0bfe0502c2730f3c7137b62022b63221c4c8bf29338729369be43a07054e43eac22fecea97ea1c8ae35c
SSDEEP 3072:T6RQmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jS:T6RQmSo0khmRgB36T8Ljkc
TLSH
T1A8C312159D7AECA112BC57BC965A6CF75F10428308E204BC7AEFAF8612F7D68031349B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 263627ac9dbd84f06bebe8b3d0d4524f8d02d255789a7eb9cf1a0765748fdba0
MD5 787098a76d23f96218d959a5ac8f3855
SHA1 83621ec203ddf844630f043101f1aa8c2ef395b2
SHA512 07f617d3e523fcc809bb0e581640be6952150d5e671caf48a77bc05ef0c0caea1fe075123d16149fd6d14d022cf5dbcb4502c0686b743aa76bfbc13dc9304ec3
SSDEEP 3072:k8QmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+jS:k8QmSo0khmRgB36T8Ljkc
TLSH
T10BC312669C7ADC9106BC1BAC815A3CF74F20839308E618BC75DE6F8652FBC680B17497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cbcef17ff55621dfdaafeb53ccced48b434759123385e9f9afb275ca94aeca64
MD5 74fc4c57297ee10ec420f590dc0b13b2
SHA1 e510f6736d3428c98127d5dbb9bcdc838cf93ed7
SHA512 2b907442d66c00adba313176d3ebced7cefa1bd2d604c2303b34ac0d4daf2349013116d56a025a9278880d7821c4b172bf56bf40c4e44a0e2433a517fe2d1fe8
SSDEEP 96:mC61Pd+x7oIU1fXfBVMLSSl8h4otop5K8DwB6nGyvLXwqxwz/6I3RPf0j9Iy9LIC:mCqG7/qffRiU2P0vu5x23RPfUxX
TLSH
T18AC10A71B86D6C3756F3E45DF5022A97CFB461975A50AF54EAEF1F0802EB0AC1383522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 209KB
SHA256 ff0bcfcc37f3a18bbd41f25c9dcddc14f33c83ea55dc9853b47e7acce1adb737
MD5 e4a5bbf84225a4cdaefe7e6c4a5f40f7
SHA1 1eaaf47731b5a4ae21f86454c7078235487dc57a
SHA512 39a162dd3a9d5d7f9ca7ed91821757ef1450cf21fed9ec9a1026e5585caf1a10c2e35f51cd3bb67b048f233969ce721f9315808797cf5539f4bf893c7609015f
SSDEEP 6144:p7AJ+iysAUWz8RE3zQmSo0khmRgB36T8Ljkc:pK+lsAUWzNdIC5
TLSH
T11E241255ADAA9CA9067C07EC450ABCB64D71CBD308C6206C37DABEC752FBDA44B0706D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e21467435a3db6bf3506f9ae3f299a02f9f10e1eb4ecf91621c0cd5eb78a3da
MD5 6cc5b437a7cb88ca333a5356e5d0aaee
SHA1 31061baf13836ae5057d0b50bec40c2713247721
SHA512 e1ca196d8abdb2bff5d26b40430556d899cd66979408b2e643075a257fb04b61ff7e2a7debd1fa185c823c1ca2e2e61139eb1f32599727ffa551fc5af85a808c
TLSH
T173D0A725762968D5D225103254604702B6255553329686066255840E8DBA48A77D6F92
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6c50f11e3ccc44ffd35bba666cb7bb4f6b9930427310546695d3c6979d24c70f
MD5 8c5e00f40c65d253eeb5d5d85bca90a2
SHA1 dbf7c9f371eb010e8a4a08a6fe6fa81fce09aaff
SHA512 d27299e2ec1ee6902ca769df46f3626ab1c3c23fb28c286ac45ec49222f892aaf2ed3ff556d517b5ef5792e1614794d7d2eaa1c75c124ca27316c06faecb566d
TLSH
T187D02325762D7CC5D335103254704702F7254553339686066355C41E8DFF4C67BD7F92
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0dc26ad44dc5175e061a2d08aef5a91589a8ff9308a2ee8ef343ae37378c795a
MD5 8c6f4ecbbafb6080d9318e41a59a3fa6
SHA1 77cf1a954ac28102cf4a796250fd3f19af842609
SHA512 da28d7e2e461d8a24e79fa7597d29f9bd997bd1c4803b09831282d99c2793f47709105f2c43ea8adf75be392fa5309c3cdde87f45e9a9e724d69acb11cd60946
TLSH
T1E2D02325762D7DC5D335103254704702F6254553379686066355C40E8DBE4C677D7F96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38ecddff0c11c11b11bc582b272e3f556d2cae512d67fc634fd005ff39c8cf4f
MD5 4c04e3305eedc0082d1ed5b5e232087a
SHA1 b2d8cea5128663377d84c85daf49f710c1c46868
SHA512 48dd8ff5f337668f7870a1b1262b322a225cc4aeec05e015c8aa1ccff582ed3166706b2cdc84b04c2e5df3c5856e8c69fe39a1e1e188aa2f3179e2deb9d7cbcb
TLSH
T19FD08029735D6C45D716243254614713F72184113556C5165352D00E4DBF48977DBE56
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7943a1ff2e3829d2d774f32adbdc0488267674b0649439f173213c848ac5a27
MD5 3a5d81977fbd6da9de6bbd83b040895c
SHA1 844df9058ab770f432488307e7e458c08ca6cf86
SHA512 ef07f7086edcc250c7f23008bcfaa3dc6fdab2f50c286f3d7d44db9ccb5410b99bec2d429172c1bf3c7149fddb3a9cf2f0dfa030fae94e9daf9836e586a48086
TLSH
T1EED08025735D6C45D726243254614713F71184113156C5165352C00E4DBF48977DBE42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb7eca4e591a780f2f3f544719ab5c686e078e575940973ccbaa914de11d665
MD5 884b6be407385e102d66849553bd73fb
SHA1 c67d5210731badd8ba899a5ab8a11111a64bed2f
SHA512 5f79421a543c0ac906b1674ddaae2b976c2fa0342e8263d3104a8f011f94f4706b0500c3883a4b5deeb378233a8ae8f9bb7abfb6e2e0250b207e3ee08086f9c9
TLSH
T1D5D08025735D6C45D716243354614713F7219411315ACA166356C00E4DBF48D77DBF42
MD5 SHA1 SHA512 TLSH

