hxxp://potscas[.]com

Analysis

user interaction
yes
max time kernel
899s
max time network
903s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://potscas.com
Sample261024-c4p9psht2m

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
948	msedge.exe
4440	chrome.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5435"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5435"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{379D27B1-26F6-4024-885C-590C8DF295A4}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea0709004200680067007900620062007800200076006600200070007900620066007600610074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000904100731a42dd015021cf241b42dd01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070900420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000931ea5611842dd0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{2604FBC1-E03D-42A0-8B1D-2435B764E650}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336234636501975"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8530"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
4196	chrome.exe
4196	chrome.exe
3872	explorer.exe
3872	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe
Token: SeShutdownPrivilege	1080	chrome.exe
Token: SeCreatePagefilePrivilege	1080	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
1080	chrome.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe
3872	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3872	explorer.exe
3500	SearchHost.exe
3020	StartMenuExperienceHost.exe
3872	explorer.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3252	2080	msedge.exe	82
PID 2080 wrote to memory of 948	2080	msedge.exe	83
PID 2080 wrote to memory of 800	2080	msedge.exe	84
PID 2080 wrote to memory of 800	2080	msedge.exe	84
PID 2080 wrote to memory of 800	2080	msedge.exe	84
PID 2080 wrote to memory of 4412	2080	msedge.exe	85
PID 2080 wrote to memory of 4412	2080	msedge.exe	85
PID 2080 wrote to memory of 1900	2080	msedge.exe	87
PID 2080 wrote to memory of 1900	2080	msedge.exe	87
PID 2080 wrote to memory of 1900	2080	msedge.exe	87
PID 2080 wrote to memory of 4684	2080	msedge.exe	88
PID 2080 wrote to memory of 4684	2080	msedge.exe	88
PID 2080 wrote to memory of 4684	2080	msedge.exe	88
PID 2080 wrote to memory of 4648	2080	msedge.exe	90
PID 2080 wrote to memory of 4648	2080	msedge.exe	90
PID 2080 wrote to memory of 4648	2080	msedge.exe	90
PID 2080 wrote to memory of 4044	2080	msedge.exe	91
PID 2080 wrote to memory of 3784	2080	msedge.exe	92
PID 2080 wrote to memory of 3528	2080	msedge.exe	93
PID 2080 wrote to memory of 4044	2080	msedge.exe	91
PID 2080 wrote to memory of 4044	2080	msedge.exe	91
PID 2080 wrote to memory of 3784	2080	msedge.exe	92
PID 2080 wrote to memory of 3784	2080	msedge.exe	92
PID 2080 wrote to memory of 3528	2080	msedge.exe	93
PID 2080 wrote to memory of 3528	2080	msedge.exe	93
PID 2080 wrote to memory of 2696	2080	msedge.exe	94
PID 2080 wrote to memory of 2696	2080	msedge.exe	94
PID 2080 wrote to memory of 2696	2080	msedge.exe	94
PID 2080 wrote to memory of 3652	2080	msedge.exe	97
PID 2080 wrote to memory of 3652	2080	msedge.exe	97
PID 2080 wrote to memory of 1200	2080	msedge.exe	98
PID 2080 wrote to memory of 1200	2080	msedge.exe	98
PID 2080 wrote to memory of 2448	2080	msedge.exe	99
PID 2080 wrote to memory of 2136	2080	msedge.exe	101
PID 2448 wrote to memory of 132	2448	msedge.exe	102
PID 1080 wrote to memory of 1628	1080	chrome.exe	104
PID 1080 wrote to memory of 4440	1080	chrome.exe	105
PID 1080 wrote to memory of 4928	1080	chrome.exe	106
PID 1080 wrote to memory of 4928	1080	chrome.exe	106
PID 1080 wrote to memory of 4752	1080	chrome.exe	107
PID 1080 wrote to memory of 4752	1080	chrome.exe	107
PID 1080 wrote to memory of 4524	1080	chrome.exe	108
PID 1080 wrote to memory of 5116	1080	chrome.exe	109
PID 1080 wrote to memory of 4524	1080	chrome.exe	108
PID 1080 wrote to memory of 5116	1080	chrome.exe	109
PID 1080 wrote to memory of 2912	1080	chrome.exe	110
PID 1080 wrote to memory of 2912	1080	chrome.exe	110
PID 1080 wrote to memory of 4964	1080	chrome.exe	112
PID 1080 wrote to memory of 4964	1080	chrome.exe	112
PID 1080 wrote to memory of 3572	1080	chrome.exe	113
PID 1080 wrote to memory of 2004	1080	chrome.exe	115
PID 1080 wrote to memory of 2004	1080	chrome.exe	115
PID 1080 wrote to memory of 4916	1080	chrome.exe	116
PID 1080 wrote to memory of 4916	1080	chrome.exe	116
PID 1080 wrote to memory of 1964	1080	chrome.exe	117
PID 1080 wrote to memory of 4288	1080	chrome.exe	118
PID 1080 wrote to memory of 3104	1080	chrome.exe	119
PID 1080 wrote to memory of 4196	1080	chrome.exe	120
PID 1080 wrote to memory of 788	1080	chrome.exe	121
PID 1080 wrote to memory of 788	1080	chrome.exe	121
PID 1080 wrote to memory of 1800	1080	chrome.exe	122
PID 1080 wrote to memory of 1800	1080	chrome.exe	122
PID 4588 wrote to memory of 3872	4588	sihost.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://potscas.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffd44ffc188,0x7ffd44ffc194,0x7ffd44ffc1a0
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,6104033616247480571,2487503981469892636,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,2421833784490736657,13862269266059000967,262144 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,15205994237677851285,5605807061205361333,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9472094482761367397,14185666320137341039,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,10048880070187270891,9731726145488285302,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4458191600420061203,4972339937766939987,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,17541106424373969823,5345199320059379289,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,2980010239887757222,10869934393786009035,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,12342254178203260645,3574220698726625992,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:9
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4848,i,1663548214748378222,8356619207520518842,2097152 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11027494576097095290,2726856524104492883,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,10600272976244563284,10280438663569748975,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7962820889499021783,15929775133198624468,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15288892292371086894,18195354978529620317,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15288892292371086894,18195354978529620317,524288 --field-trial-handle=2156,i,17129873853701009669,17294246498956472666,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd44a8c728,0x7ffd44a8c734,0x7ffd44a8c740
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,15541661561226833890,14848117285872424369,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,4819295177361605900,8547803720058609687,262144 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5106318920420920240,10106783799058065230,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,6783686336528654322,12461108569627791306,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,7229689655590558038,16310205568113091567,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,12482543112672955404,17687472813027941359,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,15306896400530439403,1911109417316423486,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,1315799115086769980,4117700523941139598,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,3673292547774256417,15105445758483541806,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5932,i,2606068394336531042,12808315616236579111,2097152 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,11481676940851126802,2160758752828727681,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,3675357651946716450,12760709240330638956,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3544 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,6531754243734927383,4739146228575636003,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3556,i,8465630155927134941,4381392551376817453,262144 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3488 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,18110300250209591523,15987925619161950445,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3568 /prefetch:12
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,4679922027300183015,4079754432371038341,524288 --field-trial-handle=1992,i,4704083276027802253,7171497578211299583,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=872 /prefetch:14
  2⤵
  PID:1800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4028

