hxxp://malware[.]com/

Analysis

max time kernel
576s
max time network
571s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://malware.com/
Sample240502-tmlcvsce6t

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591402961330805"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2818691465-3043947619-2475182763-1000\{F98D93DD-931B-4872-9F46-295416823598}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3788	msedge.exe
3788	msedge.exe
3620	msedge.exe
3620	msedge.exe
4960	msedge.exe
4960	msedge.exe
4136	chrome.exe
4136	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe
Token: SeShutdownPrivilege	4136	chrome.exe
Token: SeCreatePagefilePrivilege	4136	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2024	4724	msedge.exe	83
PID 4724 wrote to memory of 2024	4724	msedge.exe	83
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2220	4724	msedge.exe	84
PID 4724 wrote to memory of 2628	4724	msedge.exe	85
PID 4724 wrote to memory of 2628	4724	msedge.exe	85
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86
PID 4724 wrote to memory of 2184	4724	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malware.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa763c46f8,0x7ffa763c4708,0x7ffa763c4718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2145463894924625490,16777652117888017240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa6729cc40,0x7ffa6729cc4c,0x7ffa6729cc58
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3284,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4644,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4452,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4572,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3452,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5152,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3476,i,15815087905648303094,9292121197038081373,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dee2accb9fa51409daa9a46978a10efcace8ca7109b6d089a5884dc816ab205e
MD5 100b9f4b649ca536c56914599de44de0
SHA1 798ce30bd3296b673608e1e317447f670a005647
SHA512 d8f234cfafd1a80e2f5abdcca2926fee6aeccf5dae4827231d50329f5a9da79dce1ebb99b5ddf8358959042ac84d9c4b202e6efc0fe58a8cd5c8ea31bf111d2b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 101e429952fbebde4e2407dea5aff379fb3c33d8357b515d825ed7957a5e01da
MD5 974bdf39c008703c9c15a9345d1ae6ac
SHA1 da5e600f87ec5757ea0f134f8e2a5ecedc0beb55
SHA512 e056f68e66ca8f189a469e4143698b56e721fff71e940d3872eb7090301cdc9fcd2883e15c800a0924094611f161ab350d3ae4a449f88187076124be61417100
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5ce2152774c9e6b2137aec7284054d364290b6e677e5fd64dab81e55e4cbf7fd
MD5 297fcaceed4f3bfca5c59ebf44494f6c
SHA1 75d26e4929c4d52ecaa0abaab82c4722a57dcae2
SHA512 575df43b81839205d000af7bf449666f557773cc2706b208dabc4e9ae1d8c903c913c0c7a237aca863e753b7ef22c7f779b82e3a885e511ff329a3553103d46d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 79a92869e4b8da5bfa4a0ad533ec92d11a26904e44e2f165d52540aeb1110b41