Submit Download

28a70859-a533-442c-a456-07b811d22dff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28a70859-a533-442c-a456-07b811d22dff.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9edfcb4b-47e1-403f-aa6e-c2e46fd67586.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9edfcb4b-47e1-403f-aa6e-c2e46fd67586.tmp
Size 414B
SHA256 cf3f15a17b6704c18a14434eeaeec96260276033dd31fee4d3400a38c1a38a19
MD5 42b8f6db5542e098373726a3bc6778d4
SHA1 eb1c23418d2ef1fec75c22102ae85eda34a89252
SHA512 8d852f2f81fe97c22b88699c7633eef260884bcff3ebee2c0ae103f562a95eba0c5e9cfe71680b964247b53782b44756d2198c866bb3bf8c95cf9658695a376e
TLSH
T16EE02BAAD821AC2B5CFD076C78604B8AEB5013273740C54B3B3D41188F7063B418697C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6ed6e222d43a03687416c898b321df5a1d53b8bb566b2d30bbc703b32e9ad921
MD5 ade1126aa7283513775abe12f090e06b
SHA1 90126126770ef7beb6e041356dcb8b5d71930b19
SHA512 45757ff6b330c5669d29dda67ba36612479da5d241712267a2a8a57aaefbfb196cc5addf56652b897468829bf66e562485385f5fee192abf53879d3f01bdfb67
TLSH
T1C9E026A40BCEC2AEF27064474178874CCB91368FD6C96A4A2B4194BD7642440EBC2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 a15b18794fc679d811f1d15c2b8b8f71f4f5b98797c304b0c7bf14d5f1e6c9af
MD5 942ec0c4141256d7990f7f9e6fabad6b
SHA1 c56f9a6d9087edaed1e1da0aae7dc979b9e9c80a
SHA512 d8f5aaa27fffa789a34a89924a9f251ad6dde6a24283dbf03713ac3a6f3fbc4ab6143938be27d6db59edace4c7182d05c44b1f2bc2363fea5450d585cf8a61d5
TLSH
T125E020B71380C5E4E14B964B807C435C485371C5F68D879537C7F45C5C80000C7410BC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 82KB
SHA256 f2583aafb9fc2980cb1258e8c3793d0742d300a8e39fadcbfd3d8e08d8ac1d24
MD5 3652a76dc3fb1636f920df562f70c04e
SHA1 bb574e66f2e1a5cd1aeabdb9da78a02b921ef95c
SHA512 d14debad1f36bc997f6e2ecf02d0748a637242097a37b0e6a880fe2683d46415354f2c2eb977266c60351cc3dbf1cee01309b612c1b2f800f476d52cde191ac9
SSDEEP 1536:W248HsAatptwxKNCW/B7v4gvEwzs10ZfvTYASj4KlVk1NNZg/g:WzIzwtwxKzp7vywzTrYHj4KlVkHbkg
TLSH
T1348312F4F7D4E6D9DAC2776EE3C4C184B0F219327DDC1B6A4D3289A49546E203E14E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 ea6cce6718262841e644806001853f0ca6e4da4380422ad30200ab8f39773462
MD5 d15adfbc14454911c109b9e83bf0510c
SHA1 a3814c785b5e97c532302a89cfcf51be7d3652e7
SHA512 b1bcf72ea193f80f4a426d6d44b7dd88b292a82bf9f0e1e1996c595066884cb675e9e4189c3d9cca778a2cf1ac34c24dae2b90dc6218b0ae6adb8aa7faf05687
SSDEEP 192:La5QejjPVlrNY3cPtSDSfsyZER48fgt/ti/J/I:BejjzrNY3e2StZERFfgD
TLSH
T143F1D7113B89A7D5CB79647C09E0DEBC34F074998943EEB230148E3B1463F7589D265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6b015b7768d9660a1aae4d00b9aca496de7cfbe63176f2f4875f1eebe1caea82
MD5 36dab65f2e2e0c6a2c45e802f9517fe6
SHA1 ac8b904858f7592a1afbdea485bbda260545e0b0
SHA512 ff795489f342baf79494704f54b85265851353a8c4da3615ee1ff7c72a305dbc6eac769214972de15c0abfe89391e6023ca7b1679c67ac1cfef84d0e9edd4b2c
TLSH
T15671625433A28BE1D722B1B91CE1DCED36F074C58347FAE524521F715825F78AAE2523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 5cfc34d966db4d376c242fd69d01a9b8613b89afce8c6d06b38aee8ac1f8104c
MD5 6b3059728cbe59bf15ab8f5ead9fa340
SHA1 9986f99c7b6e775cfcd84a3b7e9f3b27d3f46525
SHA512 3d57c9c422df9c338ee1d3a5c2d27b9d6700db1edca7e0ef59faffca99f76fc5f31840cf643a776e81825ddc62505a8a058b6c06eed1c676f42b0f802444c8c1
SSDEEP 192:ZC0ScKiDaD22Eet3Tly4oD9fnG+KzKCQ2kbt1:U0ScKYaSNetT9WlGnSt1
TLSH
T138F1D8113B99A7D5DB3A657C0AE0DEBC38F074848A47EEB230144E3B1423F7589D265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2629c46128f74456e38cfcebd6a0c1a4412b46f868c0bb986457270a36d710ed
MD5 bc775c5fbc136f4f0c036f06cc261a84
SHA1 95c30448ab8de0156c753545bcaa1f56b187fcd6
SHA512 29ca9bc5c5d479ef0fea8b0de68c60ae743ea37bf4c7b7e313d95001910179e03a88c20a65ea90c0b9af4b2fff6b50eff355b8c35a557154d9deac89bdaa9614
SSDEEP 192:CfHKpDzD2HBXtZ+Eeo4u0w9z/KCxX2bt0:kHKdzShXT2ZutJct0
TLSH
T1E9E161113B99A7D8CB3A747C08E0CEB839F074918A47EEB631154E771427F7889E2223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0acf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0acf.TMP
Size 3KB
SHA256 6c4e6f228109a63e37573d6bb19167c4a565bd4791bcc4991c1e63d34f592513
MD5 36f1525906c1883bec516f7b13ead977
SHA1 2dd3aa0a80d6bdbe1c2ac939ea8a955e775a68e4
SHA512 2be0cca2191e46e66f3d6a21a389b4208f3ac4cb0969159148f7fffee21678de9d1bc12c3f427a359a96be47536e47241c3cfcf00a0c88e839be1cab74591e2d
TLSH
T113614E5433A28BD1E722B17118E5CCFD35F0A4858347FAE544422F705925F78A9E3123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 256KB
SHA256 f37093b799721bc7fb2de5ea769234669dcafb777348b4704c5f66c65aa87787
MD5 04345ba29697bf6795610ee35f2444a9
SHA1 1c31ca88cd8f801fac99c395c270eebeba027fa2
SHA512 c63eedf587d3759112cb45058a244cfd9ba426ba9ef9b5c1f3244ed20b203d8404d813e40796ef33fc20ebdaab1079b019ab345ad5ac18f5aa583e3bddf99ae2
SSDEEP 1536:iwjiHz8p6szz7eWKs5WIeGgjJzach411Z1p:x
TLSH
T13A44F8F71A527E3ADFF8C1B47425D0785C6AD05FC60B53D1E2C201BAC6EAE6A6C884C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fc6c664a6fba5a3ac7aa1d6deba495dde971d7536b863886b5303b3ece8522b1
MD5 4b7968f9dadf6cfeadff0e5774c882a8
SHA1 8952bceff5c77f64562c99d4aeeedb4818065d47
SHA512 fc5d77a550c8de42fc2985b69c40c27f524ed677624453f9d1835c25c77b5b184e728552c9eceefd9fcdad5a4d5d3ddf159a9e413db3150968f414c09ce282b8
SSDEEP 96:D3NYOt64qD9CaDei/N5zBwwGj6cfjDUI/0LnwE:DdDt64qD9CaDei/N51hGj6wjDUI/6nwE
TLSH
T114C1BDF7C3D9812DC91116F49B196F1FCE2D1A18432C3D2AC8E8BE5BA3E2471E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 77d7dc92127307dcf040a08ebefb79fe7669970f4f3e729f5099587e06dcf27c
MD5 a3bca3aa9c05c6663ad8bcf28908cf0e
SHA1 635ecf72ef1e550102c2232aa728feea76fedcdf
SHA512 ea75099fcaca8b3f6a8511fbb4ab90db5700d98587675aad0c2f3ca670fdf9c142445855a924dc0747fa3cec15294668b47eb6f3c010c40e2ea4c8c8095db9a2
SSDEEP 384:DGWWijtxVNk8LSJJke5J3xmc+uTS3a17cZqxmAvJMwHYaDeiZ4wDTvDrpI0C0mri:cly4G1qiQSk8JjD141ueXK4
TLSH
T1DD72BBFB83A4C22DDA0156F49B15EF2FCE291528031C397A89D8BE17D3E2432E15675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 f049d18fa9a9dc5a1320c6947a24609ea51f7c897744ad97212e859cde25eec1
MD5 c4dfd9d66b2d02f26758b62b0a645c43
SHA1 b168852d35f1f2cba306dd24eb4ae1a8e2527ef4
SHA512 ba09107ebcd4d4a6a9d415f3f16a703c843250e2c0b6368e91dcf4ca588ebac942f7824623710fc53a56f6f15a23f8628391abfc8f003297ca20178a643f2bd6
SSDEEP 384:DdDt64qD9HxwLMNXJKeAJkXmfaDei/N51kGQDkJUtI6LAaDiMf+DrG1pIoNChLRJ:2Wd2ZCFwBQSM2CaiQJS8r
TLSH
T13E428CF7C3D8852DC91115F89B19AF1FCE191A28431C3C2789E8BE5BD3E2871E11666E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 e03e6089e2490e286695d0cbc71b5276fd0f8fe7a1d58371d979e200dd9b1533
MD5 820b17888ab0a586a554de66695c6d37
SHA1 4ddb5fe03b037b1590544b7eb9d8def361023f40
SHA512 dd8c1202b2dcb170beae155c96ba28c0a1173377ab53b2068ffd5b2b8d48f5c1fc6ea90c1a988164409495c1c87b11b257b5bd40858014a17225fa637476e30a
SSDEEP 384:DGW5WijtxVxwLMNXJKeAJkXm6O/RfI5U3ALIUsbOykMLaDeiZ4wWyvDrpI0s0mbR:/WdOGjaiQSk8JM4iKSjuXAsWe
TLSH
T163928AF7C3E9822DC90156F49B15AF2FCE191A18431C3D6A89E8BE4BD3E2431D21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 32KB
SHA256 fb2669ec19f44b0b509fc2257fa949be5723eac3228ca01794ad624ca1fe02de
MD5 aace727ebd02b979a578deb41ec6c02c
SHA1 722951cf5f661383e57b945b03038ce1d4a2ce95
SHA512 7265725c91828d2341ef75b8319e9f55b31b32dc82d494fd5bb8a3742dd025e6bee17ec8f0c7cf18e5612611bb52e746a582fbc4d8f4dfd91fb8fc1ac6561876
SSDEEP 384:sxRHTqFS/fzsJ666s8qMpRiYnazAW8pZS15posJWeT+Jm3a2v/5DFbCXTmLN:sLuFS/fA64Mnc7WeT+Jy/5DEmh
TLSH
T11AE21906A924C8779BC35E19B47D7E73DAEC50525284DEDA1AECCE0C019E5FDAB03827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8ba92c0fac100eac494ad4ec98b22760dd0a9f211f2033a34855b503568496fb
MD5 e5d1eacd03fda68338d89cc471425e33
SHA1 771bca26d3d08487006df3f5822d85b16e45fc18
SHA512 86ed87ac8c5e6ba702d7f4bc279baf85a1bfa9324e5603cef7118a86bd138c7b7c798e834f845d81b0ef3d04b35dd37e54bc9c0e995e4271d6bde99093b66461
SSDEEP 192:sxR2REyM/jK1Ml8wbS/fzsmrTYCbPzoA8pjhy/g6+WN9IE/YEP3JGLhIgIJ:sxR2ClS/fzsITPmw/5h/bss
TLSH
T1B562DA0665349D7B9CDBD20DFA51BF53D6F81573A2905E44AAFC8A0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 069457c2a749a824203175784509b6835aedbb37a5aa561172da32e46db4b906
MD5 e210e42dd23b2fedc00526c85f641815
SHA1 ab3b39c736861c822d5ef914f25a4d1190c385ff
SHA512 8727fc82dcde2bb06f46272e901d9aa2aea3fea1cc170bcc2548a235cea8460da475153cfb3c1f9dcc91bbc2b5a633eebb06d43bffc1802ef7c162cb1a2e7bad
SSDEEP 192:sxRFREyM/jK1Ml8wbS/fzsBrTYCbPzoA8pjhl/g6+WN9ApXYEP3JGLhIgDnJ:sxRFClS/fzs5TPmP/5aXbsd
TLSH
T1F862EA0666349D7B9CDBD20DFA51BF93D6F85473A2505E44AAFC8A0C00E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 671b2f668b5ae96af2c443a2fab30ecd2ff9d3943c8d151c0a803fab1ddf2d1b
MD5 f4f189de12eb83859e96e88b590735c7
SHA1 f171d51ce67156172aa69354a7a8ae734ae048ac
SHA512 7cfcdf5759c15e72758801d6e6f83e20336025c52709f970a0e8e977bb0202cd48d9c094ff7e316554fb2505d09a0cef736aa8737571859c16f3e007deb11d9b
SSDEEP 192:sxRHREyM/jK1Ml8UQKbS/fzsBrTYCbmzoA8pwzyMH/g6+WNdZLDTYE03JGLhIgDJ:sxRHCq8S/fzs5TPbw/5/T0sd
TLSH
T15362D81666349D7B9CDBD31DFA51BBA3D6F45463A2901E44AEFC8B0C04E67ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 39KB
SHA256 1c4fc6ce4085a4b4e1f2b8db1eb05b16f1c0787c02d35e80945c8d35d1cb129b
MD5 c3ae1f1a744b9e1a267662416d2bbd20
SHA1 2689ef556f2d4bba6c1910b80a67722903fa15ad
SHA512 e2a2b5feb00243fff7d0d51203e8c3824e6d9d1fa1b6ab93c884cd2551dafa04d998d6efccceeaf51b9118ee4d7c5dca8ad163b66554be2c0c35a3bbf31d58f9
SSDEEP 768:sSu/D/f3jfW9RC8wAefou+64Mnc7WeT+Jg/5DEmGq:1u/pou+rMmW7mDEM
TLSH
T1FD0308069824D9778AC35E1DB57D7E73DAAC505293C0DE991AECCA0C00AE5FCAB07877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 b340cb7a132d598958db0ed3a99a2e8d8fcc2b5ed2742350c0b8891a0f38cb03
MD5 54c030e7ffdaca3b6f683e826b7f6e68
SHA1 c063e1f74ff537bf3b3ee567a6651c8498075d6d
SHA512 e608160d79379b94914af34bd027e54377f4cace27d1ed105901a2a576635303ec857f52f2b3a18b26322c51e23042a205fc2263208926993647d11593781cea
SSDEEP 384:sxRHqqFS/fzs7e66s8qMpRiYnazAW8pZS15posJWeT+Hm38B/5DFbCXTL7N:sLVFS/fqe4Mnc7WeT+H1/5DELR
TLSH
T1F9E209069924C8779FC35E19B47D7E73DAEC10526284DEDA5AECCA0C019D6FCAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 41KB
SHA256 1612b1d2f6621fdfacac7056355c31a61a17c2897eb198925f66fc0240b82199
MD5 a4cbb035690b5e7cc8c4853326c74390
SHA1 3207900dd8773d29a0be94659129f430faf4bcc7
SHA512 a285a6ca5ebd3459822ece0ddfcb3b14c09272f72f26d7599e0039d69bfab261cdc8b393c60328b18feaf3e4472ffe32f58d6a10f3bcfb5b7cdbcd75baf0fad1
SSDEEP 768:sSbLs/f3jfW9RC8wAefoFzYKh4Mnc7WeT+PkF/5vszrKiq:1bLYoFzYKSMmWlAvsE
TLSH
T157131906A420D977DAC35E2DB57D7E73DAAC405253C0EE995AECCA0C009E5FCAB07863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3d20aa30231886a49df952d1caaf352d3427f1934a65e43a8ca1006195f3484d
MD5 99cc45bac9b48ec5abccdd90951478a5
SHA1 114ab012b3e439aa8e73ca8701631fe8d3e45da0
SHA512 9584f98193d27a0440da6bee1ce41aae145f71b36c07cba309fde0206a16909c28421bd9645518d8f14c898447009675d64349de67953e11bd05db8c0bff331e
SSDEEP 192:sxRHREyM/jK1Ml8UQKOS/fzsBrTYCbmzoA8pwzyMH/g6+WNd2Ae+LDTYEV3JGLh2:sxRHCqFS/fzs5TPbw/5O6TFs2
TLSH
T1F172E90669345D7B9DDBD21DFA91BB93D6F81463A2905E44AFFC8B0C00E67ED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 e933268abab033a54cccdad0fa63f7fbe5c8f9c7ba2cb0f6934f7074a0206df6
MD5 7381fc6aa990aa2302f129bda56e12ef
SHA1 fcf6e6ac6b35d3cba2beec4eff93bb586502b298
SHA512 9a300fe8be6fd53e214ab45c357f51da3f07f2a8bc19a9502357990c0b9264f682fcd5bb255161ec909f0013c40c9ea3fdb140ffc59b9f1aeb6a49f21fd30236
SSDEEP 384:sxRHtqFS/fzs5G66s8qMpRiYnazAW8pZS15posJWeT+HPBB/5DFbCXTGs2:sLcFS/fIG4Mnc7WeT+HPX/5DEGp
TLSH
T1DEE208069924C87B9FC35E19B47D7E73DAEC50526284DEDA5AECCA0C009D5FCAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 cb7ec1fcdd852b221de55414a6a66a675de380753a93f8426463c05d6560c3fb
MD5 1d9df9458cf3f237f4beb5c255d52cce
SHA1 59e13d24bd278093726b0a54fcdc552398a5a59a
SHA512 9ea71e136f85f5358313fdc7aa09bf53f95df6a3bffecc97b8b5d051227d6cb2939b5abd84ca86bf6e904d75e22ce270bae69fd9f5b05dff4451268b73c5c2eb
SSDEEP 384:sxRHtqFS/fzs5G66s8qMpRiYnazAW8pZS15posJWeT+HP+8E/5DibXTJs2:sLcFS/fIG4Mnc7WeT+HPS/5DuJp
TLSH
T11AE208069924C87B9FC35E1DB47D7E73DAAC50526284DEDA5AECCA0C009D5FCAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1c52ce45ed02929b1ff1925e3d12ebd361c9acb135a02008da70d09b2261b7c4
MD5 12700ac53616e57e856bb7c6b1516c0e
SHA1 faf5ba3bc417367cbf1ff0f07a9125ee05ae3c3d
SHA512 8dceb5a6b6bf825e7fd7a606c35a3b28a0cd09187e8b175237aab6560794e4680640a020fcd018e0c4fb8f114518ce0acaf687cc447667b2fd9b87783fde5c52
SSDEEP 768:40D/6DfQD8137pLuL7P0DbWgQ6DjfDQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMr:40D/6DfQD81xE7P0DbWgQ6DjfDQDFu1+
TLSH
T108E2EB3B680CCB7F4F80499DAC29BEDE6DE801CB96D8899447EA880C03C67EF55165D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 484c27b53a6fbe37fa764e36d338525024c2f86d91c48f730551990804e3ffc9
MD5 a7c14f9507a443e411316e4786167612
SHA1 9dc532aef46d21311eb8fff7ce83951b477bbecf
SHA512 7819009edfb2aba93be2b1d82783f8d832b7a034dc8a886af07e0bf9111aaa39a67bc29c3f8e88feb1ac789b262c469ca6df606793125be3fbb4899a5c1ab941
SSDEEP 768:40D76DrQD8f0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw0DjGQDL6/:40D76DrQD8f0DbWgQ6DjfPQDFu1jaj08
TLSH
T1A7C21B2B540CCB7F4F844AADAC29AEC66DD801CB97984D9447EA8D0C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 34KB
SHA256 d37bc3a7f07cd12601807b5d4ac32bc20997b7fe32c9c23c67c10542172579de
MD5 e0b8cd406b859556df72076b71a791bd
SHA1 3ab7ddb3afbb58a12cdb1ceb8b2c606f6e9ad8c0
SHA512 2af9314dc11648e8b32ed047ee81e107725d95938695bcbf8bb82547a4a713bba3d74b1775ad9c7d890abffa8c3fe7e0660add2a9d5006d546afbc009a056967
SSDEEP 768:40DOYy6DfQD8137pLuL7P0DbWgQ6DjfDQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OC:40DOYy6DfQD81xE7P0DbWgQ6DjfDQDFr
TLSH
T1B3F2EA3B680CCB7F4F80499DAC29AEDE6DE4028B9698CD5447EA880C03C67EB55165D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 600B
SHA256 0e34d7c8ef6360109dfe5287b18cbfb7c0150531b47df888c066dc93cd843331
MD5 1ccc3a770b8b3fc2620e7a8a0af87781
SHA1 6780646932fcfa10a8a149055c8440399d5ccc6e
SHA512 9f4c8037a9e0d30105a55bcb708c689bd4b3f9a71836d119765c476600eed39fd3ca70f46854368a0f9416b3aa04f0e5eb84e5ba095d09aa84661cec9d44c6cd
TLSH
T1C7F05C97DCA9A44BDD23B8BB563A3156333901ED12029D87106D742D9626A388751746
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5df09c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5df09c.TMP
Size 600B
SHA256 696956c1e777010359fadc91e4e26be399c13a59481ea9b0f1bd364d1bf0dd7d
MD5 b6e5880e7129577617e8412d52dd00a5
SHA1 0bcfeaebfb298d4db844a846a21b6e0f5e2c5007
SHA512 b681115d5210a22cd7a2ded49ebc7f1aea0f3141c6344d4457a5d24914a8ba0ecfbfc019158b2322cab698cf2cefbb067a4eb890bf551b2858c305be0d5466e1
TLSH
T126F0ABE740A1EC42EC6AA5F521167017723E08242116EA4A619B78BA5A226788381A42
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 df422acbe3c6cea4197eea54e4bb81528eaf91c40fd55e8a7975f1ffa42c1a2b
MD5 9e0bd4ec17a2312a7fb16827725fcf7e
SHA1 cd74427dd52d65b1d0812a0edbb48f69cc5d49fd
SHA512 79f6951a818eda8d5b459116c561434b1ad8dd77e0aa54c0f7858e54fd07c6353d3feed0744bf48dbbf41457e5b21af3257f2365c731622d19a264d2c89e902b
TLSH
T1BFE0C0FB2CE71828EC7F83C32571C57101017828D108EC4E111692D300B1366A88AC31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4a38c602b906fa1186787e56f0dee68778f6db377782a5a7c7ec9d136a82afa4
MD5 db1e82a57fc207421b694b9d4f5cb11e
SHA1 49f230e2f1b3bddb8d2ef5a06af424ada956e1e9
SHA512 7533e03542dfaf1fff40fd24d007e0154e59475b581ee65aef52ede82ea5b42d4c06149fd57ec532563a86756fc76fe93125936b97e8ea86045a77c25c93fd9b
TLSH
T100B00193082909C6C81442FA91812688A26BAA241B76665A54B801B88C64B61455A6C6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e3e6e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e3e6e.TMP
Size 48B
SHA256 8fcec4464a7c74eec53be92802cda194d37ede6c4f5b5cc8ee9bb80be4656839
MD5 eec8175ea683a4ebc425f8c9c53c40eb
SHA1 3e1ecf0fe9f3d39efebe96460d8713440cc5536c
SHA512 30db6b12e35df5296efd065d8bea367b6e00e32f9421a05064c2b5a3ded4b76eb46369364d2a27d324298d9b1d8f1a9a2ec781034a3980e508c0863fa08bcf8c
MD5 SHA1 SHA512

