e04bdafc01429711c069136a2caa54cf8b20d2cee700e576569de57f09a2f3c6

Resubmissions

12/06/2024, 15:16

240612-snmfwatdjr5

12/06/2024, 15:13

240612-slvpgatcnm5

Analysis

max time kernel
150s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
12/06/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Run desktop apps online.html
Size 704KB
Sample240612-slvpgatcnm
SHA256 e04bdafc01429711c069136a2caa54cf8b20d2cee700e576569de57f09a2f3c6
MD5 635f65de088d30a34365421858161354
SHA1 c974e333c2851cc4e54132f0d5f4b133e1d2f468
SHA512 1d5dcfe9478960a6ac174c1b9d0c304f4f6dfbb725aaa94e737fc5155db061881c4c887d82cf8c327f32edd53af943b38dcb251e4eaac964b535a338b01656ef
SSDEEP 6144:BwG+iY07vK2VAB671FszYJT1oj8lEKHZ98eROPx0yFTpM3vn0VuFs16DFktUAY5C:BwG+iY0ZR8OyFTIu7oGt
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f12da634dbbcda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "424976286"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b856a020dbbcda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = c0c5d67e0dbdda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 46ee9619dbbcda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4952	chrome.exe
4952	chrome.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4680	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4680	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4680	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3636	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3636	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3636	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3636	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe
Token: SeShutdownPrivilege	4580	chrome.exe
Token: SeCreatePagefilePrivilege	4580	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
968	MicrosoftEdge.exe
4948	MicrosoftEdgeCP.exe
4680	MicrosoftEdgeCP.exe
4948	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1392	4580	chrome.exe	80
PID 4580 wrote to memory of 1392	4580	chrome.exe	80
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4460	4580	chrome.exe	83
PID 4580 wrote to memory of 4452	4580	chrome.exe	84
PID 4580 wrote to memory of 4452	4580	chrome.exe	84
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85
PID 4580 wrote to memory of 1748	4580	chrome.exe	85

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\Run desktop apps online.html"
1⤵
PID:4536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:968

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa939c9758,0x7ffa939c9768,0x7ffa939c9778
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4412 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4732 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5216 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3080 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5548 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4552 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6116 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5988 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6120 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5944 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2920 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5928 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3912 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5124 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3868 --field-trial-handle=1880,i,13648665082598862426,9792544011571133568,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e4
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_00006b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006b
Size 16KB
SHA256 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
MD5 12e3dac858061d088023b2bd48e2fa96
SHA1 e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA512 c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
SSDEEP 24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3e9fdfbf924a44fb2d567cde73f90348d296653611581c5034f45c8ea79a5f97
MD5 f10298e6d98c40a5ad4ce74c97faf986
SHA1 de8fa27512ebd463bd987e0bb60378633e26f22a
SHA512 9bf41ce9d9491410714fb18a4aea8ff470fb229ed89c2404e2893b478efe46a3035053388966659a07dbeee9e2d8288aa13e9f3160bcf5d1c8540b29533ac8be
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 56db8de48614f2799208d8c3ba52f85586d1f8af6680615e1f3ac9c71fce57d3
MD5 d349578deb50945942380ba3a0424ad9
SHA1 8d1a4dfd23e31f052b53210888f93f65d8da0962
SHA512 7b417549d8192f7033040d4354c6e83b585a0d82e8b46589ab552379d422664626cd002e0f1f26ff222af9d9dcae0723a3e9ba372a7edf2bfef19d176ec45114
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f358e745a5f41ee6332666bc0d2e42f3e795b514bd456b919266fe876b636ba7
MD5 9a4913f403bb79b1f5f868f94f980865
SHA1 963d72cbbf3317177f0238b31592289dcf09be05
SHA512 6b26b641490176a0272e0f590310051645cbf39453f94237c881bfd570a110414be0530ed473a406fe83d165087a39afc6957d96807c8cf76bb3417d4ae66e79
SSDEEP 96:jPD/1iT6NFwdSi+xcZeVDa83Vgs9b9GsGRAUGnGNGNPzjSO6:jPD/1c6NKoTxcZQDagV5pTuAUooMPzj6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5c9db1d6aab1ced21d50009b58fe40d9d6f1222a1f9e979b9e162b5f427abae5
MD5 71e9cda0e110e666726228fe1cd5a195
SHA1 cc3a34c928ec428c7eb303be0896054157a1d107
SHA512 9483e1eb2d6afb1a25fc128828d6faea0f6cb104c2c6ac014635197dc90281aea69689814aee72f42cd94c3914191f2ab08b6ca6c7d18e66d11417d613672f63
SSDEEP 96:jPD/1iT6NFwdSi+xcZeVDags9b9GsGRAUGnGdnGl3GjGsaq1SuzGgx:jPD/1c6NKoTxcZQDa5pTuAUoEnMKbaqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 1e5ea1a5c12a36da882b4094842ba2471ff5f8bb66626c394d6fd9ce78fa40a5
MD5 1d6de2f525a36e8f42c50f7eb56ef6c0
SHA1 158e38af14ffe32ca864bbc161036765c87f6669
SHA512 7f1358bead0495982c00594856da1642fbb98bd2f61510f70eedbd281a3a279056175a0946eda4480311c6bfaf8826dbbc3918712b04c457dab5d25f47e27759
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 f0768d944aae968d91ebb667b38483ce5cabf31e091a0ba4d9a96d92410d6fc0
MD5 be1232bb41e5861c640d12d8ec4a8fb9
SHA1 99889fcc781428d911b35788ad1d450f3cc335d4
SHA512 8d744591548c6dad43a181ef7cd46e6f7fdd97d3c69b05941cbb499b4716cdd31d715059b64d5e97c9b9f603d53dcdcdef9d907f22e5e2ff4a60edd26186d7db
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 dfee452dd7a5485de45206a9492a6f9071f36384564cef0f816021e059c31fa3
MD5 7f52010f4a3609f7a30a4ade4b05a7de
SHA1 9b8739d7e67bc417fd2e10650bd4fc6bacd93053
SHA512 eb113d58d81eda13f292afd5344d627b5ff7c9e6cc68d09ec99bc4bbd990ad6748ee6cfbb7b1b536c46e074c6de825851c99ea68b17084fa7c41c87e633302ff
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 b5445d48e490b74476945a00fdef4888a29f543297e46162f5b0faa68b5f6aea
MD5 f43b2c066c4d281059cfe9411689f4a1
SHA1 9b884a1683aa027ac3a2cf38282cd5dfd63f8c17
SHA512 3f0d66f8398655164785643781b2471bac62fab7dd3d9cf6985cd7996a04cfc8592b3ad611e77eef89c7713892c8a129ec46082dce5588029e8793f926415eb5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 075722b99718876cf4a1cc77702a3124396669b6316cd28c98ccbb21d8abfe3b
