hxxps://www[.]mediafire[.]com/file/ukig607yp0wl9za/SETUP_ARCHIVE_(PASS_1920)[.]zip/file

Analysis

user interaction
yes
max time kernel
300s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/ukig607yp0wl9za/SETUP_ARCHIVE_(PASS_1920).zip/file
Sample260808-mca1tadn5w

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2100	AutoIt3.exe
5028	AutoIt3.exe
1864	AutoIt3.exe
2392	AutoIt3.exe
4908	AutoIt3.exe
4388	AutoIt3.exe
5088	AutoIt3.exe
4112	AutoIt3.exe
1404	AutoIt3.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 4908	5028	AutoIt3.exe	127
PID 2392 set thread context of 4388	2392	AutoIt3.exe	129
PID 4112 set thread context of 1404	4112	AutoIt3.exe	140

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1788_1130459841\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1788_2140092128\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7016_944553542\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3584	cmd.exe
5372	cmd.exe
4300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2596	chrome.exe
4028	msedge.exe
6564	msedge.exe
5276	msedge.exe
4792	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306579832046704"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{4DD251F6-77D1-47DA-8E40-5F20EF5A2652}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8552A183-54E0-49C6-93FC-08B2921DB88A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9BBC5821-B74A-495B-B027-45D644A85AE3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{0A52A523-1630-4A71-AA7F-517F9A41A56D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1404	WINWORD.EXE
1404	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
7016	msedge.exe
7016	msedge.exe
7016	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2100	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
5088	AutoIt3.exe
5088	AutoIt3.exe
5088	AutoIt3.exe
4112	AutoIt3.exe
4112	AutoIt3.exe
4112	AutoIt3.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
5028	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
2100	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
1864	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
2392	AutoIt3.exe
5088	AutoIt3.exe
5088	AutoIt3.exe
5088	AutoIt3.exe
4112	AutoIt3.exe
4112	AutoIt3.exe
4112	AutoIt3.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
1404	WINWORD.EXE
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe
2000	StartMenuExperienceHost.exe
5280	taskmgr.exe
5280	taskmgr.exe
5280	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 5144	2968	chrome.exe	88
PID 2968 wrote to memory of 2596	2968	chrome.exe	90
PID 2968 wrote to memory of 1004	2968	chrome.exe	91
PID 2968 wrote to memory of 1004	2968	chrome.exe	91
PID 2968 wrote to memory of 4296	2968	chrome.exe	92
PID 2968 wrote to memory of 4296	2968	chrome.exe	92
PID 2968 wrote to memory of 4968	2968	chrome.exe	94
PID 2968 wrote to memory of 4968	2968	chrome.exe	94
PID 2968 wrote to memory of 2492	2968	chrome.exe	95
PID 2968 wrote to memory of 2492	2968	chrome.exe	95
PID 2968 wrote to memory of 2932	2968	chrome.exe	96
PID 2968 wrote to memory of 1096	2968	chrome.exe	99
PID 2968 wrote to memory of 1096	2968	chrome.exe	99
PID 2968 wrote to memory of 2128	2968	chrome.exe	101
PID 2968 wrote to memory of 1000	2968	chrome.exe	102
PID 2968 wrote to memory of 4164	2968	chrome.exe	103
PID 2968 wrote to memory of 3236	2968	chrome.exe	104
PID 2968 wrote to memory of 2464	2968	chrome.exe	105
PID 2968 wrote to memory of 2876	2968	chrome.exe	107
PID 2968 wrote to memory of 2876	2968	chrome.exe	107
PID 2968 wrote to memory of 5904	2968	chrome.exe	108
PID 2968 wrote to memory of 5904	2968	chrome.exe	108
PID 2968 wrote to memory of 4812	2968	chrome.exe	111
PID 2968 wrote to memory of 1980	2968	chrome.exe	112
PID 2968 wrote to memory of 4812	2968	chrome.exe	111
PID 2968 wrote to memory of 1980	2968	chrome.exe	112
PID 2968 wrote to memory of 3776	2968	chrome.exe	113
PID 2968 wrote to memory of 3776	2968	chrome.exe	113
PID 2968 wrote to memory of 2688	2968	chrome.exe	114
PID 2968 wrote to memory of 2688	2968	chrome.exe	114
PID 2968 wrote to memory of 3536	2968	chrome.exe	115
PID 2968 wrote to memory of 3536	2968	chrome.exe	115
PID 2968 wrote to memory of 716	2968	chrome.exe	116
PID 2968 wrote to memory of 716	2968	chrome.exe	116
PID 3192 wrote to memory of 5372	3192	Setup.exe	118
PID 5372 wrote to memory of 2100	5372	cmd.exe	120
PID 5372 wrote to memory of 5028	5372	cmd.exe	121
PID 3636 wrote to memory of 4300	3636	Setup.exe	123
PID 4300 wrote to memory of 1864	4300	cmd.exe	125
PID 4300 wrote to memory of 2392	4300	cmd.exe	126
PID 5028 wrote to memory of 4908	5028	AutoIt3.exe	127
PID 5028 wrote to memory of 4908	5028	AutoIt3.exe	127
PID 5028 wrote to memory of 4908	5028	AutoIt3.exe	127
PID 2392 wrote to memory of 4388	2392	AutoIt3.exe	129
PID 2392 wrote to memory of 4388	2392	AutoIt3.exe	129
PID 2392 wrote to memory of 4388	2392	AutoIt3.exe	129
PID 2968 wrote to memory of 756	2968	chrome.exe	132
PID 5564 wrote to memory of 3584	5564	Setup.exe	136
PID 3584 wrote to memory of 5088	3584	cmd.exe	138
PID 3584 wrote to memory of 4112	3584	cmd.exe	139
PID 4112 wrote to memory of 1404	4112	AutoIt3.exe	140
PID 4112 wrote to memory of 1404	4112	AutoIt3.exe	140
PID 4112 wrote to memory of 1404	4112	AutoIt3.exe	140
PID 2968 wrote to memory of 1280	2968	chrome.exe	141
PID 2968 wrote to memory of 1280	2968	chrome.exe	141
PID 1788 wrote to memory of 5428	1788	msedge.exe	146
PID 1788 wrote to memory of 4036	1788	msedge.exe	147
PID 1788 wrote to memory of 4028	1788	msedge.exe	148
PID 1788 wrote to memory of 4036	1788	msedge.exe	147
PID 1788 wrote to memory of 4036	1788	msedge.exe	147
PID 1788 wrote to memory of 4136	1788	msedge.exe	150
PID 1788 wrote to memory of 4136	1788	msedge.exe	150
PID 1788 wrote to memory of 3856	1788	msedge.exe	156
PID 1788 wrote to memory of 3856	1788	msedge.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/ukig607yp0wl9za/SETUP_ARCHIVE_(PASS_1920).zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbb426c728,0x7ffbb426c734,0x7ffbb426c740
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14650733876731080308,5937463411940309413,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,3779342558743352386,10514974327882123713,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,467282786567674574,13947358233871520587,262144 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,1677735765086360841,14183444576638927521,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,516068985027152797,13561696744585026815,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,7503919288286993064,8130536380088748356,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5548,i,2730794059766384534,4596807086712121848,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3276,i,11332091476427302902,15841246270248575213,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,176352624923145359,13080792247524577987,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,1277087285444750218,17970609966981987070,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,7080547224797701977,6787491468365565021,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,11943855145423086691,11140887886874356479,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6316,i,12382979017976053453,2464031127433888603,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6356,i,14749410530065125640,352913126551790767,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6396,i,12796013660136359515,14005763047679722009,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5072,i,2357590517325281629,6193377691549458833,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6404,i,25316922329379670,475764287485298469,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6376,i,10211869692027145545,14106234086866289776,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6536,i,12276775826741818124,15293048114914327510,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6588,i,7173780550266331277,9051978628881882827,2097152 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5860,i,14648916355137547948,3334205582622403546,262144 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:10
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,6115949012754901953,1794130990573452310,524288 --field-trial-handle=1924,i,10989694285683337025,1236571138603872346,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:14
  2⤵
  PID:1280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5116