Submit Download

7d1affbe87696ebf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\7d1affbe87696ebf_0
Size 194KB
SHA256 29ac6df0464f8871db10d7b9a7219874d2d34197258e74aedf4685362fcd7685
MD5 88b374c731fe0d8b331c3638ff50785e
SHA1 52bd0970016263a3f701480e05d119f23c0490b3
SHA512 59be0d1ad003dcc05a5e3d9de902b069a2396c36ce8503f125d09eaef8d457306d3f26185c2c5f3868120bcb6463e7f10ec2721993b3c1cb168f2704ddd0662e
SSDEEP 3072:SegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:SegF1cc9zByRIZa8HlI93h
TLSH
T14B146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9899e32f3e6318d64bd60fe7567b0a81482cdec40d582eeef3a43da46b5b709a
MD5 b0a71e2e2a4a8efc56b6748cb4fba831
SHA1 d5ebb46a49a9cd553b9274e2ffd1d03c4a51baa8
SHA512 3d943c8ec31cffd2a6bafe376b48fa649ad9e0b39c13886b5160487681150bcc5e50289e75ae35caaed4f623f8a3c7662b52ed8bd176dc87c282fb82c3db2096
TLSH
T10FA0022026C00C72CD4112773D892180F22D78A1754DDB93749A105DDDA756D635D102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 34dafa71c1e1b6cc51b0a83d87c8192a87eb4528d6d12172191f87a324ff02f4
MD5 4561c92ca445780fe41688404b1101ae
SHA1 414a1964a0bec013a7b5a750441269d152520e02
SHA512 af941949973796088863e836d043c82a6e8cefdd3a78ccc64c7028dfad5d37d632a5058341056115a1ade1dcf94c9b15eb5e45cb2c0e24248643c4a5e6c763ee
TLSH
T1F6B022A800C00C82CCCA033228C008A0F2383CE03B8E8323B2E0202A8C23B0E080B88A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 9d2ff2a1dd0fdf7ff01c734c147836445b4978808f38b1ca876951a2b628d27b
MD5 4a0369f07d90a9091301b417347eb9bd
SHA1 f577fd52aa72d7b2f23723e99dde311cec68e4d6
SHA512 8abf81833a46de2e6d2df43f2809bfe9f3bce58be088a8a6444409c18d2ce8386f02cc0a639def8c7cdba1d9e4667fea7894defec6e843251c17ca9cda5bd409
TLSH
T1F7E026B066DECA39A05064C34274AB1C8AF1F94B93D93F03A74C44ACF501100F7EA980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 97a3af892d22b3517e123a6822268f7046c833bf66dae73871480b762c5763de
MD5 fbb9dbfea91d6e0f356e2fe1445a560f
SHA1 22b7029b076fab5198d463f2e64f5cf6f9b8f41f
SHA512 c5a37a8fe94bb723d95a0709148a6979ac5fb0cf2c0e4c715c55f99e91be030884b61cd13984bf80c97de0977d0d5c34e4146e1876479009a7f6935a223321f9
SSDEEP 96:KR5WnjRzHDW3EygrDK4aglDcJh8fnA21CK2MiWXaKkYnU:C5WnjRzHS3EzrZaglwJh8fnAh99H
TLSH
T12E911254363A5640383EA95981B5A97A96C3F4637058BC3B3BF940A64F67E02CDFC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 708063872e87f3dcd78ecd4757db38943d9e763a7dfd67a7bc8ef65c36e435eb
MD5 d018a6bc2fe25dee591599ab9a568d0b
SHA1 c9ac76834e170509d1d8e86c1bf8ade3677354d3
SHA512 6d0cc2e1e3c134a61ec3f31d7824628358f1cc2780964fb0c2c24e080587dcf8bc2e28b17de0c81e75832b8cf8edb412a6b4b631bb56b9bed57d152e261e788b
TLSH
T179C04CE32614DA8B4634DADC2058722DDD6B865C4CD8CEF89404815222B99374417579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b824c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b824c.TMP
Size 157B
SHA256 ed04702f33fbb41827c7d6d575943289889790d91859b7a285dc99d0352463d8
MD5 339e786651b3f2686565bc3ff26eb322
SHA1 638ebd410d4752cf8bbf59db25fd76f1c0e583dc
SHA512 3114c21ccee84df316aa8d07f8d95da3f3b598dc0b7e9695af20d2ae519596c0cb1a556dc734a3a203609833bde0e6a1e2e63c49916ad1b287ceab4288e77b6f
TLSH
T100C04CE326148A87573099DC2028725DDD6B8D594CC8CEF8D805B15232B993744175B9
MD5 SHA1 SHA512 TLSH

Submit Download

6a0deed9-0dfd-42f1-841e-0fa4af022e5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6a0deed9-0dfd-42f1-841e-0fa4af022e5b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 232227567527c1936e7813a7887653f282b945b700eceb488f7208a8ea92eb75
MD5 0c75987488d2651b0634e036bc23c937
SHA1 ed220dec8e66a48dc7b0066a43da7927a6baf48c
SHA512 7d2848a379c919979afb519cb063970490ac2a5eff791ffe7317a8a7c33df5fec837a3ac2be39fccb5f5ee265831d288ec982341ef0329e512f44acc110beabf
SSDEEP 768:FFKj+9G3jwg0bdOBOkDTd+ZoKIXeqQLWpeX6+qTko0u229a4vsJ0mb/:99G3O6KNvVTVKa4/mr
TLSH
T10C135BF2A8D38877C8AE8747733E2E825EBDD0A3B5845950B7D9690CCC4617FD706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c82a583e6ecfea2c04e79c6af9a2df3519b8ffc67b71c05626295ebc7bf6c125
MD5 83d187f1380ef9b3667318ec83d379e0
SHA1 603713b1558f01468818ab2960861fd2d57a051e
SHA512 69e205fbeaca10c1bb798c7a536abf057db1b35bb2e1b471a3b508ac91b11fb2412099606b2cc700adcad69d98b929707b77c28134a9ca4fc4bafd9f61a7dbfe
SSDEEP 768:jrv+4UNbdm34bdhskDTd+ZoKIXteX6+qTko0u229a4vsTdC:jbsbU3L68vVTVKa4AC
TLSH
T1C803BE32F8699DB38DB68688B10B75837F7811A387C81B549AED7F4D014F5AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 2a3c72b4abf8588bcbed31094a5fc486affcead57f48bb4ef1804bd10bb88758
MD5 799e1e70c117b769300cdc19ff103872
SHA1 24b66a08cf754314ad60151c9c8bbdfd8350a0af
SHA512 88debb2e0031aeb6a7288fd66bde819d317591f781cfb18e5e94621f74266f2c60962a008fb0858153164d1f3bf3e4cd337873ad5eac93a25efcbd1cb0d5fa84
SSDEEP 768:xF1j+9A34wgkbdKskDTd+ZoKIXDeX6+qTko0u229a4vsTd2WVDbh:Q9A3Z6CvVTVKa4A/DV
TLSH
T176136BF2A8D78977C9AD8787A33E2D425EBDC163B6845950B7C8690CCD4B17FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 34f14b311f5d67cbc3c96f305375f2320ecab5a49b92004128852903f1a6aa9a
MD5 7956b67ac178d1d68fbbc66ed5b14162
SHA1 64669c32323b7d63d116bdbbf49a9214de003a5f
SHA512 4e98e2130663f0250d73d537c50337d419c9d61f6057a9e5f92245abf95265fd28ac4eda697b36d1af33f1373bdea4e07fa899c03f8776d2b7a47529b3ac57b1
SSDEEP 768:tFqj+923jwg0bdyKm5nZoKIXeqQLWmeX6+qTko0u229a4vsJ0mb/:t923J6KuvVTVKa4/mr
TLSH
T1B7134AF198D38977C8AE8787633E6D869DBCD0A3B5885994B7C85D0CCC861BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 818e29a716cc7aec1f83c072699c2dacff85ed55a5cccab10abd4f5b7ccd7171
MD5 9dc6ff9ddd9a20f26971f0d7c9ce9b7e
SHA1 535a2480f0fedcb67921090dd1c18b2d0cb91beb
SHA512 06d448e8bf89d5335a7c78e9c8bf1777e7dc234bbd04c92ce223ddb377bac41e5ec70d3b7bdcf0b1396abb3914bc6ca964ffbb76ce46564d2b4817a190707f75
SSDEEP 768:xF+j+9x3vwg0bd3skDTd+ZoKIXoeX6+qTko0u229a4vsTd2WVDbh:N9x3l6HvVTVKa4A/DV
TLSH
T1A5136CF2A8D78977C8AD8787A33E2D425EBDC163B6845950B7C8690CCD4B17FC306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 53e9ff225764faf079454b89ec25c9f5da19d2f877b94c10bba5bde2c0f1f0bf
MD5 3ee9c7a38b527accfc7713cfc2058673
SHA1 01c4cef43b264db14cb8bf6cc8eff74b0b9cb0be
SHA512 d97d625baf4ff283ffffc6bda161dad583c8e58955eef4f4bb95c90106254df06e92e9f16ccd3883b0266689eef8241ef69664aa9f6f6ecab5a1ff298e7d2878
SSDEEP 768:cj+9A3TbdNskDTd+ZoKIXneX6+qTko0u229a4vsTd2WVDbh:79A3a62vVTVKa4A/DV
TLSH
T1AFF2BE32F8659DB74CA6C6C8B21732876EB511B387C82E5499DDBF0C054B29C570B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8d03253e68acd7fe68e11d2e29e75b2d9137942dc4fc14fba7720cace9dd535e
MD5 7147fe20ad45d57313c4b732c90a4118
SHA1 5c9ca3718028ee866a283d11ed981ad7ace771d1
SHA512 db0ecee7595b852a74cd3d17172ef16e2826c2c2343b00fb984ac207a91f07835f9eeff28d83c1ae81859211cd0012fcc20d0529a94dcb5ca1b8d0e0018e2d7c
SSDEEP 768:tFKj+9c3jwg0bdaAkDTd+ZoKIXeqQLWpeX6+qTko0u229a4vsJ0mb/:19c3G6KNvVTVKa4/mr
TLSH
T1A4135BF298D38877C8AD8747733E2E825EBDD0A3B5845950B7C8690CCC4617FD706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2337adf69e44385c340f6ca3bc0cee18846c6a39b9546e9af6324166b76c2a56
MD5 b764cc7dc0988069c5a3c9eede457553
SHA1 e6b82e6a22242a831a9f49a3779294c093d3fda5
SHA512 aaf778a04f827dc96f664f8e518e3411fdd6881bf4954a93f12cbdfb7fd2fd755efed51b1c4ca704b8e5b8396bf8531fafc55a44ea2c3463be9e699246dbfd15
SSDEEP 768:xFvj+9N38wgtbdSBOkDTd+ZoKIXVeX6+qTko0u229a4vsTd2WVDbh:S9N3a60vVTVKa4A/DV
TLSH
T10E136BF2A8D78977C9AD8787A33E2D425EBDC163B6845950B7C8690CCD4B17FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 e292a2fc24def1f0324ebb2110b7cf6092f80d98a0ad72b041bfb4adac6d5244
MD5 c3bd866f886e39a48bd75a45973e83c4
SHA1 af5f9c5ed164484359fc59be79ae12656dacdc91
SHA512 22e6f20fd33d74e07bd43428a72b184aa5bcd2a564d29f1cf47c3d4cc8316bac869ffbc1f84993b09464485c310b2489df250a1ab59fe139ae5772654e7aaa35
SSDEEP 768:xFKj+993OwgtbdVskDTd+ZoKIXVeX6+qTko0u229a4vsTd2WVDbh:5993p60vVTVKa4A/DV
TLSH
T1A6136CF2A8D78977C9AD8787A33E2D425EBDC163B6845950B7C8690CCD4B17FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 2cee0f7d3fed58f8bf78b928939d973f9a76678b529674fbe9ffeb6aab7b3a3c
MD5 4be50cb11c58fa4fabc9b428af425344
SHA1 1c5b735411838fd1ac4245fe5dd3b4e0a2b6069f
SHA512 fcdfdc03995afa5b3e1356426e5e7ec1eb3e4a5097326fa94de555c882e2c05bd8d28db205af5ef0b94a69e72e584c006081de0c564302ac1ba10579b4a13141
SSDEEP 768:FFvj+983bwgibdABOkDTd+ZoKIXeqDeX6+qTko0u229a4vsYBnsi9hbOI:G983a6QvVTVKa4p/9hR
TLSH
T163137CF198D34877C9AE8B8BA33E2E825EBDC1A3B5841950BBC8590CCC4717FD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6b41184ca5388d9e3bd6b248e6807da3b086bbfc396672311ad4dab9aa4d8241
MD5 a954e9819de481ce4f15fb36f7c50b10
SHA1 eaa79ef6335828c884cc77b38b5a722ac859369a
SHA512 5222d113397d7792dff866674821b7e36195b90a171c1f426d5849bfac8394c41c0605e6e36e6c4739e4dca481d201f3644b3df06a5cc6b3cca08e4d9c9e73bb
SSDEEP 768:prv+4UNbdG3hhsqDTd+ZoKPeX6+qTko0u229a4vsDJeVH1SdW:pbsbU3cWvVTVKa48EH1h
TLSH
T11503CF32E8658A738DE6D788714B71472EB92173C7C80B90D8ED6F0D025B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 ac4919d4887c27e77506585ca65559676d09cfaf732c51032167c7d1216b386d
MD5 1262722fbc97f88aeca4633a61bb79ef
SHA1 cb0b3667a592a858bd19a10988d6c201eccf30cf
SHA512 d44c2841869fcb5f52485ef3a08282c5bdadb129d2edcc5854861dd028ff3c504aaaa18ca7a4d7f7cf059f270bf4e9a42b729b2ecd1d958beb3da9d513e013f0
SSDEEP 768:tFYj+9r3jwg1bd7Qm5nZoKIXeqQLWoeX6+qTko0u229a4vsJUlxP6kbAjvPmb/:b9r3F6K0vVTVKa4tBAzPmr
TLSH
T17333D3F998D3893EC4AEAB4B633D6D5659BCC173B1A45894F7881B0CCC6207FE306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 77e334d64c104ccd5915c3d920008699a489320693a536751be165d0d66c7ed5
MD5 504ea8bde14aac20ffad6693eae06dc0
SHA1 5d5d10527623230c366956a6df75252324d96947
SHA512 a58ef492c0bc061d9d27c85e1a9c3fd19da7cd774d8d3583026307418a5618b328885ee82051d22d4ec05a6d6ea1aef975b48a23269901690606b7e2294edc20
TLSH
T100E00443E31454EBC069033100D31F206EA790B60393469A4F3645BC2D617846E20990
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 879ae635df02d07341fcabff63fe44a15c02f91dbcde65e142f6b76fdaf09496
MD5 3937486d8224edb4745cd50a3de102c8
SHA1 e42830362b2bf79e5fd453c72f0ff18534c49cdd
SHA512 70b71bdc225c5341d82a9035f3af7766649594a06a06e864fade5b1f30317b99037b1a827fae78da528c055cb8454cc5720b8596b43fb828b758715512c6ceb8
TLSH
T1FBE00202E30004ABC059033100E31B203BB2C0B1038303074B1405783D507445E10480
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1d175881043764004fc572a2a77a4147893f2b4d59a828ed9d0a9c7913bc982d
MD5 53d1471519ca4025489e6d81d6f6f9d7
SHA1 f460f13be889acf12747752f9b6356ec249ee803
SHA512 84a3cb00b3e231e67be853918a6707483321ef9e92b90a0d38661400bcc44a4fd8d2fc6271148b5e663d60081c47978abefbee02d530b3d5a5b8cb3587fdf7f9
TLSH
T187E00943E31004ABC069033100E31F202AB380B5038343464F25456C7D607446E20480
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 519f6211acfe1dd3b3c63feff65e258be56bbcbdba8561d4d248eab8fbdbc971
MD5 c0ccac165fe89a8619c724167f26c9fb
SHA1 0c4224bc309e71699a896881b08233f5553e44ae
SHA512 a31e7b78281184bc41cd3e1a3a81eb44cba868909228a3becc350a21f71bd693da0ba248a8238790d3f88df861198297d5409d87a9b60fa28344545d54de1cff
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 17ce507cda673d1ae6b682f4ec30268051860ecb371c1e23811e3ed469a23377
MD5 510998a2e8fe3cccf0293e34dfca50b0
SHA1 62292f9c45d61c9e9551e3f5b3d8b7d58fe33987
SHA512 c2593397ce1b2f3ac2b99dd25631a0a0db60253b4c09f8cb4886d4ed82f9b529db690f91d7299f81d55fc6209120d0b708329f70aedec5f4dc81bcea20ff9d3d
TLSH
T10EE00943E31014EBC06D033110E31F202EA380B503E343964F35457C3D617846F20980
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f2347f96d157d4482c29a09fc2d4fe43477068e451ec8975c5363b15b5ff69ff
MD5 9e6d5aa0d68b43400a664290b1a21181
SHA1 dc328cec9584c0aaaeab2e7bd1cb5b050a86420b
SHA512 cdc21001764e694b4f8b095315075dad511be2062c4920a4c86e4c423d43377cff5d0147d82bc71ed4762ffc2e11dcaeb8a56ede343b0c64160fd47d10ae350b
TLSH
T187E00103E31004EAC069033100E31B202BB3C0B2038303064F2505682D607446E10480
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b681d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b681d.TMP
Size 392B
SHA256 d03509dc241541f109d61e3ef34eaba0cb6e0ce4bea3df26b12e3d3f776abe9b
MD5 c6b7fd3f034ec7be7aaf3c250ab6cecf
SHA1 3dfeaf290b3528e35c71841ebff7595d96b99428
SHA512 68dbb82917fe0a10e116a2f1106d52e53f5406ae99d4804bef3568f9e030848864cae19575564dac60a981f611e54ee994188b1f1ab8275a83b7b8e5cf7e4d8c
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