MD5 1b7b1a13e3efc6d5551fe254e0670eba
SHA1 b157c014185fd50c97754eb5e0cd7ef306d2e61d
SHA512 c7f3da3e11964fb86cce224b4e33fce5b16d30f08e54bbdc816b5e02c96c467392dc2f4d3661c6a309610b358c073b32aadb86fcd2f05d2453992ea8300da4ca
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 f8429b30f03af6abfa44bca41fee7ebc5f271889c6ffdc470e64f3dc085baa56
MD5 3365aba391cbc279606c1aee901cb6bb
SHA1 216e89d2cc5bca11b840354cca8934427e55b0c8
SHA512 e86c38dc604e7f1711caf4f368afba76b35299dd72b85ddc0cf9d443dace65664c12b759e345c489c363c0356b4dfcb2954606c5bcfa8f6b7aa21d4a704f565d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 56fb1ff2429a8f6b845c0057bcd8d4261f45d194d2b8c96967e5e5c36e06cd4d
MD5 f01c403838d250ebc4b6b4b38b508620
SHA1 f715c0342e2a4a6261b9cebd0c5457773f071a3b
SHA512 e8bf62d11778602c64b4008765d718bb7246184dcc2706adedecb3d622af7cdd6f6b5156c731a27978a752ee99bc21e5449d6283f921ce237d407fdf792e446a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 b2af7f886be15008f2b8b700d703da2e415cd7ee73828e9f6b65e00cbaf128ac
MD5 011bf94ca0adfc15e083a2d1be79da88
SHA1 70b99c08c0ec5bc20f5c7e11e9fda545793b7b58
SHA512 82e49b0461e7f9d955d5b82ca1a67c3b1ed41e884c39f5a90b6a497a7af88582cacb40728ac8af943069988d239453c482e1025d4360db6886b27fa80839f7fa
SSDEEP 192:oI1kUJAejb9HV+FR7s4kwlkVPo6yIsnVdg4:oI13btGRx+H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e9fb0218094a8b51aa7e6ef6efd4ed1a67103c5112db42591821fc09a09fe6d5
MD5 cf7f58370a2b0cd3ccb4605a902c007b
SHA1 7666b62f6dbdb309d6d557c00a3dce7cfb81328f
SHA512 991ccdd84f7a959120284fff5481ac917461d2d87facf238de85b1017ba8489ea21783cc61cce8c20ddc9e2d58c4e1352ed3bdb6742ebc668de55b49eed94144
SSDEEP 192:ogcBztkUJmeyb9HV+Flj6O4kwlfVPo6yIsnVdg4:ogmzt4btGV6/VH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 1ed894f22be53080adfeb57614b67c42bdc63d539b5635ce91e5ccc0c632d272
MD5 d2a270e26d647918592e3307a08d09db
SHA1 d5d34e04930627f5d0f9938eacc4dc5b8d077614
SHA512 83a73fea2bcde74088b5cb8f86f1aaadc5d0dbd1ed0a1fb28ccce31ccc907879c9ea56822f47d95d89954fa0b25dd36a5e2569f8dc5b0821cd7ba2e45f0f27d5
SSDEEP 192:ogcBz1kUJpeRb9HV+Flj6g4kwlNVPo6yIsnVdg4:ogmz1UbtGV6pjH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 fe552fae15fc952b5b9b9897272b5c9d3cbef7cfd44b7c2e7b6fd2c05d3dd0da
MD5 7059d2047ec711f3b0d5774ff55bb3c8
SHA1 d49db0b1e2bcdcc4a89bcd540f410dfa7e976604
SHA512 3226e4b120e6f97be32a376fb1aa7763c339c9642ac04bbfffd766986b01e4078467e3a9e88dfcb7121bd2386a68d47311170c3bfef360928edf6286612dd5c4
SSDEEP 192:ogcBz1kUJ/eRb9HV+Fwysp4kwlNVPo6yIsnVdg4:ogmz1KbtGVsyjH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 052462d8b5a85e87cbfafb4919b780fb538e65613c195643482f2deb4b692db2
MD5 4c0e62b0f3f9d42b3da752d722192773
SHA1 bb80979bf738d2e77398606b51c693c83b64bc82
SHA512 faffcaf623fa7f40ca92af47a378c557c5c713c44c1bc58b9a41a1b35c3b23693c199512af7746b8740e30a1107eb857e05727e999da078f15d94a8c65fc0b1a