C:\Users\Admin\AppData\Local\Temp\7cad96ad-5738-49ab-8696-f2698435a137_SETUP.zip.137\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\7cad96ad-5738-49ab-8696-f2698435a137_SETUP.zip.137\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c md Spy & move /y Inch.exe Spy\AutoIt3.exe & start AutoIt3.exe Drum.a3x & start /w Spy\AutoIt3.exe Spare.a3x
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    AutoIt3.exe Drum.a3x
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spy\AutoIt3.exe
    Spy\AutoIt3.exe Spare.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spy\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spy\AutoIt3.exe
      4⤵
      Executes dropped EXE
      PID:4908

C:\Users\Admin\AppData\Local\Temp\2c3e9826-c3e1-45ca-bda2-8f90386e9846_SETUP.zip.846\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\2c3e9826-c3e1-45ca-bda2-8f90386e9846_SETUP.zip.846\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c md Spy & move /y Inch.exe Spy\AutoIt3.exe & start AutoIt3.exe Drum.a3x & start /w Spy\AutoIt3.exe Spare.a3x
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    AutoIt3.exe Drum.a3x
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Spy\AutoIt3.exe
    Spy\AutoIt3.exe Spare.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Spy\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Spy\AutoIt3.exe
      4⤵
      Executes dropped EXE
      PID:4388

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\SETUP_ARCHIVE_(PASS_1920)\PASS_KEY.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Users\Admin\Downloads\SETUP_ARCHIVE_(PASS_1920)\𝟎𝐏𝐄𝐍_𝐒𝐄𝐓𝐔𝐏\SETUP\Setup.exe
"C:\Users\Admin\Downloads\SETUP_ARCHIVE_(PASS_1920)\𝟎𝐏𝐄𝐍_𝐒𝐄𝐓𝐔𝐏\SETUP\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c md Spy & move /y Inch.exe Spy\AutoIt3.exe & start AutoIt3.exe Drum.a3x & start /w Spy\AutoIt3.exe Spare.a3x
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AutoIt3.exe
    AutoIt3.exe Drum.a3x
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Spy\AutoIt3.exe
    Spy\AutoIt3.exe Spare.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Spy\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Spy\AutoIt3.exe
      4⤵
      Executes dropped EXE
      PID:1404

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=ctfmon.exe CTF Loader"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffba801c188,0x7ffba801c194,0x7ffba801c1a0
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,167860220606937687,12508080283570815413,262144 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3620717222534248366,13877063500487789543,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,17899263746797750974,7648772349302524538,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1110763580949381743,848245764299023962,2097152 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,2380679157195260484,6890426681653943951,2097152 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,11247855241003431265,11398709530057700839,2097152 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,8238916236655646880,5066303996929542378,2097152 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,10134145605018991475,7769912789831220303,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16132931362280575832,6222132367933729407,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,12273710829801246846,1489741878588392739,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12955309594086637087,11852117959984761865,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12955309594086637087,11852117959984761865,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:6788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,13249397912001442488,14291554996751938200,524288 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:7072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6372,i,211556791961039246,17222859108364889659,2097152 --field-trial-handle=2284,i,8115294431882369464,3646558824070504424,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:7096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:6196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x330,0x7ffba801c188,0x7ffba801c194,0x7ffba801c1a0
  2⤵
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,11146147147239665327,6249623318989515765,262144 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,17732860267283880906,17205941121522498778,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,7228640580135424425,16854412571129364662,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,15852552511302816970,778878585703803285,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,15852552511302816970,778878585703803285,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:6780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,14039397173004385732,5445061258714907326,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,7072784405209052706,15495327661766090196,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,16047957650761291386,10092245990989143814,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15239966407256098300,7773058440708649822,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5176840605816029067,9455566650795073694,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:14
  2⤵
  PID:6584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5172,i,2560315863617820969,1360239166094340700,2097152 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5448,i,15241425909465010539,8470621417109100637,2097152 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4442802427180546373,15684065566989890962,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,961761846593320135,17649891899526145414,524288 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6216,i,3847480180227194920,5601103095307283331,2097152 --field-trial-handle=2292,i,5394842903554955552,9666940428385091755,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffba801c188,0x7ffba801c194,0x7ffba801c1a0
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12579362002788721172,14938024565383982549,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,9268357518730090043,3741397705587081658,262144 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5681906839654708032,9926095836519430250,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:13
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16044335967249794047,15206633181132792952,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16044335967249794047,15206633181132792952,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5060,i,13191028198193013486,4933323286403284227,2097152 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5056,i,6055122990668008740,16961742264485859747,2097152 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,8847097091703576774,14509185511635670306,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,121955519895835745,12675827325816591679,524288 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6148,i,9347036550022779355,5993598848167931510,2097152 --field-trial-handle=2264,i,11027610079138402908,12940447027722797924,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffba801c188,0x7ffba801c194,0x7ffba801c1a0
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,7189108432789406130,3304165790333837287,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,10442935288238091850,9444291632849186988,262144 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,9131172966719394539,25918033989636850,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,14668153337698526906,15877304944785953342,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,14668153337698526906,15877304944785953342,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3920,i,9278761543887927654,7991653814967154396,262144 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,12807942538762741593,8517114643405985776,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,11657121051997799133,9258754834260543824,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,4353723864343670901,12366666943539878363,524288 --field-trial-handle=2492,i,4243894884034634812,5978501253578826580,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=AutoIt3.exe AutoIt v3 Script (32 bit)"
1⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=StartMenuExperienceHost.exe Start"
1⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2448