82ee4696-9658-4d02-8671-45ea531ee18f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82ee4696-9658-4d02-8671-45ea531ee18f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\activity-stream.contile.json
Size 1KB
SHA256 b226bfefa18249c525b3967554e2c29a453f97d01ff383b8e733a3a307a64b62
MD5 faee2caee6921bbe6aa5d66e4d76e06d
SHA1 e3e8b8bb3f0dc092c8a0a714b87035ef1d3b849a
SHA512 2e7913a9f145a3545dda52701c245ac8865afda12ed21624b2ce5e484c4871b433d733b1d15f13e8cfddec1749b9bfccd84f9f5c8bc8645fac6a43ffc7ae0c2c
TLSH
T14331B7FFE9FCCC432B25F2E42E673E3CF1CB50678AE965097B515A1250543961115540
MD5 SHA1 SHA512 TLSH

Submit Download

02CE3827EA8C487BA33C6277099E86F163B865F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\02CE3827EA8C487BA33C6277099E86F163B865F2
Size 50KB
SHA256 8b9a23fb24672d6b45ce7d0d97d89e14ed123e4345687b52674730cf5df2a24b
MD5 0ece357f3925fa24c1cebdb474ef97cb
SHA1 8653fb272bd8096b27f83ba3909a66aaed02f73f
SHA512 324fc0595a74468588037e9d0dad5e6766f71079f4600992ca3d6e16134b2609ba2a15c94f2898675d841ddd3e990c26aab469a92ffa054a3c7ac148127622d3
SSDEEP 768:h8eXh/r3IXl3N3PKUGH8OZR2NUS0dv5n1s8VTAHXw3mx:htE6HJR2N1Uwxdx
TLSH
T1DC333A3EEF952D21D555427180BB23363B36E1892BE3F31F6A4F61226C463691E82DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

042D05819910552CFD42CBBB5E46CFF03B86E7DA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\042D05819910552CFD42CBBB5E46CFF03B86E7DA
Size 73KB
SHA256 735c748e418d290a1396db83d4322f967213733cbb24589c3d6c633a70188af4
MD5 677584f60f2d6a381e57e65f2f362acb
SHA1 85a91a73b845b743dbfa5aa4f0368af810314529
SHA512 163b27c6f7bd4530b16ebdef82c6759253175ea974498998649decbe39f360ac507945fbc97263f4305e70536ea7bed00717e73a7c969ee4bf4b4397d31dffde
SSDEEP 1536:Pmt5XKE3hzLMJ51ZFCmJQurtM8X7dBldR:SXKUiJ51ZFnlrJv3R
TLSH
T185731A27DE550A66C95403F580BB27353A31D9425BD2F32B3ACF7165BC2A3760CA2DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106255F85732BF5B2773034329203974AC4D7C59

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\106255F85732BF5B2773034329203974AC4D7C59
Size 18KB
SHA256 76fec0bc7ae8d43d432c8242c5c7b409a8904d062a2466c713acaa7acbcd4cb6
MD5 71450fc2c604b9c51ad8afcb20ec210b
SHA1 c9cd96306951f6065c16641d4f00f46adedebd36
SHA512 948784daf10ad0abe52944c42e7235de3a1fd8fed916cc03e5323e7208f1a6f41aa181ed605f1e8d197de1ce8b1ade2acd683019b3f4d0d78c5c8e0475506341
SSDEEP 192:mH9TEBVYIA7tccTBdjmLsnGgJ2EdBwVxzMFf4khofZQf2dHepkw0d6YPiCUCGIFz:mdIBDy2QGgJL3OCV4k+dHakw040j1sG5
TLSH
T154825C778F90391AC96546B0D5772B643E20E9438FC2E7EB7C8920179CA57711CE2EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A5FF55F86B76390F4C8D17F903DDCBE99D18B94

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\1A5FF55F86B76390F4C8D17F903DDCBE99D18B94
Size 36KB
SHA256 aa4a9b89d39e1c982793cfef8e6143cc298980f26e6d2aa70c7677e04ad16544
MD5 4352f870f3ebd98089fc7fe467307f4a
SHA1 b2225e162efcd87f88003d70839f358c25af759b
SHA512 bfa86acc6f6bfcb8f08fbe25fc4623e10bda8d031d2d206d99182f008579f67b56bf3631af7602fd6e7b11ce3b9975e4d95fb23f23cf014cfbaa9f5b0e52b979
SSDEEP 768:0m6ZS9teI7zY/+RM1MIh0//PJ61tZTAHXw32RBr:x6ZSVfsIIq//P8ebRBr
TLSH
T1FFF2D0B547A4383989629D48F4AEB79EBD3ABD834CC972EE74402429C4DDAB304D51F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

328067528E4038FA397E2AADA125544EC787FFF7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\328067528E4038FA397E2AADA125544EC787FFF7
Size 62KB
SHA256 8b274336bb9702fa3362796a4ec1eff4472ab2287d5492cabcc9d8d15a853943
MD5 a7105e8487d369302ad7f7e1d115af6b
SHA1 258367fb81857bc67ee065c2acc8330378576af0
SHA512 24b2278ffe65f375ab5b1cb7769f2a1cf9144d66df9c7e499d68439c81517ec936619df4076711816a7be30f13456119abf42fed5fa327c00ba6f8c96024007c
SSDEEP 768:5L1dosT56a5wUSM/8WlfcWQwM02xoWLuOFG9W0b6W4wDfdPXhOtF5pGEY+mMGhbl:zVAMDfXQz0ZSG9vtDfdf0n5puvhGvxg
TLSH
T1F253BFE4642231AC1B328D50E9AE27C91934E066C040D9FF9839B599E8D1B3777C67FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

419DC8D87E8A0ABA8AA45A12DA91F1F108FBC924

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\419DC8D87E8A0ABA8AA45A12DA91F1F108FBC924
Size 179KB
SHA256 a4cb19eb034cc186666d2f6d17877b18cb55ccb4134d0542f2539bc792da190d
MD5 fb35a258f293c824e7811ee3ddb4cc36
SHA1 00cefb09a11c4b38210f45706d0c9795e1c91db0
SHA512 64a725acf3fa92fd49041e4d2d59d3ad0473c46672efb29121bf430670432b9a4b46973a0a2e20172a3de320163adb1775be25954fa3f48610e5df84aa7ab876
SSDEEP 3072:t0nVbQpI+XKUppSJ51ZStSeMkS8nlri4/eqXkIFjj3:6GI+XbpSJ51ZStSV/8lJe2Jjj3
TLSH
T1AB04F836EE555A63C91403F580AB37363A31D4465FD6F32B2ACE71257C2A77A0C928EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43B5D3B387CFBE424CC2E4BF45B5035974E73E0C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\43B5D3B387CFBE424CC2E4BF45B5035974E73E0C
Size 20KB
SHA256 bbcf38fbcb7cc06300d7f5e7a9b67fc6558e6a757eea85cda0269ada13543047
MD5 cfde12d6c421c79c040e0bf60f9c4582
SHA1 817a230681bb17fbf2737f4a2859a1a3f3ebacb7
SHA512 d6a5bdb66efa9513adede8f34103dc4f795ac5ce73836f1d52d2d53c3cbca07860506a0939fea1cb87f897c82f9e8dc93fd74407a46dcc901bf023c2b7dc8b38
SSDEEP 384:spaTxW3iGsFL7iNGRa8Pu/QOCV4k+dHakw040j37Z16Z17s:caTxW3iGsNRa8Pu/QTAHXw3mrZ8Z6
TLSH
T1E0925E379E556A06C45149F194BA6B213C31DA634FC2E7AF6E4A2029EC317B31ED1EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4998D2D4B14EA1059D683D2CD8A334AA889A20FD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4998D2D4B14EA1059D683D2CD8A334AA889A20FD
Size 123KB
SHA256 bb357fee67a0a0d91b86b39443de11251ff2be84b36942df130bdb14e2e84adb
MD5 fff76042d442724dc51bd0942a293442
SHA1 70b1842a48482431a2244d4c6dbd734f7c1fd10e
SHA512 6f53fd43968705b1febabd37784dd8b092b0efe67bc0b1a2ca70883ec52e377ce8c7afa5f5e246e1b30a4462371273c51332683b9738d16ac21c2bcb0893ab9c
SSDEEP 3072:/NuIrLXviuexX9oldGIp+SdcFIoQkrFzq:VuEeuexX9oldGIlmnQkr5q
TLSH
T196C3D937EE561626C93002B140EB37353A21E4569B86F32B5ECFB021BC697760DA1DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4EF274CDF865B7C11C90A6E45AAB002BDF3DDB11

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4EF274CDF865B7C11C90A6E45AAB002BDF3DDB11
Size 72KB
SHA256 f2875666f10bf5b0e6dfa271c99c426c5199272a2f418b1bc8d848bdffc9affc
MD5 221de0a13bfc86bcf69b2514c9b34d7e
SHA1 437da534aba0f0292ee7b803cd6fb86eca83eaa5
SHA512 934cd2a58a1ba00dc6eab62f9460a175734abfe0e3a100532ee9fe893de133c9a5d0ce66dc977dcc14724e4ddbad0b1942afc251e0d6b6e769d8a4ebadc2f562
SSDEEP 1536:7ewLO9mA4IJYEheUHGfiLNCic7C7Veyqypdv:7lOcA4GYEh5H9LNCB7CReyqyv
TLSH
T1EF73F836EE511A22C96007F541BB27363E75E00A5BC2F3672BCF7479AC5A3750CA29D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5365FEACA0F45EF0AA69B9BCE884F56E7E629680