SSDEEP 192:ogcBz1kUJbeRb9HV+FTRkn4kwlkVPo6yIsnVdg4:ogmz1WbtGVk4+H4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a673a789c2114bdd83c2b47ba77f60c5a590cb52044cd4b6df23c148078ae17b
MD5 80a08e74aa53257254a29b64ccb80d96
SHA1 d4478928e9f8ca6d25a29f5d3186b47af2c70b77
SHA512 4c62690367d64066e62c19b5b4f4f1123814a419342d931026dd81eb47fd1b12d5387addfe8d835765e9ac80e15110f6ffafd39a81447037a8a9f416ef6987ad
SSDEEP 192:ogcBztkUJseyb9HV+Flj6O4kwlfVPo6yIsnVdg4:ogmztqbtGV6/VH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 780a6c7fd46aa6dd7cbfda0eb19c9b5b6c9040031e34cee0bfe8f5168c6bed0d
MD5 19bcdddf872a711384c0407fac0145ab
SHA1 ef3891ebb0d1b26e5e06257453f922e2fc23ff57
SHA512 3649d7622b64844d8ed584d7b6f7b3d075b009108a00c93707ee248cc41e29b471f28ad14682c6825042512c5431b29e1d0638e67a4aa71cd316c99817088f61
SSDEEP 192:ogcBztkUJIeyb9HV+Flj6O4kwlfVPo6yIsnVdg4:ogmztObtGV6/VH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4df22e4ed2771ee1c15eeb4b2316bc9edd42a995471dbd4f1244b8f37e0f8d6b
MD5 3cd5b7d2304869a513684c29655c9371
SHA1 9e15b0245846bdc648605c548e07fac08249161a
SHA512 b047e7af9ef1dd993bdb72e842aa69312a7d8882b5923745e39829579e75ae4484eb8516152940ba36c3e2fd31078bbc944be55b0cd1c545f4e12efb66d1d880
SSDEEP 192:ogcBztkUJTeyb9HV+Flj6O4kwlfVPo6yIsnVdg4:ogmzt7btGV6/VH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 a3e18a28237775a57724fc48340cfec5a700121d73a1ab9f399e4cc46b8d0fb0
MD5 a7b8a6ad2a146da27f6da78ceeee2c86
SHA1 aa88f9211df5ce0edab2a8bdb89b585494193ebd
SHA512 90720aee11d4607260233283c482231cc94522107c14a15202a2260b7a90b5ec88aced57b474242378776975c5aed7e69f52e694416541b9bfa9f8f55c6fc8ba
SSDEEP 384:ckmh7pLhLcEvkNXyP1kXqKf/pUZNCgVLH2HfPE1rUY/HGBXCZ:cfh7pLhLZ8pyP1kXqKf/pUZNCgVLH2HW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 ed07546a7963506458b00b287d5548588572ba6747692e8e03afb678baf68a96
MD5 7d445fb8a0eaae1747774de36cfb702c
SHA1 8954133b0e9f95123fd10c9eb5851a1492f5fa85
SHA512 99767643beb8024263fb930ebe6ddbc17ba936ddea4cc84521e7c9d65ccf8fb10cfe59d561ba770ab4ac7ce160ac0b1f737cac4a889b4fef4e0f8601de0be1d8
SSDEEP 3072:qSP+w48JiOd2np9y6Wl/zm9t5iWUEp82vQ0QaD9W3aPv:qSPz4EiOd2p9qmMWU8H9W3aPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 30f85999d48823d981b80ca12e95d77c2558026494975d0d1d4b8644e0eca400
MD5 b5b2eaa335f74611e25f558ee2f30adc
SHA1 45f0cf5fae81cf8de3ea3b36f13ace1cf55c45f1
SHA512 cb9e93e9fd9e1f83b70ede50a1a31c4a1f060dcd349a6c58dd850882ef408f9bd283d0872a6fe57bbc0c506962a722bd96bb178b65301e9a6d920596c95330d8
SSDEEP 3072:vSP+w48JiOd2np9y6Wl/zm9t5iWUEp82vQ0QaD9W3aPv:vSPz4EiOd2p9qmMWU8H9W3aPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 de6d21484fa99ebd513419a488e6a9c19e228bdbb405e3bb4cbda0e614fc6171
MD5 1741cd992050eef92c54383fe43080da
SHA1 f7686ba46f42a83951c0f1281152cc947cd7943e
SHA512 a75fb8acf1ac5f1368dbddba3fef250c74fcb72dc361f1f042cdb8cbd03d4396d0f3dc683c92cffc879c49fd88889676f1e1ffb7355ec055408161692d39a915