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 6ace74b9b95d8271a1aae59502583c8c5717de461d73c8cbdc36909c137af281
MD5 1708952d18fab32305e2cca590466892
SHA1 f85c6cf31fc1213b66b0f5e13c5eb6720bd6c2a5
SHA512 00f74fc9bad917d54354c0a9663361d2afc8f87728c8db63c433277cee22b5d76e02aa0998550de4790f64d58ddbbf9882bbe37d4e80ef202d61ae876a5a9d5e
TLSH
T18BE0A751A09D50C7CB1D7A7234731C54D0B503B64D132B1AD1DADEA674DB3E16067635
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ce9afb58b1fc1abfebb4c42645c4930556d01e1114dcee6dd1e18776e02538c2
MD5 88429b3738701ee6f5f1c193f606fd94
SHA1 688c4844d29b60d80ba677f8b9acf343d01ae77d
SHA512 05a93a6722c1f63501359c0e976125c715001a57fe5f5fb4e869d3c0c0e8cdb8fb33953b5362d7d2d33ae9edafee9c338f63704eb3fb4e2ce5cba81c4bdee5ac
SSDEEP 192:DLi1tXFD0gJ59J4VYm4upi94VW/CwaJS6o/K:DLi1tXN0gJ59J4VYm4upi94VW/CwaJS+
TLSH
T1B9D18AF3C3E9D53E890156F996146E1BCE1D0A18432D3C26C8D5EE4BE3E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b08260652598375929ffaa1545f182be212bf13ca379279a5c867f6c5060c1ef
MD5 9aa896354195291318bd55115dc17db5
SHA1 03d52f9cfcc4f272f09218cea52fb1014141425a
SHA512 66a396ff9b2bd3772a3827c52c97696addc53774fe198abf7ddbbf56560224e055d98d2a27e9104ad9ff09cb9235119843fde44198834dd3598ee54e0d05c3e7
SSDEEP 192:DLi1tXJ3D0gJ59J4VYm4upi94VW/CwaJCo1PGK:DLi1tXJT0gJ59J4VYm4upi94VW/CwaJv
TLSH
T12FE1AAF3C3E9C53E89015AF996146E1BCE2D0A18432D3C26C8D5EE4BE3E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 de4402dc43058a992d00b119092f05e15084b58ab7058c46845141fe3832526f
MD5 1600d62eebac75c5261090b750af7420
SHA1 b208115f8dd32b557e569facc0a94935687773fd
SHA512 e72be5b0808e3597ebab0796c825bca6945b9221ea8078dede65a1288e83229b2b6828734818a43485a8cb4e1483dc3265f2f933de8671771e2e9b5b12026d3d
SSDEEP 192:dRbWwb4BIv7DvAPRp2yG964Hsb+WNnJPoMw2dbsY/aAbMVyIsnAUgR:dRbWy+UH6X+bwp82JNa2oR
TLSH
T1F632973EB964697BACCBD229FD217B67D7F6102221942E84E7FC952C24E79CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 47750aeebc7ee349191a826c8fbf8c3e0e9159ea89cec0cf38ef31ebe9db139a
MD5 44d138c895513db79f82df60d43a7ad8
SHA1 21912b360b77079087a2dca8e180cfb94a8616b1
SHA512 8ac832916719e17f7f9341545dc5ce918bdeb99625ec7c9c5df324bbb18191060e52324d5d01eb1db2a62be9767b59e01b0157c60cc15290391d07711ca6744b
SSDEEP 192:dRbWwb4BIv7DvOPRpYyG964Hsb+WNnJPoMw2xvbsY/aAYMVyIsnAUgE:dRbWy+UHYXQbwp829NanoE
TLSH
T17742A72EB954697BACC7D229F9617F67D7F6102220942E84E7FC952C24E7ACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 00e77d251155feac5006dcdc91aef3652affccbcef6101880c665fcc74fd9674
MD5 1a9a82366e7b0dc64a37cb07549a715d
SHA1 282a5a5e9e6b3b0bc0fce3baa54b0d1d528abcc1
SHA512 a67f999ee1ad948da62f58f7b21de45a4b4452a6b3a227a5892c4afe5f31985ee9f2ec2885caf334ba4d74a1541ab52eadbad62e40d0e7c64f2a4cafd3cf4f95
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7kWcLSl8h4otop5llpDxB6RopGyv9JT1QDtevJRNC39I5:Ct0LA/TE57giU2BHHU+T1QDtevJuCMJY
TLSH
T1CEC107B0A86DADAB0CB6A891F5437D83CDA8615B6E253E58ADED5F0C00D74DC5383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 99abc5e719c7e9de32b43ca0c32915866e5dcf029ca68114feaaeaf884c2b1d9
MD5 b086b45ea5140c40e215efd66900b271
SHA1 8b56902df424c504aa05636f187b3f8d33e0d258
SHA512 8986613ebed68cffe6619f9281cda0d381fd719960a90d2cd981e6f123285a9ad82ff472c976ae767ec7c6b3f673098447fed5379e506056f25b279868eaa05d
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5llCDxB6/dGyv95Stehbb2Jv4a:gC0LA/TE57cDUDcHUweStehbKl
TLSH
T12BA10971B8A95EB75D79C584F8827E83CF68A157A9226F80D8DD5F0C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e2a72f8ee59ac59da297485ee642dab9bb700dfc0cc653a86feef9371b68b50c
MD5 d5455b34c7809bfb7162acf15cafa83b
SHA1 7e3c9a0d89a61aed6cf01a32b25d0a507c25930d
SHA512 0d36417833e188cdbdaf7a170e7b267669f98ae914c996469e45bd76e1dd73dd8be97e33b7ed6892325b1869351d8d4d30b83184e227662ce756ec0d1723a24e
SSDEEP 96:gC0d+cAOIt5aDVmufj7kWcLSl8h4otop5llpDxB6RopGyv9JtFiO0AuSwgtDtejG:gC0LA/TE57giU2BHHU+tFGSwgtDtejUt
TLSH
T10EC12970B86D6D735DF69990F583BA47CEB4A157AD226E908AED4F0C10D70DC2383A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d267a44e6e6327c3b915788476ed1f9dccb7068496bd2726c854e0b45a42eee1
MD5 caa0844dd8989682a7b87a463ca37dc2
SHA1 e7963ab1035c89dc6ed703fcc31506e60659217b
SHA512 22eaa5fca4bae527754180a94da70844326f30b026a64f3f9ca70f18ae0ff42d6a0a9b3e22b345afdb32bb3480ebc6b49cb8f317907725762af556008597266c
SSDEEP 96:gbJ0d+cAOIt5aDVmufj7kWcLSl8h4otop5llpDxB6RopGyv9JtFiO0AuSwgtDte6:gt0LA/TE57giU2BHHU+tFGSwgtDtejUt
TLSH
T136C13A70B86D6D735DF69990F583BA47CDB4A15BAD226E908AED4F0C10D70DC2383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7211c3d565ef29c99e1b6aca1a2d629bb948a0ea340c163b6e5d15fa68fdb868
MD5 3cf39b7679775f53462c37b3c151ab50
SHA1 bcdc7e7c319429d305579c68b3d85f0651fa7f9c
SHA512 603b4312ec96f79442aadb596256ff24b9a942c66e623e988b635d97683bdbfa2bf264fab0fb118587e8c007e2a15352766dda77e570d1cb5de2c9cfb4b62b27
SSDEEP 96:CbJod+cAOIt5aDVmufj7kWcLSl8h4otop5llpDxB6RopGyv9JT1QDtevJRNC39I5:CtoLA/TE57giU2BHHU+T1QDtevJuCMJY
TLSH
T11AC117B0A46DADBB4CB6A895F0437D83CDA8611BAE253E58ADED5F0C00D34DC5383927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ace0e646883af9e1624d9592609fb468bcd2c99ffdabef332b5138b1f901a367
MD5 3e768b8d5ff2741b65a86532398938a0
SHA1 fc0433083f75f225a0729843b366371f07d6bbc2
SHA512 64656ae497a28b95f84bc30536d15b7820890b0d56ea220b42aa4dcab07a9df3a04ab88ea595040621449664c03feb59424968687aee03cd6be7702a6348e7df
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7kWcLSl8h4otop5llpDxB6RopGyv9JtFiO0AuSwJSDte6:Ct0LA/TE57giU2BHHU+tFGSwJSDtejUt
TLSH
T187C14B70B86D6D735DF69550F583B947CDB4A15BAD216E908AED4F0C10D70DC2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa4b92a3964d86d88c386c550ec70f2d11fdff44aec0d289297bf277d6ca14f
MD5 3b71f5d1732e0be86f36f4fadfa0bbb2
SHA1 06e65f6ed24780ce0c11986385b3bd698d10d5a7
SHA512 a0d00dc6e9d7dadf4249fb94f236c8253228aa361649909591493a7bf370306c1b082f9189d5721129deb63595f4539fd933bc8d3dcf5a711166165950740930
TLSH
T1FAD023F0BC22E3D1C61D003184700600121747213683E3925080740DDDB4040F3FEECF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 734ac6835681cd395999e252ad9c2f158b1d423dc310db49f62775a02e5734b6
MD5 300d4c497075d7b3fe70ec350fb95685
SHA1 6933165946d47e5f67db14678027ad3fbe15be9a
SHA512 e862574014c672b51c1d5fc1a6fd0fa411de49f61e3194e176967f86424dcdafc854a6343216ff7752d489a325461b8ba9e0e3fd9f15d905fb272e9bf493b662
TLSH
T1DED097B0A822A2A1C60D003284700600122646212687E3926080640DDDB4040B2EEECE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75b70bfe773b6848c615c985e24a94bbb6fb1891c7c38f3a7b806bde93df88a3
MD5 49156155eb7717768f6f8b0445615022
SHA1 12f7158f649a31b169d57f53ae427b9a0a074ddc
SHA512 4ffeeef4a9913b487ff25e2584caf57a84f6b43baacb8e2192dd763a0626de24d773e6c519d9cec75b951fbaa7a3a5ba38b2fc55ef48144664893045f01cc94a
TLSH
T197D023707D55FAC9D6451072A5F14740A2154A52B952D3495100F51DDC780C177FFDDF
MD5 SHA1 SHA512 TLSH