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3872

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

102f5289-14e2-4985-b757-28b7b625b51a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\102f5289-14e2-4985-b757-28b7b625b51a.tmp
Size 130KB
SHA256 b4b3d23bf4db389237bfd6c0c981b5968f9c273233b4116e05e2f373bae4e6e1
MD5 f0674380e3fa89c851a09284b36dc5ec
SHA1 6b8010e74f747838c15173dc78ce3066583ceac1
SHA512 d37b36930fd6fa72ba06fb59e219c63941e64deb4d11b07065517d85bb37558bb35c92eda9e155ca1f99278d7ee4551897e751ec15fb1727220a44ed217e6994
SSDEEP 3072:RTH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:RBt4fLJ0L6nGJxi3bzqapJja
TLSH
T110D312F1D1E06C7ACBF7EE4045796E908E71D5C689C9BE2409FD881816CEA344A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2862b7e7-cc2c-4089-a40e-fa9a7214dad5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2862b7e7-cc2c-4089-a40e-fa9a7214dad5.tmp
Size 269KB
SHA256 1014881721298ee8c7bb8f738e0d0e49554d95bccf080349e46975612045994a
MD5 1005fdf843fe3e8d79775ee9bc5138d2
SHA1 172a77b3758dc4b9043901943faaa86cf8a46e79
SHA512 5fc713f4afbbea23411055b85d3df168a3e976ec53ebb91c01382125e065bc2b92fca0a8f097a004499affa7e1a7c52f8a2cdf495b3454838a1d8f438ce1deff
SSDEEP 6144:PeWY0fjg4IO2RfjGC83LGJpmJt4fLJ0L6nGJxi3bzqapJjN:zfjPjC5JpmWXUx8zvpJ5
TLSH
T1314423F291B47C36CFE79F26526E2E04CEA159D7488DCEA045F8C94A07827758A07F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a3305e3-8e38-44c1-8661-94972f6545ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a3305e3-8e38-44c1-8661-94972f6545ab.tmp
Size 270KB
SHA256 0bed69f1dda52f1f1877064a85870f9aeb79a00054791c27fbf06e5fa33cd5eb
MD5 dd36d0ed0b4706dcd6967e30d9e8b07b
SHA1 49086c7bf52e8fff14d16ee984724db4ae51c120
SHA512 4817c7ac4a89e57ed5c2e5ca3ce837c60e43b3b1ed8a784acc1cb78c944b6b6fe1bca29ef353e09cf9726e3be781b107638949ee319134c24955fd957fcc3be5
SSDEEP 6144:7P9WY0fjg4IO2RfjGC83LGJpmJt4fLJ0L6nGJxi3bzqapJjN:4fjPjC5JpmWXUx8zvpJ5
TLSH
T15B4412F294B47C76CFE79F26522A3F04CEA499DB4C4DCEA049F8894606423758A07F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d5807f8-2d72-4296-bf6a-93f6c84f7174.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9d5807f8-2d72-4296-bf6a-93f6c84f7174.tmp
Size 269KB
SHA256 00eab9d1b3ef7a86dcddddfb585b35ddd8e615651acc1ddf143d8a6d9d904572
MD5 318d6b3df4500e53df4df392f24af617
SHA1 9e8b62a967de56a412c3a8397e782e6ef09112f7
SHA512 7617e3a2dfaad38d8de7114a02d7c5c1b49bf589b2a62fef9c7f4972183919942ac7d844347c578f0ad44b3acb6692dc2d0afc53ce353423a10f3ef182e28654
SSDEEP 6144:MeWY0fjg4IO2RfjGC83LGJpmJt4fLJ0L6nGJxi3bzqapJjN:KfjPjC5JpmWXUx8zvpJ5
TLSH
T1B14422F291B47C36CFE79F26526E2E04CEA159D7488DCEA045F8C94A07827758A07F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0087c303-02fc-4b19-9c5b-69c301734843.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0087c303-02fc-4b19-9c5b-69c301734843.tmp
Size 12KB
SHA256 36f5628511576e5f707a242473bf74de544391371bf32563b75ceffb692a1f5b
MD5 cac5c7afe620f7a5c6bd3fb8147f983b
SHA1 da78ddc5ae1a430b7faea68ae02b9ee9ac754739
SHA512 c90ceede3b7b40eaf23b311126c481fa1d21ceb4ee8eb55256a0d7871ad58e4648068817bfc84b8b6cebe2de55227c95a2da6c89896da65d46156f1b3301a75f
SSDEEP 192:wRkicb4AYnQv7BpAPRp2sX92Hsb+WNnq6Xem2wgeIwVyIsnAUgtaJ:wRki+qMdUX1wwLH2X08
TLSH
T1D342D62DAD24753B5CDBD225FD257B53D6F5202620A42F84EAFCC92C15EBADC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

042c91d5-e190-44db-a2c2-64460c2156b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\042c91d5-e190-44db-a2c2-64460c2156b3.tmp
Size 13KB
SHA256 4293d2a0eec6693ced0a3e6ef62ad04a51f9e6e9c2bb675e937fc65e21451207
MD5 1cacfb968808c7cb270a5a0dc4e47c5a
SHA1 353189f5424793a986afe18439c6670715635cb7
SHA512 9f95f88e61810ae0f43e0e92b867024708e5400b84d410ef0390b4a79a4cf72df84305696ffd3206fe514c5aaf9290233c8034fa57df81f92357ed7d7cde0cea
SSDEEP 192:wRkicb4AYnMv7BpAPRp2sX92Hsb+WNnq6Xp1YmgeIo8yIsnAUgraJ:wRki+qYdUX1wwLjYB7e
TLSH
T1DC52C62DAD24793B5CDBD215FD257B53D6F5202620A42F84EAFCC92C15EBADC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e05582f-04b8-4ca9-b693-44bc5505535b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1e05582f-04b8-4ca9-b693-44bc5505535b.tmp
Size 13KB
SHA256 1155c55d3cfae0228bf9721f6793f9beb523c2a0fda210c60b6fa815ad34fd12
MD5 09ceba98f6204b020811b0253648e458
SHA1 542a44c00a1b69049703174eb4b905819a1483ec
SHA512 01b3d0be5cf28e7f735971dfc2e95aa8593e08991dde6df80ac734916b284067723d95ef914e541ecf92ef5f99c159aaab86afd2851fb202b4126edee53938f7
SSDEEP 192:wRkilb4AYn/v7BpjPRpfs792Hsb+WNnq6XCiaVgeIy8yIsnAUgraJ:wRkiJqXdpXKwwL7aw1e
TLSH
T19952E62DAC10793B5CDBD219FD257B93D6F5202221A02F84EAFCC92C15E7ADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61b08d45-e7a1-4b19-a870-6cb4d4250035.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\61b08d45-e7a1-4b19-a870-6cb4d4250035.tmp
Size 13KB
SHA256 7c9d4a5b2716c2fe95a9292b3c8410c76c8ec3c81dbedc996d0f967820a2b5d9
MD5 ab706aabb410433b9e5a472b425abaf2
SHA1 ba19ed8f90286269616018050351be1810433415
SHA512 a3f235ec74f4fa44f8673e61d22f951efd500ba3515b492b49a98041c7997219608831fc58292f71aa7b038fb86108eb523ee8139fb14c95b91df8691b52e1ae
SSDEEP 192:wRkilb4AYnHv7BpjPRpfs792Hsb+WNnq6XGowxgeIy8yIsnAUgraJ:wRkiJqPdpXKwwLXwc1e
TLSH
T1CD52C62AAD24793B5CDBD215F9257B93D2F5202220A42F84EAFCCD2C15EBADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