SSDEEP 3072:aSP+w48JiOd2np9y6Wl/zm9t5iWUEp82vQ0QaD9W3aPv:aSPz4EiOd2p9qmMWU8H9W3aPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

24d10975-b6e3-44c9-9d0c-0ededd719fdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24d10975-b6e3-44c9-9d0c-0ededd719fdf.tmp
Size 11KB
SHA256 10880e2363519522d5a27064d8bf623cdacb7bcdac6a203f159e1b201235250b
MD5 787ebcf6174223635c2cf3d23a7034f1
SHA1 8b3fae22ddca6be724d50b54eeb7a0179f1d1655
SHA512 9387a20b3b4917489160ab360422d88e2a7b685326193a88a500f0e5fa02d75da3736a67c3157d8db97f78630355d05850b3d3ccece611a1dda1ded197c5128a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupo7ee2RUYIzs+OblfBhDaam:A9iIxuERzA83h09RZxYo7A8s/XDafEBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
MD5 8b2290ca03b4ca5fe52d82550c7e7d69
SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
MD5 919c29d42fb6034fee2f5de14d573c63
SHA1 24a2e1042347b3853344157239bde3ed699047a8
SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 67KB
SHA256 6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c
MD5 d2d55f8057f8b03c94a81f3839b348b9
SHA1 37c399584539734ff679e3c66309498c8b2dd4d9
SHA512 7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6
SSDEEP 1536:lqJs/v+IjgmmFS4JFXLgXI84enK6kqPc7X0iuw0OO1AiGaB+H9:lx+Ijq44JFXLgY8DnRkqkXGOHhH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 37KB
SHA256 eb11e610212667929b5162c1774c7d5b8d3a9b1a59c21bc661fb17a9ea561885
MD5 91cef35adc9d4fa1ba9415d8b77a6b9b
SHA1 4e2e1d50bec1bd658d14f03f1554c726e9d02efd
SHA512 45ccada71cd934b7d055fb5a3db987303351eba475b2375888cf07563c2811ff459026b4d6fb61e93f6a3fe928fc31e08f462609df09ad9773d51084bacd63ed
SSDEEP 768:xjT4wUD+eulV2ARAwfITyP+kme4Om9bsQSXUuFQ3NAm1Zn2g9D/DFbr:x8wUDSWA1fIWHLm9otUuFQ3NT2U9br
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 84KB
SHA256 535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
MD5 74e33b4b54f4d1f3da06ab47c5936a13
SHA1 6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA512 79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
SSDEEP 1536:8oEYbzh/Nd/NxQhApy01pxn3bJleVi0Fb+znrC8dOYUBHES/T5gMTeHOWBZeb4b:RE8FFd/zQhApyynn3bJlc1GnrnNURN5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 1.1MB
SHA256 6cf1cc33ce3b9484bc9a8741c24398b3f2e279a705f87a7ecd88824621d74879
MD5 72d29470153d5e5782ea93886bd2a455
SHA1 bee1191570371bdf1147b76469e42e8599adae49
SHA512 f036cff8f05902f1e2d90ae36964eb45ca34d60364811d125dcb243ea20670eeb21a4b2caba06c563d94547cf3b7ec9c0415e6436d1716ee196dc76232d56b70
SSDEEP 24576:MjadBuwJbjTURVWFcH41ZOXv/6VFyFUmdAp7R2DS4EPiLYzPIcbsbna/M:MjaThJb8RVIcHS+v/h9m7IGPiczQosbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 52e0accbc7fbdc037b04cd2c16ca4083e93242c4ff4d6f479fddbadbb2511ab5
MD5 e56966567eb3b19b8aa4f2d6459c454a
SHA1 e20d71d6643a93171f4785c4f5fa8f8b03edd1c4
SHA512 78c9de2a25c6e687b1f4a61c5c8857be4c506e71fbcfd6bd412745ed07b8254ab4553bb4dc5b77cea2d3fe3786bf5cda421184e5081b1211e7266d4ae15caadf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 17a9fdb5a3889d9b4c7f8dc57d53c4b7254fa810fc6615ae028d8ad3830d256d