Submit Download

21abb21a-49ae-4539-b7ba-8219892b560b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21abb21a-49ae-4539-b7ba-8219892b560b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

40ac782f-9acf-41b8-851e-94c89c25a5aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40ac782f-9acf-41b8-851e-94c89c25a5aa.tmp
Size 30KB
SHA256 57798c895dd06ccb79ee1ba8cfe8da75c6816fabf66791690ecebbc3cda8b669
MD5 81d3a97ea2bf4e66b98ff9b56362a563
SHA1 6f83666a6e37fd8df15b9897ec516deb96b0cb76
SHA512 b6cab91f0e6783a4d6b84017f0474e16a0dcf5938f382b617a12f9ff8a89169494ea7dd32631d258973d498d5463d4b8ace3f5e2cf377b1edf93e3c2b153eb50
SSDEEP 768:wGedUg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLu4YMroSE8V5m:wGedUsE7X6WgoufDMu1jagVYXmw
TLSH
T130E2EB3B680CCB7E4F844EDCEC29BE9B6DE801CB5AD88D5447EA850C03C67EB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4991a15e-6eb2-4806-acac-1d0f4cda3d31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4991a15e-6eb2-4806-acac-1d0f4cda3d31.tmp
Size 414B
SHA256 d19ee5d3356696c25d2fd4ada2be2ca6d6311ed199942a6a6a7eb08f10ff1b81
MD5 a04888e402f2c1b9e354b65716e855fd
SHA1 cb655f012aad7fca380e6c704f0cf35fc597305a
SHA512 c84c8f89e935d49fb4242444e41aac3246cd112724ebf1889e684a5201e790822ecf767ed460022abb7602698c00c2d4c7eb7cf03f0cdf0e49fba416b8cb3cdc
TLSH
T107E02BEDC921EC3B1CFD1B2950500605E78013A61A40850B363DE21C9FB463A0296C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9e6c151f47610376c8f12fe91fb9a7cb0699e5d2dc8ae14803fdbfbde9250a6c
MD5 b51dbaee47ced1f4040ebfcc33a167a1
SHA1 175d2f1c41069b69e613b9bb46510d72563a03f8
SHA512 ed53ddc16f832b66e8ab625bf1b4b7e61448bebf08ab180cac84c461e87b09af76a2181a9c6c6489c82f7cb8439b27ea99e4ce09cb1da051e3ba7f7519db929a
SSDEEP 96:iU/eN2CXk5qT7AMxLQ8KGVv3nY5RoFtELzU8mR:iFN2ak5qTcMx8t23nYRoNR
TLSH
T165B13E7943EA47A3EB3885B219E0905A39F4901785271E817F801FF2B9F7F6E65E0127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 946d31682efd219bbb7ce93fc24992ba6dc616e661c895a2f0e2495e5160cc64
MD5 7769b1e55fe42cd74c1d37fb45fe9829
SHA1 805e650f5d51e5fece9e0289c4ed009f769f911c
SHA512 72a4b102735e0d807919093887824229d3adc0ad1acd0e00b8d621ba391a33ff005d8baac9be135eb295b5572b72288ba8334d32db74b49584eb859f30249bbf
SSDEEP 96:/ONE16FiD2LJvAifpFobDQlgnAGIE2pfHLu7rikuToGKldGAB4OrvK:/ONu6FiD2LWg+CgnAGyCuk3lvJy
TLSH
T11AC1C879A7EA06B3EB3845F215E0845979F8940381271E893E805FF2B8F7F2D64E0167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ad6d3cc94ba67a44c237b896b10bed69a8a4b28ed8fd4452a5f2f3a3c72926a1
MD5 be8040eb28169f32657bac0ed28db372
SHA1 7a3f950070f33324095ca06b9236e28424582b13
SHA512 f2dcbda3efed8c2734368c1c2d420feba690092a084f575409d97e882d2d6b68e24df1f0e4302f506f292472d0d49dd879a95caa0a70609527bd7f204f13b23a
SSDEEP 96:oj0OKSgQNQ6b9oYp77kyVBeccps3q7EefDyk+LGcA2Sl0K4s/f:ojlNQ6mYpXecT3q7pWk+KISn4Cf
TLSH
T147C10D7997AA2293EBB841F244E0485AB9F5942385631E943DC01FF1B8F7F2D64E4027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5c6837.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c6837.TMP
Size 3KB
SHA256 2aab26fdcb62b507d40694c6b29f3b26870f5e46a311435649785294597dd2d8
MD5 bc1b744c8b3d5edf69b336a1d07d43b9
SHA1 eaa26f15430c08dd0e9b7597735fdcd7e5fde5da
SHA512 07539bfde1a9aeb8a8153de34eb94726872d7e3b7c185e6f5c7fa963505900b51bc3089e1d6f328bf42ba214a98be436f6e479c4ce7ae150d14eb6a206f3666d
TLSH
T1A46160BE432D05E2FB2845F249E1945939F4C05706271ED17C801FF294F6F2A75E1153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c6645d11fa7d5c22adae2d5fdb038287fce01b8e2d787010e06ccfedec5e1dfc
MD5 66291824106a0d4ee6b46a3d9190c50e
SHA1 d69dc993d8134bbb062f12df38b399eff67505ff
SHA512 4390ce2413b9e704fb07b2fdb0357406e157c2d98120569c28c595583bf8c43779c14ea309d54da5500f6e093146774e63d7e839b8ed4c653136a4bbf3a265f0
TLSH
T1BA819FF3C3E8862DC91156F09A187F1BCE1D0959832C3C5AC5D4AF1BA3E6471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b86dc6a4128004d1f6e1fb180d8890d9342e4b5c65a572ab6457e28227fd7a89
MD5 61b0268ae5224fe4aa8595a28dbbc17d
SHA1 223fc1a2d27d05fa85ef8a0ebed6a17165d672be
SHA512 d97fff82af4fc4c3e65873ac0b59256b510eecac5e7595aa4713bfde7e5061439561e3c345134093005aa09349b17e5e4fc5816b695f6576b9b24f3cd89f00ce
SSDEEP 48:YALlNoOfRJQC8eC80KC8bgyuPC8BAsJbaCZs4zEsRCAslQzsYfoKsJgmgwEslOf1:D2OQQ2K1IHpaEzlMqGiwolzEuveR4
TLSH
T1E891AEF3C3E8822DC81152F0AA187E1BCE1D0959832C3D5AC5D4EF1BA3E6471E181A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b67975cfcfeda5bdd70f19c8cfc6d2d8754803c74c0fbf9e2d209899b96243a7
MD5 c19d67991d620b820536f04a476add35
SHA1 f6d08104d0381b766d890af12dd9eb8bc5a94030
SHA512 6e59cab9fb7e584ca2bbc1e8e3b630b21910fd1a94f65ecc52923737143e94bc57247afec9f26ee8428c4ca9d207726a5f585edf7fbc5aa686fe4430f5b03e9e
SSDEEP 48:YALlNoOfRJQC8eC80KC8bgyuPC8BAsJbaCZs4zEsRCAslQzsYfoKsJgmgCNwEsKj:D2OQQ2K1IHpaEzlMqGiIw0fhzEox
TLSH
T15691B0F3C7E8822EC91156F09A187F1BCE1D0959832C3D5AC5D4EF1BA3E6471E181A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 b44bf364c90c14d3e2e530dca44b1d572a75f9c91e64989d8aab790c3683f60e
MD5 33c92eb54326a0843bcb976ebffcbe13
SHA1 8c20c62aa29e981176e95f3ef3c9463e34a0bd94
SHA512 8f49ac859e5b5124b9d8b5cb617dcc10465184ce9790d7a2e894462f8b9593c16f72a30d2c8cf26974017aa295ae813518b9a61075be40a5f398f47d105c6e90
TLSH
T1BB01F7E3C07FB467203999BF1E89F8895D79943A51C254F0DBAB817EB0890F75E1603A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 dbf253b77d4593c7adbe4bc1821e77ad106d29c190d3e4c410a47f037125c24f
MD5 6f4e624bebbef375bad99d1c04514539
SHA1 cb528a74491520fa04d074aa8e6b4aeaaf196ba4
SHA512 8185339151ad84481f8725ce4c0fa4a5d3e9b823834dc2d2e23929e000a9447b6ae116c20f593227c06ac3822e442327ba4a971affad4f1513b64a7cace31f00
TLSH
T16A017BE7807FB43760699D7F2E84B841AD7A9439418154F0DBAB823CA0C60B74A0603B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3314adb977c37f5b528c33862df18bf2259b0b0d1085b6929317fd9a847315af
MD5 758b048442cd0184094fbedc57bb9553