819b45ad-ccb5-469d-9306-703d05a49bef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\819b45ad-ccb5-469d-9306-703d05a49bef.tmp
Size 13KB
SHA256 b3541b27694a4a8725058a861082cc4b9e168de98d675e212c6906f57063a5bb
MD5 4b02141fb97a021f11045a4ddf28dc23
SHA1 aba79b346361b756ef1ece1ac8744f6b3db88b09
SHA512 52e1ed1bda22a145f7a65162afe5ae5acadadbf56117bfd1c52800ff89dbb478199b4d3594f58e084e76a8799be67be04cd3d06f0c1a823fe7e7700ec0110fe4
SSDEEP 192:wRkicb4AYn7v7BpjPRpfsy92Hsb+WNnq6Xzwe0geIy8yIsnAUgraJ:wRki+qDdpXPwwLceL1e
TLSH
T1D652D62EAD24793B5CDBD219FD257B53D2F5202221A42F84EAFCC92C15EBADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95ec0539-61ba-40da-9446-51c79a4f4b9d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\95ec0539-61ba-40da-9446-51c79a4f4b9d.tmp
Size 13KB
SHA256 7062377be753ea8ba662be4e100c04151f7a09ea522501f93b433f994b305c5b
MD5 cfc9b9922d8b14e78d3758ed442a9926
SHA1 79a9af84afc125a5d9f9d157167a3fb77f86ea0a
SHA512 51ff7e7c1b96d7006c55c1ff9c5d313ee9e93b3c8c73f3e0897ec94e3351a82d86bf0a1e2d5db4302c4e431b1417024a06c254ca77beca2d86edd52676b11062
SSDEEP 192:wRkicb4AYnSv7BpjPRpfsX92Hsb+WNnq6Xp1YGgeIy8yIsnAUgraJ:wRki+q+dpXGwwLjYh1e
TLSH
T1C952D62EAC20793B5CDBD215FD257B53D6F5202620A42F84EAFCC92C25EBADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 72KB
SHA256 8f2b3de0671892a283536414efea90a74a8e454a870d7fd3bb99387ed6f3b6c3
MD5 39490661ef906d37719fb82fce9fc6d0
SHA1 76b6b3400bf6a12cdfe0ee1812965c8bcb84f17a
SHA512 867b5fc9926e267807264612cf2c0f8883d619cc689e3661f14d32c18a935e6e464af3b9d4ccabf3b0dd2c8a62df96fc3c1c9c97e3d140af8a6de2f8cb20a64f
SSDEEP 1536:aNwxCMBXE4P59ciRGtj0i+fz6G7PMfCh9qpPQyidJd5I:aBMBnB9c9gK8EfCh9qpP6dJM
TLSH
T1177302C46E0C03EF60A526F7D7CD713709A8DA597746B90ED98A78C0C65EF0A26484BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 92KB
SHA256 dd6803cecc54b787d0f5d8c47bd780847f75c45a3d6fac87c4ef9011d9fcad25
MD5 d78dae60eab4c299c0b6d54949bbda81
SHA1 d8f4ba9387413f77fd79ae75aebceec68a44e926
SHA512 476bece16aaac8a153ff9da80ff42aec37bb5ee2bc2534c6a6f6d1498914a8c2f22c518aea9d73a72998f82e3449c6c9f89928697efc7b09e688a9433bd0dcd6
SSDEEP 1536:Q9TWYxJZ9G6IgkUWlzzLPqTg68HuBwI8hdKzKQKrCn4RZN3QgFybC5bTj5l:Q9xJqrgkn2E684uyjnGDFtTjD
TLSH
T1B59312A57B96D529D86241BBD02892C5F7FDEC4D970D07A0CEEB522EC78305608C82BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 16KB
SHA256 0c0c6f3b34d6de8db5fff831dc0d07a98073bd5ad9dd437c7614175aa85b241f
MD5 cc3c231258ef5136b0a1e2f33deffac5
SHA1 222829892a2a9873d8572c97b7c67d4bcb33e590
SHA512 e74d4847757521d5c882b5f61f235d486315d24c59d264e58a45f15d48ca252a2b8303c3bd1c00a69fa1c4d6045b6eb7fbadc88631773f42e468dc20b17f467c
SSDEEP 384:z0HVMmq1dxAnsBpZdGXxqrLtCZ7XV1sAqju3VpryEawZaunwJIXcrKAQ:oHVM71dqns50xGI7yjgVpGE/aQerZQ
TLSH
T1F172E14C5B9E606C048CB6597FAAB05C6851C36B8A1CD01BB646772049ED533F652F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 111KB
SHA256 f9641ce2cb227d4f48853eb4b79a4e3005b5a6fa400cb9cb0a3d1646c1223ce8
MD5 9990a2a7bd27d180225e8152aaa04c6a
SHA1 41967a8d590bbfdaf451659bbcb08fdcf49541ae
SHA512 74df8c120e6c4c9cde85102eca8bc3f3b87af8f55f1894834ca28521376459e06a3bafb8fc0ff114e20753ba0314c01204acd8be93b53d921da97c03497b7a8a
SSDEEP 3072:O1LnGMr8ITHOOsmUVYcrRgrifVUWpKofz2wQDuL:oLGMYI6OsmaRgr/CfywE8
TLSH
T1CEB3129AB205A7C34784E3CCC3D35405B64B6273D2F0C65CA936D2B9162EFFE4492927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 71KB
SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
MD5 4b73e2ff3024784eca66d2120a9bcb22
SHA1 2870bcb8ece10145e089262bb6634d18ac85bec6
SHA512 9ebe0b2cc7ed7298d931fc246732ed90881f0252b957afbf14f390c75c1da3fddf1b3fbb00be8d489cbb7b5a18f9dbda17a24e18594d44ebba4b7ca3f50bb10a
SSDEEP 1536:MO6PxhqwEppt5fUo8w4d+X5JlhLzcua67BYePELa:M3qh7VdDf8GPH
TLSH
T1F0630245820BA35EE09D4A79D27481F61FC2CB5C2BBF5C27538289AB5F57DBF6410134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 55KB
SHA256 0c0ec423a091264d8845667f030c390c31f2257c1cf518a7f0ab8279ed8f98c0
MD5 90e385556900428710cd66ef1c139fe3
SHA1 f9bfc927638316f4aa746f325a5f2643095814b1
SHA512 377d07bca395e43b245a9b7cce760ff0156c29fb7c24b7a37cc946345241cc9724cdaeec7b38b2d679c4f3d3473e6fbdea9a6a64bff02ac748c43a9393986e1a
SSDEEP 1536:O2OcO7K1w2U8R4IY9XYSNdSfKNCIfaFAx:fjOV2D4IYj97iOx
TLSH
T1F3430115FA01B231736A34403CB4BCBE6486B75897AE009E9B61AFC857533B4FE60C76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 48KB
SHA256 945a5a2123b127568550250d0eccec85732139d5b8369d10cf2786fe681f0aae
MD5 bb44900e7ba7846fd99ddb711205d3f7
SHA1 34d327bcbf62771763a5638e0ce2e514c51a7f86
SHA512 db68043d0e5bcf920da4af12ae599ea3162d84d96d009971e63e4d0fb555e259f9deb77571a0bc033f45374ced86c739dccbbababcbbb8ece2e86a44a6758985
SSDEEP 1536:JoErMPIb1FT+pjEyzi8AtbIyUllp4Spys:lqIb/N8AtbIyKlpJN
TLSH
T1E123F1BD7BC5E27CCC0A1BBB32D51E8D86309C08DD25AE421765E050EFA92506E5EE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 26KB
SHA256 9f5a93b544d23c9666e51adaa71501a3e917bec210114c5140058bc9d885ee33
MD5 5691d8b1b44ae56537b5b3862804487f
SHA1 d9b854a23171b45b6c3af8faa66cb4452d6072d2
SHA512 e982d3954267915f4e1a8a0c19f51b0a4a0a03f1b1cc09055705ba55f14481caf839fe7c3994ad31d62e894e097344784066ae43d58e1712811dffa1f32c2f2e
SSDEEP 768:jX4hHwudXsYfMhz0PcriJTFsRxF1z0CM+HVfAKZ2b3:D41w4XsYfgQN7SYCh4II
TLSH
T116C2F177814EBBACD88846BDD1030BD5190EDCA4F26E9E30E90579A44603E192D9F77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 38KB
SHA256 41c2b17d1e597115cf8296a2ae3d1a86a428cdf9d0b79df795bbe7c7df391d84
MD5 9d6552c12193fe721883f80d6b185d27
SHA1 88008fa8929d75f75a6e892ee9d2ac506c0d69ef
SHA512 020af584dd5aff0e13492ecea2fdefcfcf52aab2ff216c214d9fcda7b23d97a0cbe2a7f449dafbde45afff9b85410c715df459b7a8b8a4685106e3d69b6366c8
SSDEEP 768:WDr9xbDkieV7XS5GFoJWp8mcaHpOGuF0ERywlfG:WzbD6V7XSoFSWpxP6F0Jwlu
TLSH
T1EF03F124B6112DBDC4DFCDB83DEA6C341C0D3B9E66522F56A2F2C7D4C9194028DEA989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 51KB
SHA256 6471b8e1bb0be5285be8e74c0e5205c7ad8644c002e19881979894bdfdc253a6
MD5 0ddc20350f34080e2d4914c6227ae7eb
SHA1 b5acc8f43a25f66efe1aed522a6161b1f5100ac9
SHA512 0f76a96c7d1c73cac004370995594fda035b1612f23ef2bb7a140154e33c23fee53c15a1a48734530ee1bc56064b26aaea3ebf59ff6e42224a7cec03a98b2e21
SSDEEP 1536:YN2P5sT2M9A3fMlQ9FDDh8dAZQJB1rUnWJ7:YNA5sJneDDKCQJ/UnE
TLSH
T1A733F1CB70B2863EEE4F27A14E6E2476584E5B497D91F15EC01C0B3B819F17CBB82856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 54KB
SHA256 cfb1b5c6cc5e68cd42a4783b1a54b012ab0299553e23f4425efa1cc7f97a24e3
MD5 19e9d70945b3e6f294ba5d1879d3669f
SHA1 93a45f9ebd036a7ba17799cbdbec1a1b3503f1a9
SHA512 3051c61da519ad99d5e8684ff7c7172fd3d3cd2d00a58766a81d88ee65a807638f3ebaf70e6fe351fa147f76dafbd4f0e40cb425ae29969287d3298e0ca60154
SSDEEP 1536:k96wA7P4uMkbK8A8tOCp+Dlr/H92UFE+lroqadJ8esTkUo:k96wApHrrpKTdBFdlrladJ8lTkUo
TLSH
T14143F1C5CCA61600BD387BDA4E423DB3109851E76A2D3B0F47740A5E47EF4AA12FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 58KB
SHA256 574a990123bd97e8a0c7a6d9c1a1dc55e23e9bda00ba65a6bbc669395355d2e6
MD5 5818a4bd4a5034e2508ced43e9c6e3d4
SHA1 ed386aa5a8bd75dde86d0bed05a88a942c34ffe8
SHA512 c07d6472c5f44c4c6820dfa7c006d4e869387f1957a5f8d834192ed7ecaee6b751e4e1eb54d0ee62b7e941ebf4c8687ab0a71aa238847fb89a774b9e2b490331
SSDEEP 1536:2S/KE4krLaLscwaj8YEsFGbvNapVNCiedzRaT:FL48aLsRqUxMheL4
TLSH
T1E7430141B8DED2A3F09A92D9415D8C5BAB3FF9AC4B23FBF025491154964CBC092C43EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032
Size 72KB
SHA256 344071a3c883b37bda21160a1882df2be697ffa8045c93d10f89b3a2713dabb7
MD5 30289ef5ebdc8e426ce4488561dc9d2f
SHA1 e3dc9bc6ab257aa20f3e35b156bc261dbc3258bc
SHA512 1f6c85fc88c35f0d6404e608ba7e063bc9361d79efc1392122765d23e5375b0db1fab31cce7f17756831efae7b323e05f0b1806ce86749df8b906e1517bf2bef
SSDEEP 1536:zv2MHzsMzGgmmk0NoE48r+5zb3ejW2wmRQGDJswOC/T8KNKCsd8KGB3eED5:T5HAMzGdYNG8EzGCg/TpNKFWLB3es5
TLSH
T1417302D3AF64022BF7A998F57E4761180C0508BD7C88BEE4A4D5991FEFD299139CF0A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 74KB
SHA256 ec76e2092835aa919f1f86413703dfb6743b89aba08375bf7b003358ae358736
MD5 7f531fd76a341cc23ebf555221b365f0
SHA1 3ce715c3d12b8b197bf91eef1644b90969557aaf