MD5 592ec6e724313fd8cb3876c19f4a3cdf
SHA1 f219c1fb7767be537882b89e2a187dfedeb1a964
SHA512 0dda7810699f7cca33df5e6ff9fc9e392d728ba53a826b93d2d591c25cc2dcf8fb78b375c5b5366ffab6fd9039b7b59a00e8ef6a2aef8d4c6e66769c490fd0d4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 30d94122c6e68ef58d501fb42a89b7439587a788c56c7a27b9e6f635b707593a
MD5 20507209b8f87cb78cffdcd2c959a5f1
SHA1 df631048b11d60fe28cc5bc4173f90f7c62d97b2
SHA512 f928581a304a8ea135372dd9e8c5a448df851922e82dd6328fb502f2f725c8c4b8ed72f2681aea04de49c589bbcab4a28ff54dfdc475a2434f75cf3916bb7d7f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 372B
SHA256 90210ab0093bfacb63b625be048b4c35fbff1bbd2e055ab72dc3f91f4808c2f4
MD5 101b7260309a2d8b4e4367e6838aafe3
SHA1 ecef1704877c25a68999d6924fdb781cc8bc9c8b
SHA512 3634f0295c54856759f1dd7d95c104833de272e9efbb52bafed3fabcf621f85658d7cede84790295af98cb2738fbea775a31451a74c20336104cac1792800128
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 1485a185ef8e1844cb6f0b80eda192030200a57905e535b1417948656edb1ba6
MD5 4eb6c50913454ac0981feba0a9bc09db
SHA1 bfa1f1eda594f8a6d1aa0356ecf0d25a9c36cda1
SHA512 ff7116680c1d424489edb04c7b492b6f37cfa7e1623a7345c0d18e9fb363a49781518fe63f110f9c1899adb83e6766938ae07986d0e4235931c43b1abd8c68c6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 781524faee5378d356c79ebe77d92123da935a82cd93824b313c9d1be11b05d9
MD5 f80849a5770d5d0e7f6264c554cb904a
SHA1 91d9b7d2ed5e617c53857245124e907c6ad538b2
SHA512 f8a7f2c3bd02c29ee8d2b4b30e04a4ae1bfede42677df8cf6734801b83ab8e19cdee3aed1d81034f49a5c3dff47bf364b3cb5fce6254e4c708ecc667f2b3fed3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 bad6c8dad299566a79e5fc0a8e1497e84ccd29018b06d98c1f71552b047e6f51
MD5 89aa22234466c8905c7ad2078d53712e
SHA1 877cf29c1497bc01b78bdf9cf4fc7c9af3c4bfeb
SHA512 59b5f885aba033f07232cd46ff64e2ad6392eefdd30a10b4c4a42543977194107110ab0e95fd5d15f2ba1204de7933ff2a7baf3069fdd72dd7b2af3a696f47d9
SSDEEP 192:dic2kJWv7A8GM+ysf+FQVr84kL4kYmkHkzdtjEsXtScPS:dicWaylltavkptIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 02fb3768f6699c32b74bf2ea77cd6408fac652bd904b8c82b5c006e3622037ce
MD5 ab3d6a95e5dd781dbe07a6cd63f3f3e1
SHA1 f760287d03b631afc9bb17f712f1d18e52dbc303
SHA512 f3b101f4e4cbe135d832e66d9e8b9108ba76c508d428bd4b6d776aae7fa59c74e113d2de4f51b3d97e6e3799e7e4ee52436daea6ed78619c7ca60ef6a770e73b
SSDEEP 192:dic2kJWv7A85+yy+F/FkY6otjEsXtScPS:dicWKyxddtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 f10614139adeeb0d0cf168531aaf673986a308926d35f2265651f1b9747b4baf
MD5 500d61547e13376d5032dff0e741a5cf
SHA1 58905b96d4d9fab357d25ac005f4a01be79dfa13
SHA512 d5f24e332f83f40e69e0ecd439341fa657ce977d227c94264735d0af6a238d6fad8868605aae3082fef1f7b8275d151d024748915aec98af965f3ad3d7b4b5c4
SSDEEP 192:dic2kJWv7A8GM+yy+FQVrFkYmkHKutjEsXtScPS:dicWayxyv3tIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 5fd2fd0af09b89ec9fe02884ab681d60fcba81fc8ccd24c69353f834f063b6b3
MD5 41078c2a3f3b64e92d8cdcfcec75d829
SHA1 b682dfcb2e66136a369efb521867308b0845ec2f
SHA512 b24e8f8daba225506c56f2517702c016b9d1bcac4cdf35ac3e52b9e4ad14ee97274821dccc3cca644b5f91270baf14f176aebbb3423511f8013b316abc5e5d36
SSDEEP 96:Oe6abbn7A8iZRy7Di+6MsmdeABO5qujVhYtjEsXt0/cg2Vup:dvv7A8syy+FN0otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 8e0259f14a3868bedc057e62c9b565f41ed142222e76f063e89ea609ca19c44f
MD5 7a601434b3ff2b5e770d0ae692e91136
SHA1 f7515b840a73cd7350d64f9021b3a06f5a6782b3
SHA512 4efac42d05b1ff0f96727b542456b806c7a21f70668bbd238311f0c53593dfb38b4a7424184aa0ecbd97aa99282d5b19ce8499c22f15dc95b70aa3ebf66523f2
SSDEEP 192:dic2kJWv7A85+yy+F/FkYmkHKotjEsXtScPS:dicWKyxdvttIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 177af61464bdde236c2161f967be78049ac7a86a7f4be986ed2b55e2d6e5eab9
MD5 ebe91d06b33aa4c7ffa1100d283f658c
SHA1 a5e8b520d227cd38278bb962694effcafc1aaa05
SHA512 1f4d0b8d8d70d720f9706419044bf74ce262cfaf48807546e15fcdbc25f85ed5e9ab07f1d1367be32df06b7c2b1f0b73c0a49e11988feae355403242f2210752
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58c128.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c128.TMP
Size 48B
SHA256 44736b4d74ae06b31f6f86e8fe1691bf6825b54007594f9a35b6e8eac85d56ac
MD5 7914abad9e0f4898867d7d52d4b8ea68
SHA1 53ba3eb5d709e7bbb09a2610ddc8e2214d213293
SHA512 e6908286eb3201047e26c244d498126a5d7cd71af4484f83fb6dab3072358bf1949cba7c43d19ce065a855d6779e716ce9c19f19acc6af8d4965922ec7462f2c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 297KB
SHA256 77bce0abb3141ac481fea4ad760c5d85a356719b34192d1271a82fcfdd4e040b
MD5 16cb87513126ea0bd7a0a620400e5db7
SHA1 c318ebf67f97e8d6b1e3f21ff69ea37bafe6ae3a
SHA512 310732d855ea2f102347773c658dd6d08ca88f42e62d9b4017744f7a7891deabdf49012242389b476d16480884b60768ae855a2b22ff5928ddb9d1f727582592
SSDEEP 6144:vxB5/C6sJwDJo7a9AJoc0Awb/yU9iFPkNTFh0oT2IM1BFuYq7r/wP:vj5/dseDi7auecIhixCTAoTpMXDqv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 296KB
SHA256 d692b70770529f05c55a934cd136cc76a9a229770aecddcb5c654409d0e0d543
MD5 ba01471af0cfe91ac182fc3be901b6f0
SHA1 3e723138559011027436c6350013c2d7a6dd7ab4
SHA512 fc6a606ff2c5ce36321c83f7ed11a2441e42547b489245aeea381cf1914896b2e84ce30755c3eb510d70399ac1c53ea349da110f1e04acf9beacca36ba2cf0fd
SSDEEP 6144:TxB5/C6sJwDJo7a9AJoc0Awb/yU9iFPkNTFh0oT2IM1BFuYq7r/wP:Tj5/dseDi7auecIhixCTAoTpMXDqv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 297KB
SHA256 8adea88bec170ba7c13cc0a35e7a66e300e54894311c6c6a5cd67a283efcce2f
MD5 a15215c6ca163a215c546df21ac126ba
SHA1 0d2823961d04a364d5609047098ba8bf3026653d
SHA512 35adbe8de551a9acc7884e054c5385187b7ecfbf20d3a378d4e751a191beef27793af1d4a66d6d6639b510215845ce9d7c0b72ccb86c95d3a7dbd5ad37deacbb
SSDEEP 6144:CxB5/C6sJwDJo7a9AJoc0Awb/yU9iFPkNTFh0oT2IM1BFuYq7r/wP:Cj5/dseDi7auecIhixCTAoTpMXDqv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 150KB
SHA256 62eeee9656111b84b69de7f6e95d7f851b67c994031bc7c18ebf8cc6fb576abe
MD5 3774623229746947254f3d237571eded
SHA1 bb6e9dc7c828137e0e6bffd11c33947fcadeac34
SHA512 4599f4fbf8016a682d289dfd5d050729359b3ce3c2c6e55cd8fb47a7701f9240f9712aa1440ca21afcfada06cbd752cf1146faff68cc4289bcb68274791a771a
SSDEEP 3072:irMmYyU91oXxek153VKrlfl5LFzDAbvbds0oT2IM1B51huY2o67bwo/z0zPFk:x/yU9iFPkNTFh0oT2IM1BFuYq7r/wS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 314KB
SHA256 2e4eda2b3676bdebeccdf67b3e5b21463347fc556d93c3d2fdc27ef6e88b785d
MD5 a34416d707936203601cba95dafeb2c0
SHA1 e196a483a3d45a318f2c49c98c34376d9f5a62a5
SHA512 85f018a7d8bc989af463b01a650b7749a9421867a31f2fa4f37176969f216bd93d86387f99146bd3000ae831ec32c2dfebc098829780c36f5c0bb19c13f00218
SSDEEP 6144:zPwa25mxB5/C6sJwDJo7a9AJoc0Awb/yU9iFPkNTFh0oT2IM1BFuYq7r/wP:rwa28j5/dseDi7auecIhixCTAoTpMXDh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 93KB
SHA256 f1cec031d08e590e79d2ae908a00e8ef524d5cebf8a6e98e9a836b2eb2918316
MD5 9ae335a7edba6d655d4bf904a242de16
SHA1 d008edbbce7dd616ae1d2562e8dda8c2f782e56a
SHA512 bf02713015a13fe1305b7e55dafd56e67026214fc1aa4840f3c125aa99b921ec434fd9576331772697efce5e119cdcd2b4dfa4168e6cceda3f9d452399c7190f
SSDEEP 384:6NdQR+YZMnqLXQ0dzsJt3FVBaW+2ubybjZopFsi2BLbkkFt2xqo41JIysLgp9beY:6E+YZ/dm7Zff5HAmWxK03TTQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 95KB
SHA256 2a60af152ce3b6da8f001c5d605e4af03ddd4196473f0444bcb34d97571557e4
MD5 a92c103ea2c815294aa160b5d9b84126
SHA1 be2e78955d350e35367d9d354a30468b4a2a9fd8
SHA512 ecce04921e833e7d3970b19cd02b8ef02aaed8e560eb7d890c4b390eff4ec883ad8efb1c258d0de254bdaad9bcfde39150eb4b61ac3b6cef263868be45ec87db
SSDEEP 384:dNdQR+YZMnqLXQ0dzsJt3FVBaW+2ubdbjZoCYFsi2BLbkkFt2m8rTqo41JIysLgB:dE+YZ/dm76ff18O5HAmWxK03TTQN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 98KB
SHA256 e2acd9280cb23b25c6a86883059080cd2ac4371430b79a3bab2fd54568804a2d
MD5 20b8ec6b6eb2ebea82c49f78e2abec1f
SHA1 921267fb68f145cdb6f2c13cdb37fde53b10c995
SHA512 d19a6e36d61b47c3fb6286851eb4666e29b5b91f1559cbbb3f5e656cf5eebde89a032a5442486d3b5886ebfd8de6d8cf32ac47545da2c1cd5dee748e42924a56
SSDEEP 384:mNdQR+YZMnqaXXQ0dzsJXy3FVBayj+2ubdbjZoCYFsi2BLbkkFt2m8rTqo41JZI+:mE+YZUdB7Iff18s5HAmWxK03TTQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe589045.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589045.TMP
Size 93KB
SHA256 b0b2d34ccb91b1592db49006e105d12bf5d11fc992d0cd4ef46a2dbf3270c68e
MD5 efc5146d253de22a8bd8f686efb91e63
SHA1 d0ab5495584f891eefb7029b5da3f4236ce844c7
SHA512 bd12f2af16b47faf8e39a2213547985729098b4465d898f9f6cc1bc52ed7ffbfa9c8e4120943c415ecca78d8dcb61de05f29b35d46e05bd56ba056121aeb1bd1
SSDEEP 384:cNdQR+YZMnqLXQ0dzsJt3FVBaW+2ubyjZopFsi2BLbkkFt2xqo41JIysLgp9be3Q:cE+YZ/dm7xff5HAmWxK03TTQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

edgecompatviewlist[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BU0KRETY\edgecompatviewlist[1].xml
Size 74KB
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
SSDEEP 768:gL9S+ZZR8+zAmz7B4P/jRLhOzgT6YBNxdvEFd:K9/ZJAA7B2jhT6YTxdvSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\W4P4MKGY\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

1568373884.pri

Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\1568373884.pri
Size 218KB
SHA256 8b69fd5d6b540b3080b438f3cf0d42f3266654e786ce7dc5e85855d309e962ac
MD5 13e8857c11c103c86af5a010ba171f66
SHA1 dd8f6ee3cd8b1ac01c480e0843c323805c3cf2ae
SHA512 8454d4a02c15e12428628aaf9df2f5ec48d261e692a8b4f2e7e81d83c3acd6921bfb2d3ebc76f78f124fd0065852af348bec56a91e7ba9c54525615d6b7804b0
SSDEEP 3072:OglgO3SyBV1ggzwlk9m1wOkuKrF2oeu8H3RMxQHz4lbNp7h3WmSsa5jN2wC+:OgK8SyBHg1lk9m1wOkfw1w0sDONU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-617-0x00000206FA530000-0x00000206FA531000-memory.dmp

Download

memory/968-618-0x00000206FA540000-0x00000206FA541000-memory.dmp

Download

memory/968-16-0x00000206F3D20000-0x00000206F3D30000-memory.dmp

Download

memory/968-35-0x00000206F0FE0000-0x00000206F0FE2000-memory.dmp

Download

memory/968-0-0x00000206F3C20000-0x00000206F3C30000-memory.dmp

Download

memory/3636-54-0x0000020A72800000-0x0000020A72900000-memory.dmp

Download

memory/3636-51-0x0000020A72300000-0x0000020A72400000-memory.dmp

Download

memory/4680-45-0x0000027535400000-0x0000027535500000-memory.dmp

Download

memory/4680-47-0x0000027535400000-0x0000027535500000-memory.dmp

Download

memory/4752-91-0x000001F952500000-0x000001F952600000-memory.dmp

Download