MD5 4533f8aa81cc052accbfa9fd712b4b52
SHA1 0f58924d082a16421c6f67db6f2cf03aa028fa9a
SHA512 8e2b5d52007d776d650ce92cd801134c70a31cd50ce5318baf950687401f30c4f5eac318e370502181fefd83f8e7c2a71fa1726450568b386ecab12d0fcf77a1
SSDEEP 96:aVvrCDZQpG5lECvQmkrVJmTF0121SXGjQB3tSpslkAx:aFrWOq+CbiJPBdVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 07a2b0492388e8066529e00e2bf7e0f06643d1d824b2a4c018137d1b42a69138
MD5 7baa8b739284e3f6cf7b3a2b87fea5a7
SHA1 c618a28e7092975544f12c9cd1fd1fba529e942c
SHA512 1a66264683e6e97750b16ee04c57c68a448b242cbd9840d102e1a033a6964a5438b12db631ed3b79c26431e49d8cfac0e6d9c51c4021c8b0a396171e4e659638
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 550B
SHA256 aaa4f74b3937d01e1deac9b84104072f2d472cce2ca3bd5e3866887c3d94d492
MD5 ac636403dac0428bb37ad7a8d0fdcd40
SHA1 4f220a3fa256f8b6a3cab15de49fa422b0156080
SHA512 93dd27c128fe60a691c271d111663c395953a45d5f7d2018c49c84b3f0a72290da9bcdcb4075d31c67853e0d8f67bb2c388541ab1d6b6addaeed29b94aca3f81
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 bbd328e6736ca9584daef9ab739b15af6c37339d914e3f797bda977aa3014a70
MD5 2451a07f52b8c47844633071a2e20339
SHA1 ec6d5f04d63ea70a0e1a9b2298f025de47a7c739
SHA512 19e9e1b96bc29306e802ff1b9971649cacb6f5db2b02dd88eb3f1a71d6fcae4017b3a3f270c46885ce433bb3b22f3e52179b75da5c7bf2c5c8fda448f57e655d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 992417b98bad4ca9ec2b9dd71a69191b8b7dad703d0cbfc27b9014916ca1d0bc
MD5 4f7ed7e283b0cbdceb4ef476851ff424
SHA1 5d603144274947511cea577835d147092b59fffa
SHA512 61e36781a44d4df3f495b99bb6fa7f3a0be406d8d551de957e89478f6718d39a78f180514d307ef3c5bc465d45e3e1b1b276553d9781e7d13f213c3d57d1522d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 f4936db3436be69ab453cec5cfa30d3f578a9be0b6535b96fda894fba9f47d93
MD5 b847dc4f4f6e0de4a7ee4152d0ada0b9
SHA1 d0fc699558de6348a179bd483566302c07e89b21
SHA512 c3b22101047f340d5b1dfa08767cfcba2dc1f732f2dc1a766b15413620fe746d54eca3a315263d9631d238c43adea9dbf511fc85c6cd31738393b5332d1ae4de
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 15dd72a7081e9780416624ea1d9e64669e4df9d8a179b5489c3c2200df700c90
MD5 112b0e470ea8db4dd7c85c82ea75001a
SHA1 21f482816593635d694c2db527904b6dc2b2f65c
SHA512 d8919a9bd88ed7828f4108f159eb0f9f125a7fdd857f8fb1a17c55e1f6745796f59c36565eea7d1c33c3ba6258b97299be84f25470df1aebe45e3c71cd4c3ba7
SSDEEP 96:n2k8sQ7I1P/V+12wp1x1WMoiaR5mde7C/vWGzqfs4wMUX+UWQyV+VD7AiEwb:n2kJdV16x1WMatC/zqE7L+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7b90190a48a757ff600570961f923e21e161dc3da42faecbe8b340ca4cb6b37b
MD5 3e4ebd230900d4328a18b34053ac8242
SHA1 061dc7a4b870be457c88871212134fb3d4a3c0af
SHA512 0bfcba08b8eab666d243b214bda80b4a5aed5b4d4c4d58a93ec95dad0e770d59ecd449db4a74fc845efcf1fd425704b755636f8d4679d607097e6b17011872e8