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\5365FEACA0F45EF0AA69B9BCE884F56E7E629680
Size 100KB
SHA256 91c0154a3c801f5de48df7d0cd2b83f7674f45b8923f27741010268107ceca77
MD5 2802ba523400bc8db1b9065ebb362af4
SHA1 a2f4665d09d9f4854b94df7b4acb9ec9a7db74f6
SHA512 c3cb9d9865b498e925a74e0b9705f5cb87cf798d4c25cbeb1ba6f03d6bb403b16d28ca2f1307dd853e14c5013cadcb732c3a3872dffb996192413fee873dce69
SSDEEP 1536:BhWw1NdQOJmM/fyDLG4IV5YSRDXqPZNRnxV+g9VdiWQ19a/QndD:2umufyDLG4IV5YSRDXqxNd+g9G1dD
TLSH
T111A3E615DE159926C2A042F6C0AB17763664E0B21BC9F32B0FCF74297C793770EA19B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

658840BDC97EDD51288DE58B7E2D7221ABCDCC23

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\658840BDC97EDD51288DE58B7E2D7221ABCDCC23
Size 21KB
SHA256 6b37c444ae3d9d96d461117642d9f92c5823b1cf1e0767fc5b85510b0e327151
MD5 41fc8aa83e8d36142c08d04ecda85a0d
SHA1 a72bb6f2fb408d36c5b9bd59d685ee339a6910d0
SHA512 5e023b58266fa4d2539f37774b8f93a593453188e49cf4869341b0c52cf2a2cf11efb3b2eaca44c887ff5357224c17a5fe3d2733b302da0b3b7101f0bf1055a8
SSDEEP 384:TqkG9MzUqbseYTkOCV4k+dHakw040j34llA:6RqAGTAHXw3mh
TLSH
T197A25B329F613917C5218675C8BB67393E25E5834AC3E36B7D8EB412AC423721DA3DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66DE4CC3869C3972AD2EBA44C3F076A810B736E3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\66DE4CC3869C3972AD2EBA44C3F076A810B736E3
Size 395KB
SHA256 aedbcf9f9d6525c5f498a247409f80c2144f8c648411e25477a411b1acc9b3cc
MD5 3b3ce6b3f9d4b896d6a04700f029d57a
SHA1 d1538ac366343750a60038cfcf1dc40288705e4f
SHA512 f2c68b145c47ab2bb52d2eb1c69684e71b1f7ed566a45b79febc3841aaaa72caec357a4b9d0ad2e4d55659e8a5f86e20f706982969889f6c6e8deeaf765ceb1a
SSDEEP 6144:MLhdn1/OUOzDKuLal7nzMqO5l5vVJ/4FOGy2BF0xL:adhtCAFW
TLSH
T1AF840866FE461E66C42603B581A723323B34E4565BC6F3271E8F7027BC696390E539EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72A8A3FF723CCCC85574DCA1FE2C38ECB695B042

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\72A8A3FF723CCCC85574DCA1FE2C38ECB695B042
Size 30KB
SHA256 604fab4de412692072026375122d775e019b142f8f340dbb13dc1ac6c436ed6d
MD5 8b143252173d971d27a09ac276059050
SHA1 bc4d3e3df655939d037db92ee1e29c3979ca7dcb
SHA512 cca03d7831c25b0401da937e1e26abde1c7260c759e20d0a6c6c94b2f6bebe3739363f9fe9f9181d8b283cc1c648e30c328f0736742d3d8cd3a7b9e8ab3a610b
SSDEEP 768:STkTrteX9Mb/3ULVOaqD+8C1hf77J8C1hf78aE1Cl4CsKxS:ikfwX9MALVOrD96hXK6h4a6CZxS
TLSH
T115E2E07B161024862F8FD2D1A0AB74591ECECD537DD9D1EB80512BCE24E6BE63A9D005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75D621EB801F5961D8EFCE6BE8F1C956DB8093F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\75D621EB801F5961D8EFCE6BE8F1C956DB8093F2
Size 432KB
SHA256 3d180759143234d2814aa12656ac5a7153c98d28e4cf42e66c84c62c27f53881
MD5 5b4047febeefc405b2deffd9b2f80501
SHA1 6992cf4418a4119a343c058e7fa623b4db556d49
SHA512 86a81acbee1e4954ff98e5eb2994b3951b290f2b5de2ad16f2d64c96078a076c18ac2ca8ca1449cb52a4642bcd7fb7e6ae0b73d027ec89b805f73c38284cb7fa
SSDEEP 6144:p6Lhl9HXGx8HhMw1IDkF21Y11Uwk0gRFjRvQDugCvPWwk0gXFjRiQD0gKedEEEa+:pS93o8BMpr1Y1URTzgo8XTYga
TLSH
T1F2949E76EF165A22C82542F0847B33303A75E4625BD6F36B1E8FB8217C6937E1D458AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89751F14315B5A8187805B379FE4265E13BDF9F3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\89751F14315B5A8187805B379FE4265E13BDF9F3
Size 19KB
SHA256 9238dfb32c9c10555dcb00946e84da0011ffb26b9cc579f81d69c5a000da04af
MD5 92d5f53558c2d96c6303e548ed5b1810
SHA1 84f2a10fb88f5ecad5faf76c4770ac794aed1076
SHA512 455fe68fa1eb9170ef0ccab7d17613c057c43ffbcebc2203820cdb5affb2b04b3065e1ca188d689fee7d2d9b670d1575019a76b83c732267154402c22bf4c78a
SSDEEP 384:NUT6MI8H6Wu3gxE4CtV9019OCV4k+dHakw040jubZbKd:N/8qsBg0bTAHXw3mu9o
TLSH
T12B925C778F503615CA15867195BF6B303E20E6838BC2F36BBE8E70266D587320D92DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 8fb82a33a8b3962af3cfbe41a8b80fb39b6380c7f55dae55e953141cdc24a513
MD5 20b445f00da20fea0dd241406b7bbead
SHA1 2ac088d90fb6d5482d2f91c477a8776d133b928f
SHA512 1808d58150ceac5093b50e72ea182d08bfb1eef5307c04a4086662e5bb0a6b9913cfe0f33a0737259a48323c8203de4bca11cba3d3268a895cc89bc900759b36
SSDEEP 384:H9XghOiO024YLdcs3hk2nhfdDE2Ba/rIVy8e1hd:dX+ZYLdv3hk2nhfS2sDIVy8U
TLSH
T138729DBF8F116C592957D585C8AD8379DC05F9ABCBF690A608243449CB8472AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D74B23A4C873B39D211BF36FB105D0AA0908F75

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\9D74B23A4C873B39D211BF36FB105D0AA0908F75
Size 63KB
SHA256 aad4c453036af4e2da236f14d43c30ce8bf693968514f1bfe03281a53e1d9c98
MD5 7b0679cdff0377ef76cdd6cc819ccb66
SHA1 de0fb9e7c5771ac86d512dac7333e79cb5ffafd4
SHA512 5068f8a269ca0a70e418ed930fb9c61e0a45bd8519fdfbb1d42352531d1bfd87ceb909be3f7acb43700baf311f7454af103db35718e56400eae3db09c41d099b
SSDEEP 768:dqOmFS0QBb+aZNN804czxDjNlvNeNCWoPujqCoBNIioFFdTAHXw3mC:dEQZq0Bz5NBNe2wGNmadC
TLSH
T14653F7698E19196AC66603F180BB2B353625E4615FC2F3671FDF702A3C613371DA2CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AE4F90DBA7FE19F8298323E08AA458C012240748

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\AE4F90DBA7FE19F8298323E08AA458C012240748
Size 1.3MB
SHA256 3cc242359c07321775de731d74ed49a52ee7265fece06b79e889fbd4376b086f
MD5 b769bfadee1e4f8c26d379b2831d08e4
SHA1 813d30bb671a8ff3305a91b98d90c4a9ca360aa0
SHA512 c55d13bd4f14b81e2a3cab042d90457e2e0c42c075dae2bfbf4936965beb02956ff3ac10cc6480672f48b5c8db3cc14974c8bc874093fb5d29dde9e7f9485beb
SSDEEP 12288:nEzu0JPNfq4KwYQmjel4QkqhOLrvF8CZRJSmrTiDW3P7Am:nYuKNfq4KwYQmjebtMmCZRLrTjAm
TLSH
T1D455D815FEA65D63D41212B280A7633037B4D84857F9E32B3F4A7072ACB63AD0E565EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B850D73D42C4144B3C66E28FDE891D1EF870F40D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\B850D73D42C4144B3C66E28FDE891D1EF870F40D
Size 99KB
SHA256 939a8a60f4d3569c3cceb0337b16d3974de48a21bf6546e2fee4e5fc62ae8a9a
MD5 324b2fb95ee81a64ecf36b0c827ea173
SHA1 f123e204b34b783fae3ae337c9afc5c07aa5c5fa
SHA512 2e9fc2a10aa66fefd22d4a10534935a7a50795e931b89ec3230820a990048b4d0770bfe670fe836acf0443522599a26e6d885abd888ffc77f992ef9e742b517a
SSDEEP 1536:yRQNjb9aaUaJCDA3DjHZv37nfaQazQPdF8VA3l3J3Lx6/Xdc:yWZblxqATjHZvLnyFXVA3rkNc
TLSH
T186A36B94CAA5BA34C11A83F2C96F3634346500C753C6A3297BEF3934F34A9729E57D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C99EA98A5D9032D2FCAB011415C22D8C4B356154

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\C99EA98A5D9032D2FCAB011415C22D8C4B356154
Size 16KB
SHA256 113cc9b0912fc3efaff0656e360b7a27206c6f2aaa77d9948121c5108fe47fdf
MD5 c6c687f67eb895f6ff740112f6631b4d
SHA1 676ea45d721ad1114b5e9d4b25dfcce892deb99d
SHA512 0d557a084236c33c18078c14246f05a2547a2d19c84be31e05ac4f7717ef215e00c275ccdba956d698a995f9205e1a30b72941e23067b893fb5bfb30723b559a
SSDEEP 192:e8eAM9pFdbzqXNmuxswfJTIhpzYIZDGBwVxzMFf4khofZQf2dHepkw0d6YPiCUCp:e8eASFdbzkcZSOCV4k+dHakw040jK1k3
TLSH
T1BD726C778F913A19C86586B1D8AB6B783D24E5434AC2F7AB3D8C60559CA87710CE2DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2
Size 19KB
SHA256 c65966b28ea9a433fb146607c7c46527b33dd22f5ef6caa887217278c3eaabcd
MD5 49a3ca0eb84032e005df4239ed8ff077
SHA1 9f4cc9c404b2d4fe685d24c59eda367ee55a110b
SHA512 5232202042371e0c18c448d329603dc7e2d7329b80b61cc7d78b4d2bf789f5e01fb9d1f922645930e5f0811778768011380912f041e79ba70b4c16c9de9780eb
SSDEEP 384:WANQybkJnSE56dJZ5KZaO3JSiuVvWC3OCV4k+dHakw040jNksD:WANfinS8JZxcT3TAHXw3m/
TLSH
T18B923A77DF503B15C9214AF088BF2B652E24E6874BC2F36F688D70169C597722CD29E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E725373242D9AA00D37266926679EE8C7E7D7E9F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\E725373242D9AA00D37266926679EE8C7E7D7E9F
Size 1.3MB
SHA256 778c224545502b4ad2ca76319cf871db8e718d1b2d76bc1f7634c18a99ced86f
MD5 a768d222627ec75749c9f46b78ea1ec3
SHA1 9491fd689d995b40eff5652a002cae477d9433f6
SHA512 a8f39c24ce59f7afbf3c825a4d2ff9842459b1acad7ad1e1667cd042094f35c9b296e2f2e58d12f991653069a6d1244bca0daea87fb1bc2200d814951376f040
SSDEEP 24576:i7bSB1DkCXW05dbx7ZSB1DkCXWe5pbwPtQTk1AgPPk:i7bSB1DkCXW05j7ZSB1DkCXWe5mPtGb
TLSH
T1F8550A86FF576E13C512127540B753343238E08997DAD23B7EDAB191BCAB3494F263A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9B005FC337164E863590CE51C31F16EA81DCE4E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\E9B005FC337164E863590CE51C31F16EA81DCE4E
Size 917KB
SHA256 f3be90bffd4a82a08bbd85d4f2df06444255e847a15c24eb3628d91941bbc78c
MD5 df9a8e1fa28b1fcb7d819a6f28625266
SHA1 e8cfb1a228b0c04b21921f76dc679a5a92815677
SHA512 8302574004bcd047b8f6b778213fdce7f1b4934db87df52a57a6b745c73c7d48c8c9c59458178efb1286d9f8d7c992ea4a9552cbf37a31822a7126bd5b46bd7f
SSDEEP 12288:07p1ZvsOn8lpXP6krLGUwQu7IKSbcKr4UwQu7IcqdqJ4724qj2UGe:0PZvsbb/6k/mfS/E5q0J4724qqUGe
TLSH
T1F1153A2BEF865E53C91407B680AF63353630E18527D2F71BBACF7156AC5B3A90D811AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F3CF458BF6026ACB1AA55DDA70A5ECDDD8B3963A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\F3CF458BF6026ACB1AA55DDA70A5ECDDD8B3963A
Size 77KB
SHA256 5b1870257a1d2dd856b6317d2004966f93b450320481be3f35e5c9600160386f
MD5 e4f2a4424db8f7ed7e77eac7db8969aa
SHA1 238c33a812f7fb1a42ad88fa348540c4d0ad83fe
SHA512 8ad3130b97ff7528ab1d9f396515ad631bdaecca3b66632d59c2775a6a2da69811609c0f79b14645cee688a9db854745c475aaa6fd297c50113cf3823bb9a3b5
SSDEEP 768:DJv57ZzaMS6SPAukkVXvaXGP3C7mXFLEaLafAmMoEo/ItafIMtik7Kon9UddhmTp:DJx7hzpK3C7mXpyBItEtikWO0td0
TLSH
T1B273196AEF566A22D529027040BB27303B30D44127E3F36B6F8FB025BC1A7760E56D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

597f63f7-bb85-4519-aac2-d4b4c6cf4b30.tmp

Path C:\Users\Admin\AppData\Local\Temp\597f63f7-bb85-4519-aac2-d4b4c6cf4b30.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6d432920-027d-4853-8d4c-1d5e25f72ac5.tmp

Path C:\Users\Admin\AppData\Local\Temp\6d432920-027d-4853-8d4c-1d5e25f72ac5.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