SHA512 b9cc78f192e75c02b28ab34f139492d7b2ccaa3facc1c873d657b59494903acf43bd0502762b5fb5ab296ec2bab0193914dfc2a87e7095ee9b818c890cbf72eb
SSDEEP 1536:fgHEsWBKkFbHPkIJkvMt2X7TNJqDW0Ubylj+jglnwOG743G9H9AdBlISgg:fgkBBHPVWvXTNYa0Ubkj+k93yAdwg
TLSH
T1E473021A3E9BC240E3A16DE7CB306E6B27D333DA918B648508D52AC8913D76CD93ED54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 52KB
SHA256 c977fb933ae7a448898858959d376b1f9ec68dff5cc2a23539cace00914b5210
MD5 7d993ded140645482be0caa9070143ca
SHA1 7283c2ed5f33469f3e05543bc31bae96e4e6e223
SHA512 017d87f4987af80a6b488099d5137eb218f4ad67fd181893b6929807e4bc2943d59fc50ba9807bab1413f2480232353438a2e6db5cf8716ce02da60d8df418e1
SSDEEP 1536:L6aKLrMVmfIRaANIUAzxf3DINuZZJgt5P83DeztCtGrXv:2y9RhGzpm8JOR83at
TLSH
T18233027B1E1A3B5EC95C9D70D109E43A050F1BC9BF076DE355B70407117AEA188AF692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 65KB
SHA256 5259866451d6e67d7a2741eb51895fd85bfde6a784fe9e65e4ad17a645a14e0c
MD5 8f83bca3a53d9ec69b96a60f4914953f
SHA1 2154887948793dcad22c53d341427a3ddb4a8fc8
SHA512 f266d81908e488e197bf4f5e8995113f4b1bee0eb5b4a1cc521dd94309cb27c6e6ecd8d0c720d6588eeb151f13b525083cbbee6f09f23acdeb5c41526c01625d
SSDEEP 1536:JjjbWA9pz9EB+u0/aEP0uRcmd7/eKxJs6FJo8NfZoJ40:Nbdz9EAhSE8uRvd7/fLFJBFZO
TLSH
T1365312616873882CE6E93B1BC5F33BE3476426D4415A602EF0DF6A03065E0B27D4E5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 60KB
SHA256 870a431e162bf824cce39456d459efd3a67b64a2b1cb290d6526a39bc1fd596f
MD5 f9c8c27a8d9a29cceedfd9b374e5d239
SHA1 681f688923a53b406074bfc4bde478edf55a0617
SHA512 2bc89baae2e1d57a9bd8630f00a4341a144e33bca85fa019ddf58b6d5706c387d70c0cdf441e5cdc6d3a3b2f2aaceecf8ad2d8c85aa077ab7bec791687704df3
SSDEEP 1536:su6lQCXDT8qeCniOPdA5/yeX4xdtJwJAhw/hCeum:s3eCHgCniOAR4hs/hzum
TLSH
T1DD53020D4197B3CAA83B1529FBE2CB51580530DF53E7EF7EF25ECA5AC09548A4C2358A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Size 54KB
SHA256 96984de1dda99e6efd61393948fe3fedcee4f942294b52c9b5b3dc08d211c5fb
MD5 755a57f21433f5bf1a1b7145f1a2a5eb
SHA1 8c87413306efbc9419f957dd1c817ee7ddc33d9f
SHA512 e6760f51471651cf252c3f9c565c87cf8e85508b57a40ed2e78b600f3aa26840f5c4fc9a6358aa21cc6d8bbaf8cdb70894e1d8d40dca07ecefe97f6cea58905e
SSDEEP 1536:bXK1HSSrMgWqvmjrICtMBHAd79Abas8QY:OhSq5XME2cHAOasQ
TLSH
T1284302F307E531CAFD249336AEE1134973B2AD48D7644785C1AC43E18A802EB677A9F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 16KB
SHA256 1e8b1df4869e1058e4165d6354c6920463b7e2e77ca1d54193dea9262e2a4937
MD5 9247d3c672f654dac24b345879ac9495
SHA1 da265cf72c1f4ca85353b29384403b7247eedc6a
SHA512 d7e49769e3b267883659334ec12f74cb6fd24f15c3fb4c3a94005b330f066329453f645aab55ef460401c18e4c23672c597b0d287affd844f58f99089f7eb749
SSDEEP 384:odpxH+3G9sC7tqft6K6aOamvb/qSBMG6o9RWgOl8jsY62PkKM8j:od7aG9t7tY6bdhvLZ1XkgO4s72sKM8j
TLSH
T19A72E1F852CEB0A1830EEE53C33B17C9EF661C4D2365D652A7C8D3A93C3150B1B95980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 116KB
SHA256 305593a4b0fb7e87f23a8a259ffe6c464ac7f052b8a05622092f3835f61ab98c
MD5 0537dfd0b1e5a586aa9aa7292f36e4a1
SHA1 aa216bd36f5b0b10e550a3ad4cb98a90c43acfa2
SHA512 4a74f6ac7450300176660e8a6ec83e75717f793ed0ebf4044626a4bc193eb744d12c1a646c8022ddc78663d974fbd777c460a224a5a86b22e6dd494e5fe39def
SSDEEP 3072:6yaFjJQN9aj9o0gW9pApzjlU5BUXm3R2DpXaMK1ENUr7:6PFjumjOVW41oe8RiKzCNy
TLSH
T160C3124D38609FA0376B9E275F3B4D119C5358FA7CF18CB02F1699E236A5B9C850D6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 60KB
SHA256 e8bcdff3606247a9fc22b66d876b5ce10d4310e6164416398c90f449ffb18b56
MD5 4f40f8ff6e1ae4780072180beab03343
SHA1 c8effeadb49c361db3952781b86686e850bbd39b
SHA512 5db33ad9c20600b01d8da6b34bf8fde1669e64e1e5a8e7c2aa597ef891b0f0f027abe8d73ab320477e282bf5f181f8f259d5f6ccb2f737890afbee0757049a35
SSDEEP 1536:afQMyMcmcKXDmzUrGZgOVUWMzUGISpS1SHEoJz:afQMynfKXqzUPBRS1K
TLSH
T15C5302B394466A74C29732735D8FECB3EA79AD8968BCD124761B9763B0C2337781C046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 114KB
SHA256 105fa93f108b376a24ae7acbd2690553d348b6fa45c4773d90483306275c561c
MD5 988ce044a2c9927c7345499bb65c9e27
SHA1 e28866f85257817a29bb9c5aa06bb93e0bfa3fdd
SHA512 781f9c20b6d543e35fa46dc7440792fc40fea11687eac5d5ba886a23ecee9f2fee0e9fe2386773477e144b8626e97d39beb841e9129e1cd691c6c1f07a872b7c
SSDEEP 3072:zrdF0OImj0txWLUSqIwVeLNr9252M3/ID2:zTc8LSIhcxn
TLSH
T1F0B302ABF63935C0B4071A77489E216E1D74C2EA8CD277096C2CF97B98A09EC1D13B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050
Size 95KB
SHA256 8dfb923618fcd59d535d9ceb270908644ced057afb18bb06b28c4112d5050e55
MD5 da571f0b435a16ea351308058f6482b8
SHA1 6c816a603e0afd878ee9284712a59bc8080a765a
SHA512 f17d895359ddb44db28a7a931158eab29547d303d91551e44580acf5f30d42ffcf18c32df3456b4c42b229b4dd404e154be18c4b9e13d9aeefaf72e1d5080fa0
SSDEEP 1536:lNAOk6jDheHUle5ONYgQsoPOnprT/Kyua1eq8XWlH2MUE6iCjfQR1a6NaJ:IR6jDheHUl7NyTPOp/KDa1uGN2ZEnCeq
TLSH
T1FFA302B286C83615F11CB8B54B472303DFC219894592B3B6D3687BAE81E46C2F4968DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051
Size 132KB
SHA256 61514c28cadd66bb09e030cbf6f4514d5bc7f5f7c218fb6eaa690426268bba93
MD5 bbde758aa2ef61e9f9f4f1bd797d3ba3
SHA1 b780009505c176d299a60b568362cd2531b6be79
SHA512 ac16d46553f9e7c8894e1e3dff76f9cce459ddbe63137438996efd8aaa715c7b055df796cf7410f03690fa1bb02c4c7a25a929ff7bf074348f01cbe9f18a4403
SSDEEP 3072:N4IcJuOgmySfywCOfjX9bVa7lKyuyA6bpLX4g:N4HJ9g1SRCOB0uybbpLH
TLSH
T1FBD312AFA22DA775DC64C07C4EA4CCF9C408AC8883A49DD73DB896EF3807824511ADDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053
Size 26KB
SHA256 36510bc96161caa2a49bae00fbe5e808da5d1e0f0d36a34ac1c11f59d0772431
MD5 097c9180356cad4282f32ecd46d4faab
SHA1 90902f1c950b4bf522162892caa9b6b4b57adb87
SHA512 bfbd5b3af1675d0e96c53b60e00a57b205d453c2f21fee9e8305362090fd41c030098f23fe4076b8348584e39fb4d51ef8dda3be0efd1865ac7308f6a98b5915
SSDEEP 768:rvncDmk58QcREFsP3ZMa34M0Z4G+i1hCM9ZMMkM/MMWDgo2:sMREFsP3yk4MW9HCOMMkM/MMWD8
TLSH
T125C2E11599A7F45AE380DCBEDA33FE83C49657255670FAE7AF4402A41FE44A332D8078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
Size 18KB
SHA256 29bb20cef466b673734884aacde85719567b24227793d5ce5d88482eef426a9a
MD5 8e53d90b5b2ab8316c1a59eab8ae1da1
SHA1 e5d83e76555fcc4fef5b104a615a5508df98a474
SHA512 299065ba0e2ec9e4c2a607661063d8ab10115189c17bf6628c03e58452469d31089d6b167a38d5e2a7fba3dbd872fc192db963cbfc0289505367a639f2bc3857
SSDEEP 384:hJX2XBLtI5E0XIEsFo8f7N6p6MT4/PmG7yJLn2tZcJsusrpPsD:hJUC57IEsFR7URT4/PWoZ9u0pED
TLSH
T1B182D0D3D6DBE5AC3361E1F1820DB7E4DEA58B04A0543DA8385B32E3C203B85795E9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075
Size 28KB
SHA256 7de44149f567e156917acf7a48898abd0cda0073f5aa0d13260b69a4ed502b6e
MD5 315ea7479e2dd05b6e51a14bdbbe3a7e
SHA1 050a73886ec00275f6cdd7199648bcd4060626bd
SHA512 a8af2cbeb5088aac01df776be6f026f8e78256aecafe2c36cdf4085e62ce22443ed6ab92442316ef99c269f04980456b0b450378093245456c49e0c6850cd8b7
SSDEEP 768:UzjkMFUm5wh3GqgvZnsvOy7FQ39aMLa6i:GQunK3GqRvOyhQtap6i
TLSH
T1E0D2F1ECE621631B019DE1B68C1B2D34EF531238C1ADD49F58512A387BF95C683223DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000078
Size 18KB
SHA256 d594113f295594af3221f10806ce04df71b0a045c9a4a0fa13fe711bd1c2867b
MD5 b92b781183fec051e7edda34609d878a
SHA1 71c44205c518a8497835cc18a6e8dccb6f7e79c5
SHA512 3602e66d8adbaba2a2e480b02d55d4482947e2bc5501df3b846efc64c3618ec7704715c9a93e65c3d67af1092a577f5b5c13ff8ee8d25ac3b72b54889921d6ef
SSDEEP 384:RNg8tpfMSPYFPAcUBXaaQhZ7FXThFqnaDXNZCdZvTUlaRv8/jxaAIsQ:0gum1QPBTXIaDDCdZrUlaW4
TLSH
T14882D04B983776A98452A7EE843F72F4400C5C576601B31BB621BF62A211432E5F238F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d6
Size 172KB
SHA256 5d21f27eaddeae80a4f0b22e25e97a0ebddb25ed7bf3a8986e81421c8b4374c3
MD5 5aee9cc168e903f61ef60e4885797582
SHA1 fb115fd555b35ca3ff1befefb0276d379bd70a74
SHA512 49f3f9cc9fdfca43f18e869c11ca48d5a6b945cd94c3f8adfb4293c3d46b079851e3847ae366a5fccd17620f4522f3bc386826397013b0c703beda2faad8b524
SSDEEP 3072:qHsCV932jMhY3V7iqzDj57VJH6hnesGTybjq:qHXV93jhE/7VshnPGTy
TLSH
T12D041F81B642F940C4455DBA5E1EE9D84233BBC5EF0B63323150BB7F29F69C28A6D6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d7

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d7
Size 176KB
SHA256 7eded3f0077a879f4ba46145fe74d7095c2cb000437e8f03c243986a7178f0d1
MD5 e808550b059f534eae9fcbf7594f06df
SHA1 1e50e064f43d73ef38ed04d0ecb797eaa95b335c
SHA512 369b1b0957b42f76dedd62ee2950dad7f42020a81570d915730a518d7a251c05f78b21a2eba2f482717bdd88fd10d5e055e71dc4086ebc9a01476fc1ae2078fc
SSDEEP 3072:ZD8chhNgddvhCQKs0WNTRVGtB+28OhZPatpZKX/tQsWFxXJ3cg+Xbje:GchIZhCQ5XNTStQzKPCZI+xXidX
TLSH
T1C1043B82E152EA00C4895D7A8D1AE9C143337EC6DF0BA7323154F77B39F25836A6D6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dd

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dd
Size 31KB
SHA256 4143e2810c322b1acbfec8f031354110ad78b5206744ae6fad73866f6ca19e3c
MD5 ba324b9d3ff019197de3c1251984767c
SHA1 583d2b433e8ee9371ded979825a09e2b1d69da8a
SHA512 32b5bde9b212d38a6cd95597f1889804f92c38d04c9499d70562ecb09c149e0c18f0250ddf7033a73e06646536908eaf0cd9ed810fa5162131dfac97a24f5ab9
SSDEEP 768:DaYgL3w7pbAeE0DydpuASzNADai2XakkASCP:DTgL3wyO+pFSZADatak35P
TLSH
T145E2E122D5E0C49B9A49A36FF1C20759129DAAFE08758C2644B3C48FF93219153E5AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 991eaea107c33f1623460f0b2694465ae4a9060daa37672897af081aef946301
MD5 07f21b66230efc92d95a95459e3ff57c
SHA1 980d1f89df493948a56f971e0c4e1029e145296d
SHA512 4f0f792880aabeba3b08b4297dc39bbd98c8a513e4126a03b399f2db628f7b48278ff7c265c9a978aa77176b22bbb2b765bd8d1b00495292cc5163085a37da42
TLSH
T13EF06D5173B01F1EEF2EAAF930E24C81A4301B5174579B63B616B2F29B63BE14A01E47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 c89c11fbfe7b55a478d544e8b60ced3112b794bcd1f254caca95a8aa1e357262
MD5 581b6731481165e5f583c5ae4ec33f9c
SHA1 16e38acd28488cf1b0103548f9f925bf83ab9662
SHA512 4c4e43984880810b6e730f5c136ecf642d6d5b9027d2488f8c9dd8924315d1afee0ee2e1beb50dbc3bab83b3bbf02d6fa55680dac8f06147aeb2fb9c7f37127c
TLSH
T12231EA8123B05E0EF31A8AFD31E11807327527213C175A15712D77B1FB10F36A45AE43
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 6db91a455d4204210be046699812a943e214696dac8dcc20dc717ab85d1b94f3
MD5 2b57ecf058c61ba1dd4c85935fe86545
SHA1 43ec07c395c788101b9104e6e0a2209893ab9477
SHA512 872e9b3a43b0f558062e5d93f729018cc7e3fbe138c8efb6523a1174f3fb649621f8e14fe460ce9790540e44b4b7795b491c3fa0591babd64122d9ed458c366d
TLSH
T19B4163C537B29E1EF31A8AF936D1540B7635A7603E831E19702EA771BB01F32A456E43
MD5 SHA1 SHA512 TLSH

Submit Download

0075a955-2990-479c-869c-865a772a893d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0075a955-2990-479c-869c-865a772a893d.tmp
Size 1023B
SHA256 133233d9baa71981b275040f7d1b7cebf3dd55b1ce60a1a301d3bd918e071f73
MD5 5146a6600423f1fa9457fa187af44c60
SHA1 68268b1fafa723574656c2681810b21b60c1390d
SHA512 d18515571157a80b7027260bb62205d78bc65564b534e73c1059a84a34e50d2a0f8472557a6461fea5b65ca0bbdbb9569bd0cfdd8c3098b94756c9bfdce2e1b5
TLSH
T178113BE7E97EB46B106959671E08FD051ABD7835029168E8CBBB41AC70C04F31B02837
MD5 SHA1 SHA512 TLSH

Submit Download

707eff74-ca72-49cd-a5e1-2266070f2914.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\707eff74-ca72-49cd-a5e1-2266070f2914.tmp
Size 4KB
SHA256 d6c6282578bf8d9d013e6d8896b7b7f4c6aa1ab2c8674939d19b87e48c0166b3
MD5 f4556ead1b4d9748e294bd84b61ab6d5
SHA1 c68c09077fa4724ace3d458a76da4cfc34f06ebc
SHA512 a95c5838844f1893236b5bdeef48c49cd4c68e5cfbaf64f4d67b59545da50ff152299c4728030a96aa42ae6df71011402e4ece17fa409d6930650e1629cdf8c2
SSDEEP 96:D0uu+wuOuu1uyWaai3EdLOuAiun3jhdAu+VuPkuAunyuvufuJHu8:D0ulwfD1gaai3EdLOJi63jhdAVx96yoX
TLSH
T144B198F783F4862DD91096F4AA156E1FCE690924033C38B6C9D4AF1B53E2572E28078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ec07ef2-69f7-4a18-ac09-f481e501bcc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7ec07ef2-69f7-4a18-ac09-f481e501bcc6.tmp
Size 4KB
SHA256 d29e0e263a1ad4fa7bed48288c5021978651191b391f05444d10d9b656b25435
MD5 ec951d3a2e362c142cbd6d9118d26e50
SHA1 d811050eafc580277af6de595c00b90290650d5f
SHA512 2d54eacc63da39a4a92e033aa8b841e25364b7ab3cfb701935ca8e3d7f39d2f76cd109251fb55cf3b116f6944f50333f11cd6e60ea6ee761dc1c2a4333cc754e
SSDEEP 96:D0uu+uOuu1uV+1aai3EdLOuAiun3jhdAuLuPkuAunyuvufu+HuC:D0ulfD1z1aai3EdLOJi63jhdAax96you
TLSH
T1FAA189F783B4862DD91096F4AA156E1BCE690924033C78B6C9D4AF1B53E2572E24078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82112f7d-3386-445d-a0b4-d723a10d30d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\82112f7d-3386-445d-a0b4-d723a10d30d6.tmp
Size 5KB
SHA256 0d062df5f9dd7ba22ea583c2bd819a0c86457ff987e52d24c899f2d188f7542d
MD5 9fd8f86e36de50ca3f27b8e3a0e48aae
SHA1 604e226ae22b868d976288387fd2ca033487a5d2
SHA512 6dde2011eb69adbaaf8bfcd813a23bd8104c24fd17aad85e4ecf4c09b478002754675655c47a59db441506d2b7a1aefbd91f7bfc2dea239750ec093554e3ccdf
SSDEEP 96:D/5vuGRuuuKvuyWaai3QKLOuk6iunWuvjhdAu+VuPkuAunAzufuQui:DhvtRL7vgaai3QKLOei6W8jhdAVx96AE
TLSH
T1D3C1CBF7C7E8862DC9119AF5AB113E1BCE6D0924433C3C66C9D5AF5B53E2571E28024E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba661c1d-ce70-40ea-904e-914b229b171c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ba661c1d-ce70-40ea-904e-914b229b171c.tmp
Size 4KB
SHA256 a23a35392ed3d293ce5dc81ac792387c25577987ad6c1b03e5ed3497aaa9296b
MD5 a58d70c048e112d3cca24c3c85841134
SHA1 be328bb9e8e9ed733d182e87346681dc13f25eab
SHA512 5c1786e2beb1713eb844d6618b6c02063f67f34959943e498cfe3996cfca086f22d7741813fcd56faccf85ed5f3be71862f6a4c6f802e83b69155f8cdc32e929
SSDEEP 48:YALlq85qmOBuKehzafo7XLsigmzs154s3fsRosKnKsFOBWsQOBHgOBnyOBSzsZOR:D/5vuGpaaDw3QKPu2uAunyuhOuSu1u+K
TLSH
T14E91A9B7C3E8863DC91196F9AA156E1BCE6D0D24032C3C66C9D5AF0F53E2972E24024E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 6a320cc7f10221cd196b7d653ea298e43b2a0437dd1ca330c01e4cfcffbe74b1
MD5 d4945952dacb5e812324bd81634d4e7c
SHA1 117bf1fec393f610496925cc757d02079fc3d395
SHA512 dd4bb57d67dcedbbdebfbdd7d634c2200a212a3ab0fdfdfdf2405be19960758321a33dfb8480a053bba1464609ebb2f2320681e405b8cd20eb77ce58e681c4a1
TLSH
T108B012A480515F41C50202F86290248C3258DF11E645130292F40E118C35550805B096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6bb8a401d6bf99eec8e2a51e172eabd2223a0e80ec526bdcdb21a9e7011ca3ba
MD5 180fad3a6f05d2ca77322b6080d600bf
SHA1 48848c3ac78f426f94b5ec2cd40c675e03e2d739
SHA512 437229883123b5eb5e779a8a9f74950294e3b94f895ad6c8f7441d7500c1f9505f8c40ba0bf0e0bb952b4bb30a5189b3cc5abbf9cc571c9d73d91b1b3e6ca5b0
TLSH
T1C4B00255C113A222C08343F43EDA95E871A0EF26CA033617A3E61E76DC6B6604527E71
MD5 SHA1 SHA512 TLSH

Submit Download

b76bff35-427d-4461-838a-b1b2382af583.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b76bff35-427d-4461-838a-b1b2382af583.tmp
Size 17KB
SHA256 6b7cee8b1a5eb6f1d44c20ace754a545db0a1024ec3af9927adcfd7fb5491934
MD5 6ebf767a844f07086ae64536124c4a52
SHA1 dfdc2ed2621b56af7ab86ee74a08835c5544579a
SHA512 3d3a2843ec32079f785bc015a3dfab1b143f21902675eeccd9fb84c1a22147178feb9f7d146c1c8203d46344ff8432180128aefaab9fd51e9a50a3c74b2f5ee5
SSDEEP 384:Uijon7KxkXqKf/pUZNCgVLH2Hfgsl3i7pLuLceSijXODoL+ErU3pTHGsUXIoi0lA:Uion7KxkXqKf/pUZNCgVLH2HfgsFi7p9
TLSH
T1D1721A677C4C993B0F94C9CCDC2A7E4FADB5024B61E9886483FA5C2A03D5ADB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3843737-d37c-4fc3-bf2f-e0b96964344a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e3843737-d37c-4fc3-bf2f-e0b96964344a.tmp
Size 13KB
SHA256 c713b15950be75ffc134c25945f79d72f92e334ff329b0b795258e9d644f0a9f
MD5 637b39d1d85d082bd5991fd3c540717f
SHA1 93e0c0e2f4e40c12ad6507cc240d1e5f7635cffd
SHA512 b25b7ba3578f2838e9246409e8b5f8f747d7a72fcccd9298bf6851e53770773c3ff5df8d509c3ef0f91121ced5eff430477e14c469f0d06cd38c9c15d2ccc548
SSDEEP 192:wRkilb4AYn0v7BpjPRpfs792Hsb+WNnq6XdLwCgeIy8yIsnAUgraJ:wRkiJqwdpXKwwL1wd1e
TLSH
T1D352D62EAD24793B5CDBD215FD257B93D2F5202220A42F84EAFCC92C15EBADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8756b8a-968e-40b3-9d4f-518308301ea1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e8756b8a-968e-40b3-9d4f-518308301ea1.tmp
Size 414B
SHA256 efab1a64b9f4ae8ce326108da472a68d8c931684c2b207c247f83272ffc408cd
MD5 fb7b0a5416ba51440b1155cc3d335e83
SHA1 4371ff03a227d0559183057c2e48770995a8b22e
SHA512 05ea68d479ff390b89cd3c4b105ec0288e98d5507300fd514c06f54478bfb92fb7322d3f15da48a5fb22e5b5b84ae02d60a10a37bce1266132d9d156d7fc7ab2
TLSH
T1FBE02BB9C951ED3B08FD876854604B46D65413672A51854F3B7C960CCFB8A36058685C
MD5 SHA1 SHA512 TLSH

Submit Download

ece8ea0a-2b5e-40dc-8553-dc8e07448cf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ece8ea0a-2b5e-40dc-8553-dc8e07448cf1.tmp
Size 13KB
SHA256 6ccd65817dcd272bbd6f7545aca272872604f3340fe796cb6edfd6d942add030
MD5 1089aca846cddaf63ecc6ec66f2fcba9
SHA1 22c77732a14a386662a24c463e0688d87db4ecb1
SHA512 26de0a768eece937e2272c39886779d66e6cdf52ea6f3c5400efec3dd3e947c871b28f803f576881d8e438828ff2307828c517ba0979fcc614c087645f3ec6e4
SSDEEP 192:wRkilb4AYn7v7BpjPRpfsy92Hsb+WNnq6XaOylgeIy8yIsnAUgraJ:wRkiJqDdpXPwwLDyA1e
TLSH
T1F252D72EAD50793B5CDBD219FD257B53D2F5202221A42F84EAFCC92C15EBADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f20a7706-926f-4d40-b8c9-477d1d403414.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f20a7706-926f-4d40-b8c9-477d1d403414.tmp
Size 13KB
SHA256 e57bf7d2b8408c2e6e80f6fbaeac235fe289f734850e438d0d609a20e9c785b3
MD5 6ffdc12baf40d0e8675f335c0a448413
SHA1 c35ebc9fc630b997139c8110c9fa4f326e5bbcb0
SHA512 94f08a869445898ee448064b8fc8a3bff3ad6af51a52eb35fbb09e378622edd65e43f98a84bc099033e0581afeb0d4b925ecf1de85c0219ebf0026c73d12d6cf
SSDEEP 192:wRkicb4AYnVv7BpAPRp2sX92Hsb+WNnq6XaiehgeIoVyIsnAUgraJ:wRki+qldUX1wwLHeMMe
TLSH
T17E52C52DAD24793B5CDBD215FD257B53D6F5202620A42F84EAFCC92C25EBADC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5dd95d8-24f1-48f4-9a98-aa941f8d1139.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d5dd95d8-24f1-48f4-9a98-aa941f8d1139.tmp
Size 270KB
SHA256 54644dd33c0eec9ff17d7b9848f34b080f4dcc17220468054e77192f078e6364
MD5 d55d03d67d9984e46697691046d53822
SHA1 8a0b67357fe48d2f7f661e2a1ea4c1a3105c7b08
SHA512 8d3328473628cd2e151e276db260301160480cff8f12b7f04cbe8414f0d23703145d0f4b9040922163aa2d4591519711c20f47431fc86f55fd8c5b3bb218a486
SSDEEP 6144:PP9WY0fjg4IO2RfjGC83LGJpmJt4fLJ0L6nGJxi3bzqapJjN:kfjPjC5JpmWXUx8zvpJ5
TLSH
T1594412F294B47C76CFE79F26522A3F04CEA499DB484DCEA049F8894606463758A07F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cb2f6c5-ef7d-4ac8-9d5f-fd7c4236db1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1cb2f6c5-ef7d-4ac8-9d5f-fd7c4236db1b.tmp
Size 18KB
SHA256 150f9918799998ff5700885b9fe2f98ea71315c70a77d1d9cbe17eb03c9c30ad
MD5 e3bb11425a8d883643bdd7476f1e7999
SHA1 1d547f8fb1b18076134e2768aaabcdac475b089a
SHA512 3b3c62aacb54dbf72c5acb929f5128dbd029e2b3b0f79db10b58c30debebc4a832927d605773777e6cda7c99c53b4e77eb1a51a3e0b1fe3efa24300506eef505
SSDEEP 384:b8N6UVC9EqeP3GGuaVbMZhqoI1p+hs2IX:bOqmvTBMvQ1p+hs5X
TLSH
T17F822A3D8C34583F8DAFB744A50D69275DA8427FE6B42A98D3D81B0CC1FA19CF346A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a2921fa-d532-492e-9e9b-6a846d9505c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a2921fa-d532-492e-9e9b-6a846d9505c3.tmp
Size 8KB
SHA256 d04706c5835baaa5595a009a535f9d273f79a1a8607b5aedc3f857dae3ea417d
MD5 096ef8471e34fed3ac5d93d51fcea53f
SHA1 c00a70d6c53e3637ef8682a5bc136e3a384911c4
SHA512 58c03f9d3dc40284bb6923ff21a551de05d3623005850af5a1de57e35fbe05bc7941fe93df071800ec920fa2a22f2bbf6d3b73f6a993181151e2b3061daaba2e
SSDEEP 192:HGNZS6KsE7uLQmiUykmSxuaVIoMZZ62Ivqh5U6:HGNw6LEq9qSxuaVbMZzRU6
TLSH
T1C9120B76ACBCAC775EE39852B48335179EA5825BEB847F80D5DC1A1C01EF29C130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ef463ee-40a0-4f8a-bddb-b9fb710c924f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1ef463ee-40a0-4f8a-bddb-b9fb710c924f.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1f6c4b137cf090c223f598118775b10d154be67456bf38a42ba1bb747522307
MD5 208cd2028de536f1eebd85494d0f5255
SHA1 9d2d0041979da71db635ceefa3fa6317dd57e198
SHA512 c40982abd1b1451db2e704b05ef6ee872d40348c91bfe1108ca9713f9faf2315fe291999266c5847de730d134c5fa291e71f02b8b42a23a33fd6d932fac0da4a
TLSH
T14BD02B80EBDC4670E033383743A28213314DA0904402244584D203CE2E0230200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 107cdec69ffcdf6def6a5061aec064c7487b059940a5a6e681c6c354dcb2999f
MD5 271017f7e21f0e77349ace53d363dc2e
SHA1 6b6590b288fab1806c29cf287615c2be041202f7
SHA512 0e4fdfe3cdd4c3ea8b0e6fc7f82a143df9efaa5ee0bbb21f2621315f1b4d6214c7f4324ff9f8eff9227e8d6d7d0dc4f1c99d3707176ad614419a0edb800c372a
TLSH
T1CED08050DFBC5BF4F43A343F43B14102314C65D25542264594D545991E752430055CF9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2919d80dfd6d85559fba9643d47674e2117f9df47486cab2b277d4be08d7f573
MD5 df4820d8a4af5e2a30e051bc6b17890b
SHA1 71c71e6c4861a6746045802c49b9b40e854305aa
SHA512 1e68daef0c4ac9151d4231114e5afe348c06a3f326e718c027aadf385c9d9583a707dd81bd0085d2728242904ef42d27b43b0be21ee08803b068b3878dad5e55
TLSH
T1E1D02B80EBDC4A70E433383743A18213314DA0904402654684D203CE1E0334200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