SSDEEP 96:n2kmI1P/V/12wpnKWMoiVmdeibkMF0fs4wtUX+UWQyV+VD7AiEwb:n2kPdVgEKWMSbk7E7U+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 65fc1484fa0cd2a2e2a898aabb9155e292a24e3c6475c5f5ddb91dcbf36b1619
MD5 32231301b80e8156c02ee9c501bb6b2e
SHA1 ad7080643c98a1313db3a0dee7f1b94a56ea8c8e
SHA512 d33761911943e970059b0076b8613fda5c34a7bdfbb0f3ec9bf1f812cc25c65ac9abce9f86099e396e0f3109214adfae8d5bab96a771b636720b3c8766c86b77
SSDEEP 192:n2kCdVbGWMZN7s4xdochyp5XEvqE7fclg:n2fdVqWLD1infH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8325318a62a0bc877753cd49a7f74cb2aefdc9c549f1079764610f2ef0cb24bb
MD5 af5f9883de6e8a83ffed932de9449259
SHA1 4714ec028c365cf62e4384e2758577dc98d0a9b9
SHA512 a81a81466dbb3d352b0db51cce390fee92da563524417a67b380d9c684c020fea956e21970fdb2a300ff3908ef3820b9371862df24031da3f91d9d883d704473
SSDEEP 96:n2kbI1P/9X12wpvWMoiVmdeHuwuUX+UWQyV+VDCziEwb:n2k8d9oGWMXFZ+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 120723ce1333299b1098b1f88844b881a39c48a6462ffc52acab05b5cbf52a37
MD5 78a75244a25e2c8f04059e0709d4f65a
SHA1 5dcaa7c4189970b120072c1997be3c48d325f2a8
SHA512 f5e0aa5862478f2d63d62f7d8e8fd9c82661b782d5f1c8344ee27572cfecf5164c0ccba2fdd520d0303ddc03685b775ffb00454ba8372883ab2eed53b225be80
SSDEEP 96:n2k8sQ2I1P/V+12wp1x1WMoiaR5mde7C/vWGzqfs4wM6X+UWQyV+VD7AiEwb:n2kKdV16x1WMatC/zqE71+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 657b061962fde19f665f7831c9209ab5321eed8a74d6046cb5077313f944b309
MD5 759242313473eed6fde9320450d72055
SHA1 cda57c37ad10cdccfbc822a9950d5e6e024dcd46
SHA512 e6b719241f8f2effdf374b1e3df4120db0e6d92b14a0154f9810f99313f4b09336232951bcb959092aaff2a9c1671250696a0f87f0c9d6a236ea2001aa1f1216
SSDEEP 96:n2k8sQxI1P/Vx12wpqqQWMoijR1R2R5mdeyyphrC/vWGzqfs4w66X+UWQyV+VD7l:n2kddV6vqQWMj7Y0yppC/zqE7T+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7f8bbe539405478e1c871fc8e8b9d78b7c5d14cb6c502c166a1becbfc42c270a
MD5 49df4c28eec22789c3877ad9df3a594d
SHA1 88cb437ab8dc5d933a7b9377650a6c65455f1131
SHA512 5e1b7ee6f063082adcfef8da2c500ba5b275140101c6a78b92e9372aaf96e0918d0047878704affa83f32da98a7396982b82637352fee58aee2cf1d4d2e1c8a0
SSDEEP 96:n2k8sQbI1P/VY12wpl4N9WMoijR1R2R5mdeyyphjXEOjGzqfs4w86X+UWQyV+VDp:n2k/dVPpN9WMj7Y0yp5XEvqE7F+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 07f6a0baed13b31f7f45a3baf9088ec0c3bc9b24387b9635b5e49d115f6a5b81
MD5 020848429ba1f907cfe046c1c3dcccae
SHA1 e0e3dd4fe3acb438f09a39828bf4ad08d75e5df6
SHA512 8b4c69455211ac9dcaf5a939e8b54f3e28ccc9b35b3acec158fd9ddf156ed5dbd40762a454400dd89d4ac96b030d9bab98eb14ab7a737594aeffc84436a41db7
SSDEEP 96:n2kSI1P/VX12wpvWMoiVmdeHuwuUX+UWQyV+VD7AiEwb:n2kLdVoGWMXFZ+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1a08cd62a8e4bb1b201eaa318379740dc4a1b49af1685a15b086ac1c4ac31fc8
MD5 6dee174c6f6003bf353d65cb9600336e
SHA1 8fdc86c3d099dcd0ebd00bf910372f2a65c77f54
SHA512 4260ca4d419c8cd547d4e8436a16193df1b40df6e3304e39e325a2dde390243d62238474478876b7282260d4cb9fe456d1694b28c41a4084d5cf89cbda4b0aba
SSDEEP 96:n2k6I1P/V/12wpnKWMoiVmdeSvuhJ1juwOMRUX+UWQyV+VD7AiEwb:n2kTdVgEKWMGuvhFfw+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f3d8a9c74d267ba759da0231ce5b27d00654fae41535bbb465b92e2489ae415e
MD5 6ae186c34cd83487674953598d6a0003
SHA1 f4b740df9e4d22955f8691a0ba55cee8fa95ad64
SHA512 b0de896c6ff427bc13da17afc857ae148aac29f2de40bea725bf6ade1ea3afb595006c57738b7091b2be4853f08212cf8b565a595ef2a2a762f960c4378ce8d7
SSDEEP 96:n2k8sQxI1P/V+12wp1x1WMoijR2R5mdeyyphrC/vWGzqfs4w66X+UWQyV+VD7Aih:n2kddV16x1WMjY0yppC/zqE7T+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 c2451a848d9497b0346471fae9d7ee1b83d3ed2360fe2fde9956ddd1438f84cf
MD5 5c31ddb4008b6037ae40ccc255cbddd3
SHA1 e67b81c8c8acf7a93b46d0a906f3a9cc50021b53
SHA512 5d173695dc8f2ee4f0f85e292f10e3c2e6fb9feefd96bf9a51a01b9c94beab867610d9f2da4876b4d3d8f41bb90fa9f69e246787efded5f7ca85c593431351f8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 a402e5865bc6f4e81c6f00f8f43c8782e904c967db4a1d0f864c307366559b9e
MD5 b0ed1aad8bdfed1899862c27394dd71a
SHA1 d7917a1d0e64b313344a068a2a6d56ecc2659920
SHA512 8caaf96964883ff3a9ae362df641c4fa151e4c01ae811158f06891be7a28219fbdc04639d1021add6826230be916bf78dff60363a3bd96179272c39ef2b6db22
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 41adbd9e3f5f114b89a0c309b9854bc47599131ecce7de234576287be702debc
MD5 318866b2e4db9bb31d9f735fb986816b
SHA1 dcb141d7f4217ab7677299911871abd4a9a3876b
SHA512 647d68b8ca61b11b3c7e7bae19b1b158554863f7e61093543c809ba25ce75758a791f1e8449afde8b71b58108c19d7cb0105dd737bbf0e4dbe01d903c5c4c27b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 7509d0391e491caa9215aebd26e0bff06e7d9a7e272c3f973312cf4999f1a8ec
MD5 ba51ddd413b7e6adc59b5552e0d21123
SHA1 a17a5cd436d67f5924327e089e6325c8279bcf3e
SHA512 0af41f8d464b7e17073c82f36b966ff203ffeb5da30bd7d7f9528fb8f442e4d0e4b032e41bd732501877f579ce376437f666032afe54c2aaf3aa5ac4646ae9d6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b5ba8fbc5a0b6e7711b532a923219a99db395bcf2f0be47d78946c0b2ca69874
MD5 a00cf7d221c37b68cc8bb8ce427f2903
SHA1 3d43614afa941866f4871597fedfffccbc2fb9ae
SHA512 5399ba278b550cd145df50f12f1f985a3510b78bf331a9150949f67b23f3fbd91d0aaa94a789d4d20fe1e02a4a60604d9b6f490bd0533082479c3cdbafc74b72
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7c3be2a6e54e8e239f1c70fb103eec42473da0fce5e88478adba537835cdc3e9
MD5 84a034d87bdb419714cee3ad833ddb73
SHA1 496d7e167e8944efc1a7c53874339121af90ea64
SHA512 c88b67971d40dbd1b29fc98d5a86fea8d68ed1a5ed4d3f1f1cc500467503b0deb393c375583b30a31f9c5b7be6bea68875e7505aa46c7794bd7f045ad41f431c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 12d451d6f8f43fc8e8f04a7b23750ef160f249a25594fb021600044ebf628e10
MD5 0bf3da42794d30d14e493cfd60ce94d3
SHA1 f010e355bb4517485107c316bb659ead03aec4e5
SHA512 073d18a4dc86468061add270d95f9a75fc5d4058661bdfe1f463e82ff527b05ddf1a8f2082cfca4eadf18948078f5806988aa2d15387d47da6af200aae8071c4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 f184160c2d74433388b42d4805af67c9b398ed9481ca30dcf557d6fffec6734a