438ffbcf

Path C:\Users\Admin\AppData\Local\Temp\9fe4474c\438ffbcf
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3708_1175996373\CRX_INSTALL\images\icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3708_1175996373\CRX_INSTALL\images\icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3708_1175996373\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6084_168457146\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6692_1871466206\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8172_152905199\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 a3cbcb112f769d43937796e03dbe726d54bac0352b0995b769eff1e4594f07f8
MD5 f75e00481b57973b50506bf12f2d5b7d
SHA1 4b06ced6e18cde38d3e6362aa3e34621819411f2
SHA512 282e25936dd4aec4c16d30882db4a35cac5131cd1a8dacec0ee6f796366bc748153d9c691bc982a8df5a4a49e8e55ea6e675f45e25a80f2618c860c6c5eb380d
SSDEEP 384:AW5auhFZ0W7b1W+qqTjU5W9Jn9TNKCJcP:vPr7Q+LHD9N9R1Jq
TLSH
T1DA92FF012FF71620F3F38B75EAB56357E977BC039A02464D4102A24A1533B60D9A6F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 10KB
SHA256 a0196ccb53417a09b52c0b35aba893834f80557273eb1e2dc1411dbf2c034fe8
MD5 c9ac56b1172eeb55f18b4bf3503326b1
SHA1 df40793806d5b74d56067dd29d0281bf3da74ff4
SHA512 b9d632b8dc8f4b3d8dcef23f93a8844a37ba283813ad9bdcf29a9bd84bc6101930297295bc9f4586902092497dd73b142652e17a8d3d5d62927c7609a28ac25b
SSDEEP 96:X3FC3F/73F/G3F3Eh9/NScou9/NSY3FTO+HHDuI08w37opJw3GKO+HQ:X3FC3Fz3F/G3F3W9Jn9/3FTpBfKCJ7Ka
TLSH
T18E22110127F71E05F2F38A35AB7273536773FD025B0B925D8141A2494A32B6089AEF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 21KB
SHA256 cbb64c77200b30a5a54b77bf98ecf487f710a4268e3fb0c8585979a48b7e19e7
MD5 95e2879a7abeab14c8980cef6672e1d9
SHA1 789817ffc383bb06b4f906c67b6f40f42649909a
SHA512 29eca16052bb6d681ba8bc3919a28608808d678a63e3af59d56afecee766bb3baf17faaf945beeb35c077fad1e5a2d190be2bd669b61be0d8e7cd783639a348a
SSDEEP 192:4XdXoX/p6XBEAFZdJX4ZnLXHXfoskjsQX3W9Jn9EXTpBfKCJ7K7XR:MF8hW/FZj4xz3QTjl3W9Jn9gDKCJ7OR
TLSH
T18FA213012BF31A56F2F38A75EB7263536777FD025B06861E818262450933B608D6AF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\AlternateServices.bin
Size 11KB
SHA256 ca7c2a7e0f5c35c6639cd651c08fef9938c32dd81cae417dd8a8168d8ebc0e96
MD5 9edc9d22636486284bd4cd7d2d9cf57a
SHA1 321fcbc4f891629b92d12b44805c844ad2879a68
SHA512 73c06389d26119f3d0234454aad4f4a702c7da17b1c25ff4293b65521dee6a96c98b1272a3d54c25c2ba786dc9ac9429f757d4e2038b52f2d779672729113c34
SSDEEP 24:P7RuhMZE+lz3qMVbO6ky9BS09xItqMFK76DxqMx+7d6eMRMxzM4Mx9uA:P7w4p2g0WuzPnoe+Gn2A
TLSH
T1D432D7F71777D411F05A4FB8848D7948CC2312361D68C8969A04A9D313AA7AFD13FBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\AlternateServices.bin
Size 11KB
SHA256 3182ec49cef30f0c35d7c066f9eacb5bbf85acfcb61b1ff8aed5d23583f0aa76
MD5 47b4c9010db6bf764e49f16dac8a0baf
SHA1 d04fec500c0d56067feb831f1c8378040ea37e55
SHA512 3329a7f4a9a513b1196fafe1b32da8da9ecabb89b83c683d4da24b84c7162a6912e50bdf11a8d227b0105c53c1c47185cd382824e31143c59c8f5586f28df24e
SSDEEP 24:P7RuhMZE+lzN9BS09xIqqMx+7dRRMxzM4Mx9uA:P7w4H0Wuuon+Gn2A
TLSH
T14332C3F7277AD421F4564FBC804E7448CC2312261D68D8929A14A8D31796BAEE13FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 4842e1b090558f3ebfda837dcc2f9bfc6c54ff249bb0e017273be798d5f2cc0c
MD5 0abd9afb4142b6c0948523507a1dea5d
SHA1 0f5b5010baf75de8663307b8335e1f069c4f30ee
SHA512 91dc68a026090bd7df4e9af24588f4f94ed345734c15e31513fabfaf2cd1ecc115e9de837d7a4bf0e71d3a3327d599b22892dab8c6b3b5e4a59da404ddc6b67f
SSDEEP 384:FxCiz8deEU/YGcm+uQOcyKD+wb/bybxLfYboPOQyjwId66Joz/zgC1jd:Fx/QGcm+uQEKD+wb/bybxbwGJ11/
TLSH
T1ECC2EE44FB2A953FD41512BBDCA50B001F79B88A58192FAB3A4C646C6C872DC7D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 568d1197a5a737fee864b266c6f816fb3fbb6851372461a9149f55249dae0a18
MD5 4d000ded33b6df49868bb6c36555a785
SHA1 c6e71f6f3baacf992b0c1c4fb0bbfb6481fc8c13
SHA512 3b4820e10a2fa6744810da0effaa3c15c1b7fcfb36b61e60b94bef363e719c79cca40dda1e5278bd7b4124c83ff4604aafdaa10ef840f9ccd09940df036112a9
SSDEEP 384:/d66Joz/zgC1jYxCiz8deEU/YGcm+uQOcyKD+wb/bybxLfYboPOQyjO:41mx/QGcm+uQEKD+wb/bybxbwGl
TLSH
T1FDC2EE44FB2A553FD41512BBDCA50B001F79B88A58192FAB3A4C646C6C872DC7D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 be16a94bc69487abc5746d43d146ed1e517b6a64171db57fa4115af973fd9cbb
MD5 dc066940c42211eaefc21ae4dba9992b
SHA1 3246d41c067fbc8c07b54315ee3148cb75e7c8b8
SHA512 0cf85fd4ef5d943605ff186611458479393f8c10c0e47348cd2da918c276464ae354e4fe336428859d49c7e25628bc8ea45354463c243fe6424488661c34f29d
SSDEEP 384:5boPOQyjTd66Joz/zgC1jYxCiz8deEU/YGcm+uQOcyKD+wb/bybxLf:ZGL1mx/QGcm+uQEKD+wb/bybxb
TLSH
T117C2EE44FB2A553FD41512BBDCA50B001F79B88A58192FAB3A8C646C6C872DC7D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 eeb0c1e579f81101a598efa7f78cc652383715f5890f41072979284ba5989a13
MD5 707ec9bb3df3ceb7817cd6bc29b350a3
SHA1 5ddc8ffc7d1ebbd9f997bbc1b13f20962a645c64
SHA512 e7b8022c15046327cdc063554ea299f1e6f7669aa5f6b339dbf04e26bfa908fcc511109e0866fc3ed9a97a2f1de689293b38f38962327585ad70b7585e9bf1eb
SSDEEP 192:WOv5zbo73ZOQyjleCAqT1d66JoztdzgCl6mc0dz:tbobZOQyjoId66Joz/zgC1jd
TLSH
T1E5D10C58F63C867FC018023BCCA61B510F76394A985E3F29719C741D2D962DEBA8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3a2353a454f807e662abeb4ee423359ab9d0f942d81de1e3a871bb529cfc2e79
MD5 ac1833ae0acd52d61c6b36ac5977c87f
SHA1 efef96e840e417d5ae2dfe14de9de46ac699a879
SHA512 3d50868bdb7fc1b896f1d6115b561da0b7f109d9313de994def0d2f725df1ec3a4e7f675f6f2bb38f4dbfebe4833186cdb44e45c384ce73e7368e8640184a4ad
TLSH
T163214C5C7DBC8E6AA8C7E26C7495028E93158B47488B1C435D12FE8DDFC1ADD326E839
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 5KB
SHA256 e122db99d4c5834b05eaf890db07142628d45f62d044461246cba049d1c10809
MD5 3e0dcef8d22119713559ce5c4ed01d1b
SHA1 9e3ed89881bc97f808c31cb8627f11857c64103a
SHA512 1bdd32e5e3bc5d71c38120959bfeee80c89225449ac06bf77f058ef1e67af49a44cad06d7cdb5a0371a249483beb5dbc501acacf82a9a540377a650796ff3177
SSDEEP 48:Ya30l30YAc2apw7rcISIWVwK+HzwwMXy5/ZugZ329+ZJ5SMmREai/LmOXVQsMbTS:l5EVT+Hii206E7XVQsyBNf6h84B3y4I2
TLSH
T12EB10E1C75BD4C7E59DBE69DB489028D82DD470388CB1C874CEBEE48CE8669E321E479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c70ce96-d0f2-4f60-895d-5f2c4b0011b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\0c70ce96-d0f2-4f60-895d-5f2c4b0011b5
Size 1008B
SHA256 accb66294e782f309e860926ed41d66d7a5e30d306b12af2135a5f2c5116b244
MD5 f8f209bb3d794796826f5afe06b517d6
SHA1 cb39bd22b1261fd4b7828ead6f50839c2b9ac5bf
SHA512 8db2d11dddb946c01990a2a7fe2c399ad179531dc0e2e8ae56102f626fb81f66624829d40556e841d7d5f20e6a32dcf1c396152d51339c428e7ff14a297c3be9
TLSH
T162111B80992474F38DB8828794E137434BFA661380C608046EA06E180EE9A2FEB57B0B
MD5 SHA1 SHA512 TLSH

Submit Download

123ed217-5654-4388-914a-0054c5c60612

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\123ed217-5654-4388-914a-0054c5c60612
Size 2KB
SHA256 6a5a3070414b4b02dbdf3efed983bbe1306585e9f75aa986bc41ca80b057440e
MD5 b7458a46be53e65fe67e8586281c0a3c
SHA1 52275f1ae724d1d3fa14fda8f051dbc4914315c9
SHA512 4b9fc339a86c95df05e439b8a093af5b394753d381cfb85efb14dfb0ef9ab087065478de713f7fbbb50c2a3f2545da6933494e97f88970f8015b85d210393017
TLSH
T19741115C35B89D7B9CDAE55DD482338E93608A0344D218432E45EF0C8EA769E636F93B
MD5 SHA1 SHA512 TLSH

Submit Download

2f99de47-d380-4e17-a40c-8bd10da5bd2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\2f99de47-d380-4e17-a40c-8bd10da5bd2b
Size 7KB
SHA256 f0df6319452d89b579a10f2eb365bf86a8a7f7c8a7d01443077addb548291d03
MD5 f2074e95e2e04cde9a98a78606e06706
SHA1 2b9394534606db80250e05e3e6eb474894f72cf4
SHA512 48fe2a7403f402695e1f0bcdcc8600f93a0ca1a27e267d86499121b835ce0230bcb66681f1d8e4b0a1b6cbb74393d5d13ab69938f478bbd6985e44b34793be72
SSDEEP 96:30WNntEeIHkVt+HqW2E0EZXVQsk7Nf6L84Z3g4IkfJess8:5ieekeHqW2Et+r79h+wuRess8
TLSH
T1BBF1532C757C1CBE5DDBDA9DA487029E83DD874384C61C835CE6FE088E9969E332E425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7beee0e5-1e4c-4923-a487-4bb498b51552

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\7beee0e5-1e4c-4923-a487-4bb498b51552
Size 16KB
SHA256 11a85d7d68ba63ba68b769dc621c54743515e416be1190f12739a2e3153e1fef
MD5 b71bae0196e740d27d8960eb4696af62
SHA1 bf34b11655ac17ee46be5667d841b20547a1d0c5
SHA512 7cb563c2ea5846b84c37b75cc12134d5e5caaf2d7a9aaa4e8b408f466e3e0639e11d15099e53b89a5b2677095cebf704c39243d88f92179b4e98e154063aab17
SSDEEP 192:OjKM8Zx85VSJVML5LMGU4jQL4UHPzmUYtYP8NbJVv3cWJ4eaHKhsKSdbzx0ee2BB:mKpZx8H1d9J1zqKhsKSdbl0IHzcA
TLSH
T1CB72BA166860557AC251E3A894FC7FC3E1F638CB4C419FCE9BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6a2b982-4682-4cb3-af94-a1834e66353d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\b6a2b982-4682-4cb3-af94-a1834e66353d
Size 886B
SHA256 d057ff602724f3acd9b1dcd5815758048b0dfff99a38fdc39be2e2fa82260bd0
MD5 4180b453c0fcdfd8fa6a0671e21c09ae
SHA1 b94a6482c311a0b26370d4ba19649e4d49a4c25b
SHA512 1a91d08a1956ceee0d69665d88a43b33d3be469a9ec6bc67201beb48a47b7896f9ce8e042e70dfa1b6e510cca42053d6719d868e93afab30d71586733a155f9c
TLSH
T1D81100818938B5F6C868929784E17B034BE5A223C0C648047E905F180FFA60BDB57A0B
MD5 SHA1 SHA512 TLSH

Submit Download

c1d79a90-c23a-4df1-b85f-6a933b5f5aef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\c1d79a90-c23a-4df1-b85f-6a933b5f5aef
Size 235B
SHA256 b4b134b6ff005198a3e2dd718bf3845053fc10caf570926caea6675dccbeb5df
MD5 8f384014e39fd6087144a41e17f3ee78
SHA1 9ae58a1e95a02ec3c2a123ad1f4d58e4dbbdf848
SHA512 e190a5c4f9aa71b0986652e90b6506875a6022810341dc26e0affa813f170ec30d657852ec2f2a7bbc03378e3361cec5fbbd455a57d00aa04bd66aa0817a7add
TLSH
T197D097806C98632C88100F0AB0A069C733548C3334649850A69444388EFAAC442A191B
MD5 SHA1 SHA512 TLSH