1f917dbd-cd8a-4f6c-9e6e-adbcb0da6dfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f917dbd-cd8a-4f6c-9e6e-adbcb0da6dfd.tmp
Size 28KB
SHA256 a1540008a02fe52c5464327233c204d13548eb63cb77a8862d1ae026e35dd88e
MD5 856d3df45131cf56cd3a03298609a65f
SHA1 7cda4018ecefb31671fb702415275137ce7215af
SHA512 8617a5a7f2cfdd33e433839de0efb30488acd82447522a21d4a0e58474b0872279cb2d0f39bd938bb67e2bcb8575a969584bc4ca8865cd01f041efff2c4e50b6
SSDEEP 768:rrnh588N24sWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CrLl/Ii09Ukroed:rrnh588N24sWRmUUQ6Iu1jaKCrLpI79P
TLSH
T149D20A3B244CCB7E4FC01E9DEC566F966EA802C766688D4047FE994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

470a6d44-e192-49e8-a8bb-b9656f1fca09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\470a6d44-e192-49e8-a8bb-b9656f1fca09.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7303de0c-5827-47f1-b02c-0c3ed44070b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7303de0c-5827-47f1-b02c-0c3ed44070b2.tmp
Size 10KB
SHA256 33baeaff3218b96f89d4a1573b9a9501f21216fe9fe610c0a8d2c56b50ba6b87
MD5 7829e64ba014d12b4b40acaf444e8251
SHA1 a6ee2bbac4606e8139d269b747604e7a71293834
SHA512 a0096d3aff8ced8d069f645c9deaab8ba50e38c38552f8a90caec58b02dec8ac9790d5eff885c45508825fbb9715f96aa9ac52f44a2cb6259a6be189a2f59266
SSDEEP 192:sxZIR5by/fHYs0WpVNq3j+EdpOa/W6+WNcW/E/Y0Y2g15ailYIgFJ:sxZI7y/f4s0WvglJ/b+/5Lge+0v
TLSH
T12932B7126964697B8CC7E21DFA25BF53D6FD102691D11E48EAFCCA2C05E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 91024299a85e0001f2f74a966079c69e07e7a4047750435f81ae8b64593bdc99
MD5 77f5f21d3741ad688e72b61be754558b
SHA1 6112d2a979c0591cca618baf39046013f8d82586
SHA512 0f8e0fa82a7c4c85c1d3f470c451366de1374b8c8eabf0aa0cca5e1ef43554f113c47beedb3aa4264d8975080593bbeed44fff391aaecf3a4494f1eecccbb661
TLSH
T1FF710DE0B2D00819FF9E94FDC5D505ABB63408D0369F6F7A29E1C5F99A763601E0688C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 232fa6e2058e7bc4eb1152a4c31c7232a36e024ac759a4e3dd54bbaf8551c4f5
MD5 238b44b2dab2f3c8dbfa1b5b6c164664
SHA1 b5d5ab8e4e70840f85c0cf4bf6f171888f0616d3
SHA512 5aa068f1423f20c40ee87a2014f2509eebd0a3478abfe94fecabf14195bb07410f2c3a4a80bef06386f4a9e9d3120263e9bdc039154a00e5de069468c78b59ea
TLSH
T13061C7A0E6C14569FFAE95FDD0E901A73A3848D03B8F5F7E08E5C9F9587A3501D4684C
MD5 SHA1 SHA512 TLSH

Submit Download

1d7027ea-47ac-483f-9265-033881c62216.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1d7027ea-47ac-483f-9265-033881c62216.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8a715188-e8a5-4c3d-980b-1b4bc4c93657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a715188-e8a5-4c3d-980b-1b4bc4c93657.tmp
Size 2KB
SHA256 4c8ecabc8929db2d86e9cbf5fe0adc42db081ffca06d04f2d966f0792eb9f9a6
MD5 374db1a79024e5bb361d5fe0af04bf4d
SHA1 18f12bb97b36b32f3521d6d0b1c48f932dfbcf47
SHA512 3561bf81203dc507e6e478d0c7a20566a1a0f40ed4ae055077aa0ae19c2cfcab9b6b594c36472fb12c1e6865b32354c5632bac7d92b2cbd70f707e2e46d63409
TLSH
T174415BB783F5863DD91156F4AA186E2BCE6C0921433C7C66C5D4AF1B63E2471E14068F
MD5 SHA1 SHA512 TLSH

Submit Download

db6a79fd-88bc-4447-9efa-be28ea3a487e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\db6a79fd-88bc-4447-9efa-be28ea3a487e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 40dd452e1920c81bd4f4db4ac4ea7a305f09d9b74beb1743084af75470bb45b1
MD5 7bae3b7c0c894a0faeaedd40f0485d7e
SHA1 c6fbd0ffb17571cd9e8fcf59325142c653adbd52
SHA512 20063c4e5ee70ae4798da5ed94b1b18e7409486b12b9d81292055b4a4ee79663510139aa97f2246d07c63cbaeed74c247835cf537e85054c30a9988b0d264a72
SSDEEP 24:KQuZWA8ItKChE1eSL4VyXF25WgkIhKShY1KSDsNyXD0Pc82IBKMhU16Spi9/7C92:KQLItKUEIryVfIhKkY8Ly9hIBKaUsP
TLSH
T19191DF5431BA425038BE694C95BDC76B42517373321CEA2B3FBC42A64E6BE086CFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3967c1d-b087-4aa6-9d26-11a5c58eab18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3967c1d-b087-4aa6-9d26-11a5c58eab18.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ae6b5596-cfa6-480c-af85-d3e0ea0525c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ae6b5596-cfa6-480c-af85-d3e0ea0525c3.tmp
Size 8KB
SHA256 a512a1bc353ad39a16a7cc2c16ebb8274d50dd0491a6ccae175c270e3b99e702
MD5 81e72b7939810565d49f984e56c57ac2
SHA1 faea040dcfe456f75c1c2272930032f075c5acfd
SHA512 6b760499a3cf35ec0bbaf08a64f99f4f7b92619cb634820f21795bf94d1bedb73bf0c1c99296533ad04b14d5d50305983c5682f32ef5cdd6814ecdb44715a8d0
SSDEEP 192:DGN46KsE7uxQmiUyIUmgxuaVIoSu9IMvU6:DGN46LEqPTpgxuaVbNrU6
TLSH
T12F02E839ACBC6CB78FF3AD46B58676239FA4116FE6943F84D6E81A0C00D725C1307426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3500-1362-0x0000025877490000-0x0000025877590000-memory.dmp

Download

memory/3500-1313-0x0000025774F40000-0x0000025774F60000-memory.dmp

Download

memory/3500-1311-0x0000025774FE0000-0x0000025775000000-memory.dmp

Download

memory/3500-1310-0x00000257741F0000-0x00000257742F0000-memory.dmp

Download

memory/3500-1287-0x00000257741F0000-0x00000257742F0000-memory.dmp

Download

memory/3500-1256-0x0000024F42150000-0x0000024F42250000-memory.dmp

Download