MD5 95c47bcc21eb1f58f7918515b2ce0025
SHA1 79a30ba53c219b5a84c3e6fef69538fb4df5f257
SHA512 1c767ddb333d101cb7b6cbfca3a6cc638dbdd3b48ae673856a8138a152096191ddd363e14b83d48b8591de345afd4ea50bccbd449cd00d16cbc563d54fa086b8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5aa876.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5aa876.TMP
Size 538B
SHA256 48ef832b80aa64b9185d6f4e18002413170c7284182853e31f382cb6dcfd0de0
MD5 ff97115cb9e3aebd64ed10c6566c6207
SHA1 b06b5c0f0e56f1dfa6e63256c06a6ffc5702c102
SHA512 1e8713409813f0ef795ca36f8d8a56257e2f9345f894e2f3fcf6bcf65a7e360e97a3e3e2d682071aca71d722d9462ca1badfcc07bb971b62f3b7613f1549a457
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 361b802f81fa6662efcbd91ee28942d74d76cb0c71edd8293e0a328b415deb82
MD5 26f82473b0f80403c1de8772ad29d661
SHA1 3d4ff13687e7413cced1960a93d14d551687cb9f
SHA512 4281595be907f5594465c40e23b2c99cee7eec94049b79c7c8bbbbebee08cefa49ee8ee13d7c2a124ce9e40aa51a0486af28a2daa3393cac060ca40a0d44ae7a
SSDEEP 384:c9iIxuERzA83h09RZxYo7p9Ol/tKb/XDafEBGT:HIxuERzA83h09RZxT7b0sb/XDa8wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 82d32ba075ea9083290a9c5d2aeca99f967de916e36d047bd45c60ab9e2b5164
MD5 0c1c9de86a5245d182af134893ade597
SHA1 a6431849caf020a4af7062a86f82cca3a93a0ca0
SHA512 28fd33d00e134f4c5680fbf6eda92cf8f6ade1299b12b9fb5ad4f352c65ccc8a8a06a4bfa3e20acc1edfebdbb9b1c1fe327fbd4b47558458af227228d59f269a
SSDEEP 384:X9iIxuERzA83h09RZxYo7pql/tKu/XDafEBGT:MIxuERzA83h09RZxT7Ksu/XDa8wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 5649f6de65700aa525163d4ffbda7d6601797a3e48837ad63ac5023c2210b946
MD5 54aea63b34bd87f9ea8cfa133d60dfc3
SHA1 eda8c6a6c54f8b20894a4de3b4cfb0edf7b90152
SHA512 4a206c27220bc8e46fd5edb160f9f973aaa1a81a73b08a6a9142cf5ea6018e791a5223f27ed5e0c8f09c2a488a24656964230359511b7c94f0579f040f09139a
SSDEEP 96:WXoJZ3ob+MWwIXM5aoJgsuM8oJBYh9wTYhdoJ3uMQoJnIuei:rLYbk8L73oDwNPBIri
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.htm

Path C:\Users\Admin\Downloads\download.htm
Size 211KB
SHA256 c7cd511785d055ded5e59c25442690834a77e4870f77c7a267f187228195e851
MD5 2011159e39cfcc93391650001609a4e3
SHA1 ea84c712196f2923c23997d39954eeb4bc5a3220
SHA512 62f902f73cdd67649a09377f118935e564585721224904b88d8d9df92986552c4a08bebacf5495f7e71521862e4f920f192e7eef63d95907d285cda74ff7e5de
SSDEEP 6144:RO7aWDgkhLEOPPdc1/DUGWZxsW/f+n5CSxrZVCfE2VpNeZ8:u7ay56tVChVpNeZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memz-master.zip

Path C:\Users\Admin\Downloads\memz-master.zip
Size 17KB
SHA256 319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
MD5 4790677e05d72ef7429dddf35562bf4a
SHA1 4243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA512 a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
SSDEEP 384:svCxvUI97GtSIiO0mw3pxspoCWdZs7n52mbFimtuckPXEKyuGSXCfAKrLwWtc:svZIZiAOnw3pcoYnFXoXEKyuZSAoLwWq
MD5 SHA1 SHA512 SSDEEP

Submit Download