SHA1 25534e5e8db1f651904399db6266a996cac824ba
SHA512 fd69a590d9efd091ed0a2a050d23b2f6e8a02f58c88bb8d1606d51039e640b0aa9246d03b8e0706a623b72ea5a66fe05327f1d6037c745892a30d3f62fb4b9ef
SSDEEP 384:sxRGge2om11/fhsSWvR6XCgd/55W8/JtP1Tnc:sCgMm11/fdYR67/5ZDPBc
TLSH
T1A282D815A9249D7BCCCBD20DFA617F53D7F8152399901E48AAFCCA1C00EA6ED221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 174e811cdf2d0406961ff4d3f90b62ff1c08f3cd814e51064a19c5a23b4928f9
MD5 1028b1403baf92f0f364fee13341c330
SHA1 beb0b27f0dcbc4770eca3c0743b0e29dbd3a5fd1
SHA512 4fb8c3d08329b5d7dec10f8e4d245e7d9e02f29acbb4362e646e1e2af2df5a7fd95d5876622f0c8d9613e01072c42a40a1b81c5e51ff46f6a0d31062a67c30f1
SSDEEP 384:sxRPgeHqm11/fhsUWvRUVssN/5oEefe2k2BDnc:sLgZm11/f3YRUx/5oEYFk2dc
TLSH
T19582D816A934997B8CDBD219F9657F63C7F8152399900F58AAFCC91C00EB6EC2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 774462025e8742f69f6fb834d1e17793239b35853eb1ad9840df64ef508bc381
MD5 28e7380cb4416d5bcb9ba4f621bb6568
SHA1 6445e55e147133b64d3f9592f124db74ad049cbd
SHA512 b658d84c8c9e5fa673d1abf5e3d262018ba11541a67c57ba55d7ff318f151c9879f21bf57cc412b6149a1976b9b5f0dd6610d671fb41a310ba9b83dbc636b085
SSDEEP 384:sxRPge2om11/fhsUWvRUVsnCgd/55W8/JtPPDnc:sLgMm11/f3YRU8/5ZDPrc
TLSH
T15982D805A924997B8CDBD209FE657F53D7F8152399901F58AAFCCA1C00EB6ED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b899897a47cebfdeac9b8ea57d0f92fd1460e337c19ff1637f128663ff4a277a
MD5 819cc4a62b84c92a4aa53baf94f889a0
SHA1 083672e602e67039f89b133f4b390e6118f3fe6d
SHA512 f48329901a99b1f133cd73981c60ec49a9dbcdf8f943e6edb313256bc403286a6bd7d9ad31d8d94b8247ccc591122db526496950db1e514059924349e82cd39a
SSDEEP 384:sxRPgeoWm11/fhs3WvRK0s1In/5dZZeVA2BBKnc:sLgUm11/f0YRK0H/5hOA2Boc
TLSH
T13492E905A924997B8CDBD619FD617F63D7F8152395904F58AAFCCA1C00EB6EC2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fd5d62a2ec714a6fe7660d9a33eec4abc49898218e5f5f2aceb1353540fe565c
MD5 77b6a89b65da89561118f126f34cb143
SHA1 62a23435cee5d9f6f0ecc5db4cce19984005c727
SHA512 5a9af6e338848f865243cfa55858f79b06e26f358eeb68d815a6fa32259ceed0b2252411de2910854e63c0aa2c79385272f4d0c63a8d8e7aab16d2a5c0bf834e
TLSH
T1A2E020B0D6C4C63A5804A4C7CB78B70F82F07C46D7C53BC36F08A4407141104B67B5A4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5a42b9268479d9b97a89a990a6861b6777aa2113c6dd24e0a53af6b1f839183b
MD5 2b1de1c81ec416a71e8e4f9f4fa67f90
SHA1 58e087c8b48346f890fccc8f85c2af7c11d1b4df
SHA512 a1c677a4870b12448d2fbbdb3fd2ab3e43d65ce938c5ab97414ced941d3dfdfb3533611c307751199d0186828cb17c0cb73ed5eed4157ecd825d6221c5ea1e04
SSDEEP 96:KR4H4Q414x4H4F414ZW4B4u40g454ZK44wg434Zc4/43424p414qH4L4U4R4l4TR:COjyuIQAhQVuu+zgsFGONcOHH2r6WwY6
TLSH
T169911843743A12403C7DA6188179CC3EB2C178663119796B7BAD51AB0F6AF078DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 94a453cba1cff121f201ca6db4566fb42a130d88a332a73d4a12168444820e83
MD5 a476e05559b1e3e74a1dece4fbb61cd7
SHA1 e2f52bcf51d62ed010e4dc70dd3db92cd0972249
SHA512 ea2b721c665e4b230f55187451130c25d3f7932cb5c7b6bfaa47bb271e499fc3b8792a7db79456e7867cd38959d60cf83749cfdd443c574b6b491bf130a39f5a
SSDEEP 384:nzQZcIp8NrRwdttX2qVNzJDZNfNoXOVSUUey0mETRzcoXfK86sfxEZxxsIj4lNQi:zupVRXfXDZIO08hNzc4ReyIsTQRU
TLSH
T138E2BF31AC758D27ACFAA646F5473292AEF4613B81D81E94DAEDAF0C09472DD071F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5fd8c1004a0b8c51a48b331fde6fb5cfbf68480b8f71bbe1a4c315817811f6b6
MD5 d3e57234abb6731059158600eae9b5c2
SHA1 cf76b98d19024071b135fe1a9242862ecc913125
SHA512 d7b077f6adafdce1693b0c9411a3a8ff3a4aa41b60396268efc55dcbfe81ec7c1b0deeec51076ff359d1d4f8de34f6a8972061feb97b27c82371e451aa22323f
SSDEEP 384:nvZcIt38NOgwdttX2LrNzJDZNfNoXOVSUUey0tETRzcoXfK86sfxEZxxsIj4lKzi:nt3RRX8XDZIO08eNzc4ReyIsMzRU
TLSH
T156E2AF32EC659D27ECFA9646F90736526EF4512BC1D82E948ADD6F0C46872DD031BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 549acfb22a61e5c6e7787775902408b4d9cd34c3f82fac83fc0ce76336b70434
MD5 b11d01dd3d36d438ebde5d12b4712e76
SHA1 e252c7e24e9c42ed04a41495ac5832c3fb1a846b
SHA512 36e87d1a68ce941ca7d4f406455c778005928fc083d3e720af4fb37ae45f4d1cb9307803e7d1f73edf4cfa1b1a5697b281bd8c4c9a9d9a580331d051696b94f6
SSDEEP 384:nrZcIn8NOtwdttX2wVNzJDZNfNoXOVSUUey0PETRzcoXfK86sfxEZxxsIj4lKvNW:zn6RXTXDZIO08MNzc4ReyIsMIik9ghRU
TLSH
T1DE037C3CAC244D7F98FEBB0AB50E35625DB8023BC1B85968E7E90B0CC53659DF756812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 07dde24f90fbf3b136296b0de31e6a0ddc87a4291aeb51b6b150923ebd1a3de7
MD5 eee31a4351fd05e36f90edaa2baf5180
SHA1 0f8f5385db9394f065729caf6b0eb473db14c0ce
SHA512 293d9895306762da6107b9e4d165e7640a43d04bb8a8d98eba976aa1038c46cb0d0c40b61eaabf091047504cc4289213021d44cb256f229f01731bdd2e09f84c
SSDEEP 768:xrv+4UNbdW3XRXrXDZIO083Nzc4ReyIsPpTcb271:xbsbQ3lrtc44bsxTu271
TLSH
T177139C3DAC24897F9CAE7749710E39222DB8023BC1B84998E7D91B0CD53B49DF74B952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39117a0b6bc1857e58d0cf4271c93c534080cd34b57817baf8af2092363cfa85
MD5 e54e2e9edcfd18de1e32f8c89cce149c
SHA1 fc052e20fc4ed93f8c1671c969db430a5d9b1477
SHA512 4d8e6a1919d329082f19451f5a078414566a12542109a1e97935d7fd8854a2d80821a110e1e46e5b33b38bbcab3b059b716d741d19db81fc61b8db528774436c
SSDEEP 768:6rv+4UNbds3BKDZIO0QNzc4ReyIsXweVH1S5D:6bsbS30tc44bsgEH1Y
TLSH
T14C03CF33E8688977ACF6A785B54B76533EF8512B82D81E94C5DE2F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 58fb5265023870e551ecbd0cc3f5bea5c43a94c4bd1a78deb307decafb78f07a
MD5 22ac6e68468b5cc52d0cf4071f71045e
SHA1 275e2d10a297a588694d3dcb6031d15429c3e17e
SHA512 ebb91309c93c7163899190a70e2fef2f8eafc09880016463177daf29c391048feba2bfeb09fa13720302a83cec2d4ac99d4e1ce33466dc5fff2ecc79051d5252
SSDEEP 384:ngZcIp8NxswdttX2qiNzJDZNfNoXOVSUUey0tETRzcoXfK86sfxEZxxsIj4l7GNk:epORX8XDZIO08eNzc4ReyIsNR1k9gQRU
TLSH
T18E037C3DAC208D3F9CAEB749750E35621DB8423BC1B859A8E7EC1B0CC53659DF716812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

b2d1b999-6f6e-4e8d-bcc1-104edf0462b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b2d1b999-6f6e-4e8d-bcc1-104edf0462b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Drum.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Drum.a3x
Size 1.0MB
SHA256 60ec751cd8d6750bd2a4b90c5bd23fd4dfb7b02be15f5f943f181dfd970f329c
MD5 a704d431a636ee73fbeba255b8bf2e0f
SHA1 bd6546461db6274afaf31d7dde88c6d58cf9206d
SHA512 d292403b16b078e1b28462a866495bde9c8cc57d8781a594f1c0da89dd3c1228c3a79b5a596eec08d68f6a52c577d443384a7a64483ff2628b05d477c0565462
SSDEEP 24576:CKxrnVM/a0J+i+B0ss8FbJ4ip5eZwecRlYifReHdv0VZamK:CKxOTFC0s9BJ/UpcRlpRWv0k
TLSH
T1463533E3409758D5342F8C4C756D568EACEBEA6FAEB0109F292F064885045F1B875ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inch.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Inch.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spare.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spare.a3x
Size 1.4MB
SHA256 90e3f46fe151d3618356fe78ba62267a2a5bc81f9be04dbb8984d441950b5917
MD5 9d815b1fc0446f0b7c2d4708e55e615f
SHA1 089bfbb35d2f46bb8d9a78886f8c5c1421af787b
SHA512 1bba108f4366e705a39da23d4fc1c1df221a5bff5eabc297a080aea78c9babed7eec255a7f32a810cb8fc450eb86c7a761987ce45ad7e88ed3043392e9535d80
SSDEEP 24576:OuAYxFvSGlay0KTp/Bxl64GdipDTZilr7Ow4ZKTwEfcugZ59WFurbycKUqJFQz:OuAaSSakb1GduTZ47Ow4roFYKBa
TLSH
T15E65330371D92362F97B91FB7095317F489BDAA57C08432926D81CB1A7982E717F0E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc638299-6a84-4acb-8603-837230737a93.tmp