Submit Download

e7aaff05-6e6c-4e2d-9e1e-bbe2723a9014

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\e7aaff05-6e6c-4e2d-9e1e-bbe2723a9014
Size 235B
SHA256 469d118ac35dd10ad786fbf26b1e3fff0a3844eb5352ae1e30993076c7b8ed12
MD5 cd4171d74c0ca8ec071611ec74f8b366
SHA1 f026a92d7147aa63d230f953c99d1c81c35294d2
SHA512 7b6f38a97f005d2d8b0ca8f5057c4f890a9790b44627d5fe3761e5f3e932a1a9110a498922cf3b9eee209e353ee65753ecb7dca76084092f33e2c97818360ab5
TLSH
T11AD0A7E02898675D08184F0AF0A169D73099CC37687DA830DE6645799DB9EC5D15191B
MD5 SHA1 SHA512 TLSH

Submit Download

eba57a5d-9343-4425-97d4-ee4cbad52263

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\eba57a5d-9343-4425-97d4-ee4cbad52263
Size 883B
SHA256 09a8428f8cc24b404b7e5017234129cec13ddb24c15d0e063faeda8dab2d0a87
MD5 be2fa503419676016b1d7aeea9a7161d
SHA1 ef827b337f570e81e1436d79e4674e1dd4bd3e35
SHA512 0e945206e365f19222d39eecb7610e96fb86a6c9da766f0e1b4ef8b3ecc7d1c833e1028bcd3b62109ce20845ce87cfe44c2fe7d70702558ef87a53dbb5e491fb
TLSH
T1CA1104C1A538B4F2CD6CC24788A5770247E5A513C0C554147D905E180FBD61BD767A0B
MD5 SHA1 SHA512 TLSH

Submit Download

faedc2e3-a5a2-4cbc-ac03-7c8afb4510ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\faedc2e3-a5a2-4cbc-ac03-7c8afb4510ae
Size 281B
SHA256 9a29eb87e94e45e479bce4fcc79f4541b44d6f011226cd892b83c979493dc67b
MD5 d5a3c238b7a1e308119837a384214e71
SHA1 fe4db83cc30042195ccdb3c9ef5f80f5011e3b85
SHA512 55ca92a1a187b467ff579483ff3de972a3be85ff7fe32eab0258a9336f0c94f61059d443e972d5deb1e591734a9e3b5a6eedc886460a81669c758abf158fc262
TLSH
T1AED0EBC13CC8739C0C6C0F0AF0B068E332B24D3220F0181099C0063489FDADA4060C06
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
Size 16KB
SHA256 d88902e4349a47543f7e2718f7659899140ec1cdb966b70161e455ee9ba6711d
MD5 573d307472c91473098061895e0842ce
SHA1 46efe723e4d6a4b9b82fbf431e81c62c5353f5fc
SHA512 b79ca0cf41511c2edea07b93de909867f0a036a4a2daf6968f0e5351958d9cf83953645198f9ff7a1b93d9ccfcb1dd33618e00d4d5b04c7f553cf16fc78bee2f
SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HnDI4hQu:sI4nRfzXa4c6wi464U464k4E41
TLSH
T1EA72511545049EB8298FA78AAA367E01C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\places.sqlite
Size 5.0MB
SHA256 60cd6d8660373d6b4a991e23de8d44c68b5aaf2cb04c28b1c158a064690e2012
MD5 d29a64d3aa6d780305b0f824733dd132
SHA1 0625e7ad2dd2f698f72a2a0a3428a2913b4fdac9
SHA512 7b132d088e9ddc7ebed24a39007647a8b706f70bdf7b0fcb2f966330d167327413807194b2a90a9b3980c687b129a720fcbb3885f16355b65c11ce621ed5ffc7
SSDEEP 384:M8r54w0VW3xWrIG9chlwXfUqvV83HXIbjJ3QZe:rqVW3oYCJ3QQ
TLSH
T11436B85B76206010CDEEA571ECE36F08A87B71168933769238E4256D4EE0B23795DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 12KB
SHA256 950b20f8e9aaf139a8bea3bafca063059520f48c772fc2c10269e522109c5118
MD5 4e1b4470f01d79ed429805b3ab2e4f06
SHA1 ab9fc9ae4f7dba98914472ab1edf075052262d27
SHA512 f63e7ef376534b41d9fb05fa7a02cdf431b6f94e7214018a03d0f5a26d49765c6fd07b6d9e8814472da93acb26531433da8694da2776dcaeb685910afe9404ec
SSDEEP 192:2rWCRHfOqp3OSSBLRABkqaSOBw88SgL/W7rD:EhiRufkw9W3
TLSH
T1BC42AC386144CB7F20B2327DAC294D7019A142677BBFBCD315FD9891459CF2841E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 12KB
SHA256 6e49e4fce3d51e7e8987fa64a2fcb2fc37099e43715d32dd5e94a796e27009fe
MD5 b20b13829451f9a0bbf2f3784fc71656
SHA1 a92f2cf285c76c257ced2018b365d9fd9067e70f
SHA512 44e6e0c4023a63750f468aab89822f234c8ced49ec541842207228ee47934a3cdd25623cf2125d99c9363f94728e78ed195491d5aa4121d0cac6b2db4592a066
SSDEEP 192:2rWCRHfOqp3wSSTjCLRABkqaSOBw88SgL/W7rD:EhOjSRufkw9W3
TLSH
T10642BC386148CB7F20B2327DAC294D7019A142677BBFBCD315FD9892459CF2841E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 12KB
SHA256 c6d9486f497c599c1c4930568478a4158552f6fe9b08fb3691da59dc3d2233bb
MD5 768fef2e168647a9cc0d97e7135d0281
SHA1 1396fea5db7d59553caf9729479e1d3ed4d0be8b
SHA512 ff51c7e43fb45002a87a58046863793718ee42b70b5ee7babab169d6ad18e98ddcd70889ec5819979c52ffcf2c1347fcf3336e8cd7187f25f5e2bdb6f5bc8818
SSDEEP 192:2rORmfOqp3wSSA6ULRABkqaSOBw88SgL/W7rD:Shd6MRufkw9W3
TLSH
T16142BD386144CB7F20B2327DAC294D7059A142677BBFBCD315FD9891059CF2841E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 6KB
SHA256 755f586c5925616a5169ee17eb384513faabffde6d882cebf87ad26bbf721c13
MD5 6dec487314f7840f41d7f5950bc8edc8
SHA1 5fb19de99792bd95793ed54c7863a8e5051e4b16
SHA512 4f4cdb447696d3e46d7a7013d751977127374c7547c57c05577de002b713394ffea0084417951785937b544f64376df2e5a8e5bdc5bf4285a1bab20f6b35c876
SSDEEP 96:xHYUTUmDqGqmfOqp31zSlSSlvdv9jPnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOqp30SSS5Bkqa7Bw88W
TLSH
T1EEE12F789508CF7F74B676ACAC688831AAB2013BBBBF28D650B55484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 7KB
SHA256 0510157d9e67e7e66abf39242e365385ec98199c48b8952a7f5c0a3a9b5339c8
MD5 c8431bf3d138f36153a6b87d9512edd4
SHA1 9a5fd4f74d2045a1a36e3ed666e9c4ab64470478
SHA512 d7be65a04249317b32d58d14b195bd12cd5790a54f13715c8a782ea37c1e923e5ced2546172c96af66365ef43009ee325f116e098c52ff2372a5b6dfb7754444
SSDEEP 96:xHYUTUmDqGqmfOqp3ObzSlSSlvdv9jPnKH5OVAqvqa7Bw88u8L4cnZFZGS:2WORmfOqp3nSSS5Bkqa7Bw88F
TLSH
T133E130789508CF7F74B676ACAC6888316AB2013BBBBF28D750B55484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 5b283c54276d7ecfb31f784857c753b35f27aa3a8adbe6ea129b78eba43096d2
MD5 f7a9a96ce402449b94347d0d323294ff
SHA1 db45e8bd103d473aae7e219eef91032677d95604
SHA512 579a7bf1c6aced31dc1b8724cc5e64d1d202b34fc3bfe9503d7a9f585a628f69ea8bbd7d2af0373f48f9d864afa01bb50ba8224482e240b59d4df03b212fbb92
SSDEEP 96:xHYUTUmDqGqmfOCs1zSESSlvdv9jmnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCslSSP5Bkqa7Bw88W
TLSH
T164E11F789508CF7F74B677ACAC6888316AB2013BBBBF28C650B55484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 12KB
SHA256 e555b5bbf728b25a81beb3969669b8eb051d960893bfc907ca6f88bde0423e71
MD5 1eb0f4fb4ee5e8e5201b1c9850a5d637
SHA1 3d1e28be86c80be8a1b56c0cc4f834c9aefb3446
SHA512 a6a6d8f65196836a0ea0efdb59cdb8d83ad562eb7784dbb3a02520a16916bf95bcfe4a374d048971b010547e0d2648413ca0932665a898b874ddf017b9710bdb
SSDEEP 192:2rWCRmfOqp3wSSjLRABkqaSOBw88SgL/W7rD:5h+Rufkw9W3
TLSH
T18E42BD386144CB7F20B2327DAC294D7019A142677BBFBCD315FD9892059CF2841E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 7KB
SHA256 74907ec58d33bc5b25004607eda1f38bc7ed41dcd6ae2616bdecb94994622c5e
MD5 ef89d015314c750e54f7f8c2c32db10b
SHA1 760736870e4fc26ace578a5e313b7ebb96189fe7
SHA512 7909d0f2d7dea7a86518ed431a8ce869efc7d0816b2e3c2243012587ee99d6770d543e4b13edd0591893eaf38cacd3cbcd5ada42c988387d21a1c3726cd6a289
SSDEEP 96:xHYFTUmDqGqmfOqp3ObzSlSSlvdv9jPnKH5OVAqvqa7Bw88Dg8L4cnZFZGS:2rORmfOqp3nSSS5Bkqa7Bw88X
TLSH
T136F122789408CF7F74B2766CAC68483169B2023BBBBF68D750B55484055CF3846FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 16KB
SHA256 d943292e6556b7355eac5d956e83d10f189113cf49cf627c75d70e924de42290
MD5 955a8feab8e2003f309c1f111eda7bf0
SHA1 3015d4eed27122edcb6ef46447c2cae21420ccef
SHA512 fb9f3467c481d2e60583ee8dfdd129fca58fe3c223dec64a273f9246b9b363f5b4b03af6f57df2bdde5b858720b45363d321ef2e8f701683a247d39fac658f82
SSDEEP 384:n1Q0QxS95maHmxYEmSFl1Hn6UR8qKvBSqMkQsCV:115mCBEmSFl1H6a8qKvBSqMku
TLSH
T1A572B053E2153817C41474A600E71F5427FF24925BF78249D72A3F2C88FAB4AB6E77A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e4d8607c584d8942d49783b9e3290c47e985b792d5d61952b28e7877a0ba0106
MD5 43a7e3bb3a9b994ac9679b143e623b65
SHA1 5d7ec46f83f5309880e3f068078d384c4ef28b44
SHA512 b3aca4f824d1b52c667d90cc91d9998fe08452fa5af9ef91dd2530c15073008b399bfdf2cd81d97e8dafe8d086c3f89198bd06106141d84f83201aadc25ab3ec
TLSH
T12F21CA539C7B2EF67A509169D08D4FB1CA953432487190F0819AAB0262FD51C37C711D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 920B
SHA256 b817298d7b5bbad64ba859efc946b3a37403cb9c6fc4304ab5854ce4468bcfb1
MD5 4c4f323b9e7d30b9ce25d191cf1451a8
SHA1 d3d3a841080526a35b765e96e2fb56051de733f1
SHA512 c30de1443baee87a7bc38dcaeb0e55579da2d9eb69ecfe54adc304fd6381e7ba11a95df2e6e17f4e5a2a937952fde850da8ca8fe003b745864957645cc485fb4
TLSH
T1961184CABF1F28773B50920368C93F949A98341103A428A0F60E5A01065CB9BF9DB386
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 1c025946295883dad392fb035bb650b089959b26b0d4aeb0f4cd2f70d80e4008
MD5 98a7edff50764ac089c23398a02f3051
SHA1 1fd55531611bea095e02281aca9c6002a4767616
SHA512 50fb9f5650d9780d78db0d84b9b9636e42634d4e5c86213a6c1bf41069a28ecb860dada0c8b757af660356760682b11718616e65dd71c602e3801cde9a3a6985
SSDEEP 96:RuMqGnjYraX2VE8EMJF7fIi+MZk0zf8W8Qq3goS2vb0VThx:RuMLs2X2VERgFLkMZkc8Ljb0vx
TLSH
T12FA17C27D419198AF8F4E5BE10D149E3D7BE2C0453FAA4E925143579C0BA6D23BC8BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 dc9108da85f017d7f8db2f3cf3e0e1831369d3670159f56900a7c1667c185dd9
MD5 914109af06ca32fcfc6f0da0f6c8503b
SHA1 72feb7218536cc08b12cc2789fd17d7c24e0991e
SHA512 7d366d1ebd8402cf682b1d8bdeebd57f74895415fa054d4fbb796c6c0becba80523e9c2f31432d9aa062e5baf4b8d02cb645bbda310ca75f49cf90b894ca0960
SSDEEP 192:UnqMUWNdvOXXXV04FNiMZkNcedmX7HA+yUdl0wQ3Vua55J+:W1XnoyfiVHAfUdlji+
TLSH
T127029E2795983D41CDA864F940D18EB1A6FB6C6402F9818C9211763D4CBF7CA31EE6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 12KB
SHA256 bcbbd18fc8f941782d7d7444e9c23ec56d24a8d7b4ddafad556578e73f6f2d03
MD5 7a5466b87c3b5d5590836ef1cebb0186
SHA1 c0a0910e647712b6e9f6c38e9fbad311a430fd37
SHA512 10abe75d5859b6daaa273d25ac406ac5e47a467e89e12815be9318dc83457cb91a14c8c81d823ffbff98ad58dd12ae11d96fdf5bf45dca920931943ed0e0da8e
SSDEEP 384:m1Q0QxS91SWarRpPbFVdJUc/8qKvBSqMDOsCa:m11p2/bJJD8qKvBSqMDp
TLSH
T1B842AF56A1583847C490726901E74F605BBF38568BFB804DE7213B1C88FE7CBB7A7660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 15KB
SHA256 96dd1d243eb59ce89c9652c8daa39774c3713a98b6b5edf130a643668dfe8a06
MD5 85aa3236592baf11b8451787cc1c54d2
SHA1 6615d4705fe5c3f674701eb75ede8ab8bd04a768
SHA512 87aa91222c0448aa7ae817d06a4995aeae9d599ab7712b160424d3c3d7a40e82d1516b76066c2fd4025fc39aea3cd5160dd5233593b32bd71e3cb44870ffff42
SSDEEP 384:r1Q0QxS9iNcBkXfAhT31rBUUue8qKvBSqMrUsCP:51iPfaT31tUA8qKvBSqMr0
TLSH
T12472C062E2253807C82475A501D71F146BFF24964BE3818DD3253B2C88BE78A76A77A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 15KB
SHA256 a20f6d325cbb598610f0ea98ca9abb89cd8934668f90b5b9e69554eb2bd0a082
MD5 f74a3f74ff3dec456aec361dffcd226e
SHA1 f1ba2bc10bf0a04211ff90b2dd8d3488bad7dbc9
SHA512 95ed3aab64b75e85154c84f1877dfa477fb87a10bbd6b5f8c7debbf677db7960fee215a813ac7af03f740a0ddae09273a164b41afe62b2cff7e9574cb6fa1d76
SSDEEP 384:Q1Q0QxS95maHrG05yXEZal7DgU1Z8qKvBSqM0AsCS:E15mCS05yXCukg8qKvBSqM0b
TLSH
T19672C066E2603457C41075A901D71F5427FF24920FE39189E7193B2C88AEB4ABBE7778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a39111d4c1efc599e7352c20e4e908edb1fc3090b58f09c705640d2d27095935
MD5 aeb88e019c8cedfb53ac13d8a20dc92f
SHA1 d927de071ff385e654022e4befb572e9367a15ec
SHA512 8ba2f1777a584dedad7c14917727f525d7f31ec1ee731667702e6527bd0d4c16b35ac5cc2ae0043891cde9e88b70e23bb9f269a23a3e10dedabba2640172be9e
TLSH
T18121EA837E2F2DF73780D14B94C8AB54FAD1503247B491F09945AE0103C819937D634A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c17010aa60ccaba5a3e0fffd19f0e0e0c5935a05d6be829554b1b53b1a0877b1
MD5 b2782d8d9c42fae8bf24d9db62cebce3
SHA1 d1587a7db3855080b7db57bb6606cf63bf9829d1
SHA512 d6da6da209d9f3ef517d2bf3e54cc1f559150be7934d01bd836c329a199400ce02e69b306e240283f8c05761694b1a8762db4e928eaad48c444d42e9625db037
SSDEEP 96:T2wuMqQ2jqX2VO8EMJF7fIi+MZk0zf8W8Qq3goS2FOTE4:TTuMP2uX2VORgFLkMZkc8L5O/
TLSH
T18A917C27D50D588BECF4A1AE10D24EE3D7BE240413FAE4D965001A25C48E7C33BEA6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 1c05b56b6c4bae30b9eee54600ed11b1224bc1fa26f9d0fe98cfb57f4681ea15
MD5 e830cb66569614eaf42dd7c5b3a2cb82
SHA1 f0315a8a0e75ce17a7f734013f0c1798196535ee
SHA512 13f5921fa05e3b7ca3236904e4a02901bb26701fc3e758b37b9decda26eae06064010a9ecaffff567ef61349232effdc041efc44c5fac65fd6df16ec4f198af7
SSDEEP 192:InqMUShKQjNL8w0XaVHgFGMZkcuemLGvN+CwN:a10PoEuL0NbwN
TLSH
T1D6D18E1AB4881C47ED90A2BD01D54EE2D37B2D1852BB48CD22543529CC7E3C936CDEE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 12KB
SHA256 c02ff1c2a4395409b709736ff41cebbeff11d91276460d35363a725034a87e61
MD5 1241ee4f7635f3e2391903f3c9d06c37
SHA1 4c0c403a335245cefbe1ddc99c97d049f8b021c7
SHA512 990424e2b5ecf7aa7d989094847ed1de9b7314841388cc58c7b4a38c64547053d181132384d5306fa517d702d372f1b5ea3c21d31e40a91a9d712f5112692592
SSDEEP 192:JnqMUKA0Q9PVoSS90hw2JrX+VSgAJhMZgI2mJUXSZ+dUcG23st1Kz7lrSqMSedxj:R1Q0QxS90hZJxRpmZyUcG8qKvBSqMDj
TLSH
T1B542AF63A1547856C590726501D70F7067BE28A78BE7C04DE7203B1C88BDBC677AB6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 15KB
SHA256 85b1404a48100b5075a0285c9000ed4f670a0dcee2a58f8523a34d334e93c971
MD5 914d1b111b5099f7e8b631aeee8863a6
SHA1 2e8c6ad4c167ec8bad07972d629aaad18e61d0c8
SHA512 079506c603c0802b0071bacaf94170c19148d8d3638117bb76b5817be081bbf07886ffd622ed0bfd7e21aecfafa3030f7eeea23d7a220d13c73019e60c857ebd
SSDEEP 384:P1Q0QxS9Xf93U/7SV5Xzmv52eUuP8qKvBSqMrUsC7:N1XloSjXzmke58qKvBSqMrq
TLSH
T10A72C052E2653803C41475B901D71F152BFF14954FE3918AE325372C88BEB4E76AB7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 15KB
SHA256 02ceb8a7a3b0e83aaba9cde708ef43eb5d35771b9d9e6d32ea556b9d71e4037e
MD5 e29ed9951de7094ef0efc4d5324dcf6e
SHA1 4ae52077b2210e185e7ea6f792f13be882eb4658
SHA512 1f5b3bfd9cac59437fbb3efc547da0d2bd2dda5133f077cbe7f5b4befd4c650c865dbe75781e4fac6e5dc382c7f3c4b8c84060878143df1f311467e80f33ab6b
SSDEEP 384:f1Q0QxS95maHrBcwWhtMQCJU1s8qKvBSqMQUsCT:d15mCVcwWht4Jd8qKvBSqMQ+
TLSH
T13072BF52F2643417C41476A900E71F5467FF28921FE38289D3157B2C88EAB4BBAEB774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore.jsonlz4.tmp
Size 16KB
SHA256 a32bb26aafdcb6185f1c8389a7dffc883f4259254fff5c019f3d8338c01299ac
MD5 045ef73f18f00019fbc3939c5ee84c2b
SHA1 2d6521f66f0a1c0bc0d534997cc36a134f389fa7
SHA512 232ca614cc30953e45b3b5bda9d794a76c2fe6b3d69ba2cd5986c6509f997451866124cac8be1d945bc66b038de897319f8c433e00a1bf8a36756095f7940732
SSDEEP 384:px1Q0QxS95maHmxeEmSFl1H16Q18qKvBSqMvSsCu:R15mCHEmSFl1HQy8qKvBSqMv/
TLSH
T1E872C053E2243417C42435A600D75F5427FF28824BF78249D6263F2C88FAB4A76E6778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3951282036IBmDaeghecCa.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\default\https+++www.bing.com\idb\3951282036IBmDaeghecCa.sqlite
Size 48KB
SHA256 6fb9f3fa05ad817c828cbbd5f5a39f48a298d70b22ab40e43d6b9cf297efda58
MD5 50aa83b97753b4a3456aa78032a4d3f0
SHA1 ea6a989df413a162ea78471162fafeb66b497a07
SHA512 6bdc1884861de9834c42e4867368efd828f5b4be441bc82d5ca1b814554c74625b4c783fb6e5d73ee6805ffd80264de65a0581a59ff10aea197e48363d0ae6a4
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEw:Oa16S6CKnqlizbxV+2xVeU7X2B0w
TLSH
T1C2236D8E3F07A511C53AF0B178A08D51BC5E321E07222AD56990DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\default\https+++www.bing.com\ls\usage
Size 12B
SHA256 46bd978f0cf5aa65e6784617c847aadfc39de9e478189f93dbb49af15502d1b9
MD5 245bbb5663efc7097e743751d1b4127c
SHA1 12f461e840814cbeaa2b017188c1d9608a609b55
SHA512 a7cc3cabe16a252d13f2a0c7067c3e6131646617f051d007cc98cd69b8dc673ff184a1343ca27e76cc2e3e5a40e6be00afd989547a314f7e27fbd8b43a06b872
MD5 SHA1 SHA512