Path C:\Users\Admin\AppData\Local\Temp\bc638299-6a84-4acb-8603-837230737a93.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7016_1255504910\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7016_1304188380\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 334B
SHA256 8c5bc5d97e83f8808901640436afc450e5cedcac635e13f348eaa22010560166
MD5 c6f6510b753544b3e8a28f5a30cf223f
SHA1 a67cd5daa28032972742ba27d43ae245abb38fcc
SHA512 6977cc83930bbe30c88d52e15f98666522bc9bd810de9740a7bc10e769327dfc33123ab686b88c3e8274899f71b5bc800b47835b05167a8dd6d2e5e51dac10a7
TLSH
T1EEE0469BBB18F7F243BD816C39794CD0ABF20C04EB8C002140CC6C962C30BC3224B149
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 0509bf891b6d77195d090a12fc2e660f04a7048ad8c60830c911bf7bdd263d66
MD5 f7d024408226c89fca57d9b61a9daddc
SHA1 b01c2b8459d291bd3e3d7d4c5908b0175568a328
SHA512 8f56a1bac307a85df132497c5cd0617fb0c1cf898e18133cd6a1c4115ede17ba51b355e6e0fb41876a537216a6e30ae75e496d80bcec7870257829fb00737088
TLSH
T1B351E9065AAF2F4FF0910333572A5768D3717C03F6919B0D958C232BBEB0EA04E4DA1A
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 2f3debf95979b72d54aad94a7c91c4eb38d6de98b06eae60a80397271eaa8533
MD5 ecd3b816d94dc4ae8e6ea3ca54abca42
SHA1 3fe5755e990a53b7df863317bf411fd0829cb4c7
SHA512 dae24cb54c080aa456aa16c9e116340544a59e2e10e8a26719a2630a3e2ddddd6b9b49001b38bac832a7bdabe757bbc313e79cbd7084b0a29ddebdaf8fe6e718
TLSH
T17661ED055EAF2F5FF0514333572A5718D3307943F6819B4D958D232BAE70EA04E8DA2B
MD5 SHA1 SHA512 TLSH

Submit Download

SETUP_ARCHIVE_(PASS_1920).zip

Path C:\Users\Admin\Downloads\SETUP_ARCHIVE_(PASS_1920).zip
Size 3.4MB
SHA256 3512c4ec1768d8fa8c391619ac77cae40bfd0c1de455ba6a81eb04b7e8b86c96
MD5 28f6aa533e0a2dc00592edf742d29c37
SHA1 77d411e9fdcb69efa1b7bf5d949d35a8d6eb7a5a
SHA512 57c530b27251b4ddd9349f51ae6d8f457787c68f55499a82434d84e629e3fad231e8c7b2d80489dc9f1a6ea255e01f69185c8040919fc86154109c08316bfb13
SSDEEP 49152:mPQ6Ap/rkYiA8lV1CpfwLfo4cNkq2iUSW4r9arJ4nrxn0i7Z33EWN/bCRA5JNe9n:UtAlbiACS+fo4WYSrx0kEwXW+/3dq
TLSH
T1C0F533B5D036542AEA2FF25A8DD85352FC81F5307D900FB479F74E34D6108B4A4AEEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-399-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-446-0x00000188D55A0000-0x00000188D5677000-memory.dmp

Download

memory/1404-328-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-329-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-327-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-326-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-330-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-331-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/1404-332-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/1404-397-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-400-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1404-398-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/1864-309-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-315-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-317-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-318-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-313-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-312-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-310-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-316-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-314-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-308-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-311-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-307-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/1864-306-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-284-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-285-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-279-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-276-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Download

memory/2100-293-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-290-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-295-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-291-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-296-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-289-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-294-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-292-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-288-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-286-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2100-287-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/2392-275-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/4112-423-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/4388-324-0x0000019C23240000-0x0000019C23317000-memory.dmp

Download

memory/4908-298-0x000001D473660000-0x000001D473737000-memory.dmp

Download

memory/4908-319-0x000001D473660000-0x000001D473737000-memory.dmp

Download

memory/5028-239-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/5028-297-0x0000016FF83D0000-0x0000016FF83D1000-memory.dmp

Download

memory/5088-441-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-438-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-440-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-431-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-435-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-439-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-434-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-436-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-437-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-432-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-442-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-443-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5088-433-0x0000000000310000-0x00000000003C3000-memory.dmp

Download

memory/5280-448-0x000001E5A2DF0000-0x000001E5A2DF1000-memory.dmp

Download

memory/5280-454-0x000001E5A2DF0000-0x000001E5A2DF1000-memory.dmp

Download

memory/5280-450-0x000001E5A2DF0000-0x000001E5A2DF1000-memory.dmp

Download

memory/5280-455-0x000001E5A2DF0000-0x000001E5A2DF1000-memory.dmp

Download