Submit Download

Monoxide.exe_Virus_Download.zip.crdownload

Path C:\Users\Admin\Downloads\Monoxide.exe_Virus_Download.zip.crdownload
Size 1.7MB
SHA256 54787b9b859e25b28922714d28cad76b30615cfaaa3b24ed29a1470f9b641293
MD5 429522de2eaca5f9eeccb4b07c96b68e
SHA1 9c02e26029c801cc8dd4ee0e704205c92f9aaf0b
SHA512 4c3f80f46a13a57f6aa4b59de9f679fc3188092f297c2c9322cf9018fa32a0be06437a4e965d9e4a18edf061162ace69fab560fdcbf3ab2c4b8aec909b36e0f3
SSDEEP 49152:ueJAsfV6E0IUQpIzqf9CWIvauvKqDIvnEuen6XE:Hb+oQqf9LevKqDIvnEuen6XE
TLSH
T13C85336614165B07547430A8744B7DF4239FBCBD5EA03C829FAB9D1B20CE6DB1A3A4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Monoxide.xQNfHyiI.zip.part

Path C:\Users\Admin\Downloads\Monoxide.xQNfHyiI.zip.part
Size 200KB
SHA256 0d1c5ead44e729aa9b25547bad1f128759d144b8ecdec25bb28d67d694a5b3e0
MD5 e77bca3013a7cdd34871d734a294d60b
SHA1 697b1f62007b9b9fbe6f1e98aede0e5800a6a6f7
SHA512 d9ff6c0fdc7cc2378b3de99abce734b6248c8c91fe78cd6c68cd5e84c6400beb0c5192eb9aa28fd22f60744e8c26d29fa5b6dad79296a1c84f0d2275a30628e2
SSDEEP 6144:p8ESSodSaIpdhPkHACXrDnBW+VAzZU8DIx:prSdwaItcRngPZ/DIx
TLSH
T131141276C16DAFCCADB70A92C2F9E81B1E98320E1BA1270583DF24378E546C146767D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monoxide.7z

Path C:\Users\Admin\Downloads\monoxide.7z
Size 155KB
SHA256 1ca0e13ca8b3498d058fb52e3438c07a95066cc5757a6b39a34c5e7d20d2f71f
MD5 ca719f094511706a97947940bd3e68b0
SHA1 700cea2f8e55b776ee631153e26c76376fef3e52
SHA512 83bb963264da3e7d942109f0b1b62c6d43cd75a1f322982e44198851d901f694fa2436dcf1aa9298a26208c4fd1742ee0cba43e0b7671d3b5b6aac08846e525b
SSDEEP 3072:MVFvDla6gxCiUGw/+YP3/QxYprQx0XcfGn6RtqNVROFoZm2cb2U6WpHt:MVllSsiUGw2o3/QWpCC6iNnO0cy3WpHt
TLSH
T199F31208A45E7748AE22A3C406DDBEE021B6CF1AC266C5107B7BD36CBF95259C737345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9E9A.tmp

Path C:\Windows\Installer\MSI9E9A.tmp
Size 89KB
SHA256 0503fcf7646daae6e5445d8c5f248384542d2eeab4c7d8ad3cd5a47759759a48
MD5 ee6243df5ea48d929da4790efeea45c9
SHA1 9c21d62d7ffca1c68e615eb57bcd5d4ad3d090db
SHA512 283c6a7bf2bc0b3c2dced9ea7c763c71b6d68c57da6845985f8faaa9cb7649d945a3be2127bbc1e77be792f925e14cff191c9d6bdf821635d438f985feb7753f
SSDEEP 1536:Rs6BSaiYZ86YDdzTsXOyaopL7mvof+86kWl0Ax1txiy7s04XdoYhnUTre:5SaiY66YDpTeHWgG8+2yvoXaYhnqre
TLSH
T173935B1A23E400BDE5A39774C8F64E55EB76B8063735838E0760465A4F73B92AC7A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA860.tmp

Path C:\Windows\Installer\MSIA860.tmp
Size 81KB
SHA256 4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621
MD5 fccdc45ca17e5180b40efc28052bac39
SHA1 cecb5a7e8807e619956183897a64930ce56294d6
SHA512 67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce
SSDEEP 1536:gkgmLbYQ861W0EPIIjC5kjGpeSyn7ejhPi/NULSRLnthRQGS:gk1j8yKCe6eb7nlULSRLn5QG
TLSH
T150837D2533A48039D5B61A32B974D2725F3EB8312B70C4CEB7464A6E5E70691BAF7313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5308-1319-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1374-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1341-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1335-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1323-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1322-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1351-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1337-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1338-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1339-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1340-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1342-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1321-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1334-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1343-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1320-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1311-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1309-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1283-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1318-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1359-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1369-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1379-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1394-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1282-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1403-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1402-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1281-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1401-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1393-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1392-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1391-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1390-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1389-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1388-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1387-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1378-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1377-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1376-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1375-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1279-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1336-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1373-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1280-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1278-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1277-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1372-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1275-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1371-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1370-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1352-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1276-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1274-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1358-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1273-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1272-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1271-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1270-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1269-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1357-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1356-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1355-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1354-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/5308-1353-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/9624-11087-0x000000001B490000-0x000000001B49E000-memory.dmp

Download

memory/9624-11093-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Download

memory/9624-11080-0x00000000028C0000-0x00000000028CA000-memory.dmp

Download

memory/9624-11083-0x00000000028C0000-0x00000000028CE000-memory.dmp

Download

memory/9624-11088-0x00000000028C0000-0x00000000028CE000-memory.dmp

Download

memory/9624-11090-0x000000001B480000-0x000000001B49A000-memory.dmp

Download

memory/9624-11089-0x0000000000FE0000-0x0000000000FF8000-memory.dmp

Download

memory/9624-11091-0x000000001BD00000-0x000000001C1CE000-memory.dmp

Download

memory/9624-11078-0x0000000000E30000-0x0000000000E5C000-memory.dmp

Download

memory/9624-11079-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Download

memory/9624-11092-0x000000001C1D0000-0x000000001C4E4000-memory.dmp

Download

memory/9624-11094-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Download

memory/9624-11086-0x000000001B4B0000-0x000000001B4C6000-memory.dmp

Download

memory/9624-11085-0x000000001B7E0000-0x000000001B828000-memory.dmp

Download

memory/9624-11084-0x00000000028C0000-0x00000000028CE000-memory.dmp

Download

memory/9624-11082-0x00000000028C0000-0x00000000028CA000-memory.dmp

Download

memory/9624-11081-0x00000000028C0000-0x00000000028CC000-memory.dmp

Download

memory/9624-11095-0x000000001B890000-0x000000001B938000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads