hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2025, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
108	3092	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
5456	SpySheriff.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
103	raw.githubusercontent.com
104	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com
107	raw.githubusercontent.com
108	raw.githubusercontent.com

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1290218231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1290218231\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1290218231\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-NL	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1703670860\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1703670860\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1703670860\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\LICENSE	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868752143046618"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{CDC361AC-1962-4C13-ABA0-F7844F15D8D0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4680	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2084	1976	msedge.exe	78
PID 1976 wrote to memory of 2084	1976	msedge.exe	78
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 1936	1976	msedge.exe	79
PID 1976 wrote to memory of 3092	1976	msedge.exe	80
PID 1976 wrote to memory of 3092	1976	msedge.exe	80
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffd9d59f208,0x7ffd9d59f214,0x7ffd9d59f220
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2000,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2204,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2480,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5004,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4196,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5624,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6440,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6796,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:1840
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5272,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5736,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3472,i,9472372885621080342,6065961332067732770,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2428

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7428cc72-42f6-4079-8cff-da3ff5835d40.tmp

Filesize
55KB

MD5
650554902b9c1bf81350bc4e143bf816

SHA1
cce4e393ed817ea3a57a3475665434c3a400dcd7

SHA256
88f81c3b17a300eed42056178afc3c9e9031fb3be70d0fde06db5f3f2ffd12bd

SHA512
481f7a705a0647737b72869786a0837d769479c8edc632acb64915575c84439497c2bf35f36bdc90c2ddaf139743ea0b49ac209035b6fa18c2be35273572b8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
da2d34a72f4f403d0f50e32d14d0f8b9

SHA1
bf43f41f4934275501108fc0233c4365345be0ff

SHA256
147e0a7cc020d068fc0cd12929c96b97b102d95fa89609f5c5b1d4126e60a82f

SHA512
ca298d13039b617a3a80105791c5bdecdd18b248671abd19cbb9a2cf8ae59e87c6cffbb5e77048e3106c04786a69afa2dccf3daa43acd6c91556764651d18546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57a940.TMP

Filesize
3KB

MD5
31cc2d828fe130e8c413922d6f056c91

SHA1
5bf02684f9d5abe7aceac0064cdcb1acd8dc6ab2

SHA256
17558baa8bca4e2518070d02834f0aa83ef3a6ba59a11ff2d6a21faeb16ffa83

SHA512
53e7d1d38c9ba8047c344418adb352e3d3ce9f42f082959ea6763972521f7dd68ab3d2dc049a9ffaa150cf79cb75113f0ec488710b0c3a978c32268a21b2ac29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1a625958abd6f6b59ddb48a3b0d44f2e

SHA1
e8e6dbfc393190c0a8e42535b7fc6fa9a6695703

SHA256
b02093cea22cfe279d0c5794a3ff078a93fe697900a64fcd8cc2fcc732642594

SHA512
9bb6093ae5cb904bc7c1f880aec4af0568ebcabeb42a71bd440d7ebb51ff7038ee7a26edc215e7548ff57dec1d80c6e56b28c63579612e2423f5a2716d5824cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6c2cfda59bc46666faf4c5afb9ac8f52

SHA1
ae9dc18bad730a30f1909ad2637cb00859e39019

SHA256
09d1077dc4a1a952412b0ed609a5457fd62d19a69942392561f9f68783248ff5

SHA512
1ad2a756eea0f5fe8824ce803679a9d1aaf622e2f6a144ba6dfcdba75d5523e7edd5a45be181aadfd6515c7085c7eebac9f8496bbbd8b1c167e8520c53b27683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5bb429cac530ad9f18075cb866f0b953

SHA1
7944ac0d6ac55f9cc26358187dec339a6df8b3a7

SHA256
0fb8a167f591e8307c16f41744ca2ff5adf3efda8ae4102bfec76a388daf4526

SHA512
4acc2887fc61080e7554f0fd4cb350445e7ac7011aa4d0730e134e8b64f576a77e831f7ae5129d936ed2d3ecda183a8676fd7cd9370a11b3766c0db9654702d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
985185f77ea87fa2b41fd205c08fa58e

SHA1
877b7579a027c403aad9a333e62f3f8cc811a594

SHA256
88863097688b9091888b1beb181c32469963be0fedf57f316ac50365a1bfd529

SHA512
089c1bfe50fa3e8573e26eeadad99bb8033f6c6b4a26a7d0bf763b96b971e63ee045ec4bb34e1c3196039f254aea5e7bfac8e2328c00921bde9558d5a211e790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
479a699f1f2170f030d9a615d41b14ec

SHA1
bedd0b5690bc5c723ad135f8310c44a00f57e0bd

SHA256
823006435a1b30978a9b9e4daa9d91c1431ac34415260e05ad63ea7e81167fa0

SHA512
1b52ca059cf9bdcf84efd04adbe67d7f5ecb5712982135ccf67f9c64ebd6e5b87881480aeb1632fb66bf562111c3f0ed41d1c3e05b1c9ab5cf7b492e75afebe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
4dcb31ef07fc137f3dd67215851224fc

SHA1
c63f460bc9780ac784f5a65f3163b81228994676

SHA256
d823a3f0c47270f32446150f9009942a64e21ddb24949f5f75d61731b5a18e02

SHA512
1c992dcc81bf81fe15d5386d7b1fac0ab4b82a86ec822f4b7fb3d98a29620ac06352e8a3e02bea8ea866ff4dd9bebd4d17d70d1fb7e2e7e03ed432c137ccd363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
a020b3de5215fbcfd909bb4a2c04f0e0

SHA1
11e95a5d82d47aa7a53903d68a66e760cfcd5caa

SHA256
08ee3f2665f1735f6fd8999bbecc4dbf198414849b859d9a0ce5eed08591aff7

SHA512
d831b73f3e3fb1cde022730ad909e9bbb2f68961b880cbaceb0a2236f141d33686fa002e9f9646634361e1e9bab34b42775976dfad9e47d82ce263e47b6dfb68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
4926f71c2db825ec5c04fd43ad803895

SHA1
d0458b0af7b071c44059c70943d2858a59951443

SHA256
0653a53cbc3e7656ca5c4ff830bd32335fa48b19dc611741fc8676cbedca54fe

SHA512
58fc9cec67a4499ebcb6fe3b70195bdc31dbae4b879cd0fcab74de5713f52defc0473ba3c382ed9af8d63a4a7dc511c230bd2865361f219805ee7001e879e4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
f0b1fae3a7b2a153d3092db860800eeb

SHA1
3da063d51ad22bb7863fd08b3aa81137032a0549

SHA256
fe524ec817f84d1f4aa2a03b6acfa25ec6ff7a65b72a68b16e394d164749843e

SHA512
9885e39dd76025cd854953f766d70670419934960911e5ea7ee3dd9c1a35e12b5c3a9af3e67725218d3bb7829f6df6e44d48aaa8205040fe21ffb3e62dbfe0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
367d14bd1091036a49edc495de25a556

SHA1
24171ff57992924abe849881b45b2df6c54dcfd8

SHA256
5d50b7062965885fdf1726a0ca239c1435cc805bd3e36f6cad6724fe2ac01878

SHA512
a6fb879cf029415e3a640430946eb0a9495a06abbef33cd20228dcde8cb0dc9c769809a8a0129fdb06e395735671b62ec73778c20276d89f588132e2a622c16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
82c3fdce1474f82769b823e3f1d60f6f

SHA1
d9a61568e4af824d7ad95565ef65b469a7e4fefb

SHA256
6760e3e008e190eb9e61316867f30d146077570743403d658ff0ce002bd7a995

SHA512
49aa3529adff90e224c217cd00ef113d33fe9dcf9bfcb3e156d7db7ee6674f3bc49b31b63eb50bde16039ba64bb9af036da6524fdccb8e7b56ba9c3456608f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d8f793737406568ef75667ab006d91c7

SHA1
2241c40523cccd5a633d87214b2a6ffdb9aab054

SHA256
566be4cdb326ff6b79cd2805a01868ef86d14ad5a19cc80516a5f77cec2c46c5

SHA512
822c6d265d5ffedbdb2dd64e4b6a9fe56a433a12709dde9dae10a9355043d8e78a39bd91a1592a2ccc576438474ee6723d829bef77f5d73ac86ed622ee2e7ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
a7a474826b9c9aa4dbdb96208612a68d

SHA1
13dbb399397cc99e09ce036bbcadda5672550510

SHA256
e4799901fe37064579a09bcee8f7032680e0b3b1d128e94e6ad3a07a9e815251

SHA512
59c784d2ab744e50ec31948fffe04189fc09df43535ca7ff2186e0528392b90d72d84794d8ce5ba2c6b21d77b71856f5a65f9a8422de792e8efe427aec94a48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
6090f03fc7a41fb8cabd39bcbe47e6b2

SHA1
5b17d7c1539ab9815fb8e83e8f7a016b3cf0c0ea

SHA256
5bb8c4ef8da4ddb00c48f30191475271ddf781eea2e9f1fa0c5e626e5a0e957d

SHA512
8c6a6a7fcd7ce0d06de96b937e98f91e20ab0b1b3f32f91fec262b96ac57340a3eabb43ff923cc654df256c20f09edad625996ebfe5c50b4a57ff5c98899915c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.19.1\typosquatting_list.pb

Filesize
638KB

MD5
ca87451145b7744bee71724af1feca21

SHA1
3d99f1ad97326e49ef04904db63c312bd8c64612

SHA256
d03de614aecf8590e013746de46b715605b72445a14702edbda12b5ce2db3df3

SHA512
ef4a47b30b6b03bc73e4c876111af6d08f741998308bde635427d466d4800f8764ea94462f4bd9f13d21c9eff12cc3c2b8ac13433a8cef3f7aa5bc8395c4285f

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
84b5f1bc195a6222f206b17e996603b1

SHA1
0977d729289199370a82df58e2a5979e9231dec4

SHA256
8c103258f8f41d60bb852ca9c6da03f32db9dde9b8c5a2a5e688e776619d6a98

SHA512
453ef62fa26666512bb257c5c9971ba0b87d47412a8b7256b62a61c2328141442c55f2f0183c7acfabea02285fb0dd8611dccce75635a3074857d0a6cf2a3072

Download Submit
C:\Users\Admin\Downloads\SpySheriff.exe.crdownload

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1290218231\manifest.json

Filesize
118B

MD5
1c86577f2cd4d32c2a66df8ea2688d85

SHA1
35a17132f6e9fa4cf9f7cfb307870eef46b697f7

SHA256
312e962260bb133a4c811348a75396477d2bc284701393137cbdad971317578c

SHA512
ab8583a6c1e0f34f937296d12b9c045c99a8d5eb61fb36e797940cb0bd65f952eb99cfcd44c56ae45d6d14ff330bde0bfbd9cf5c18fb8296bf68a64b38ef7594

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_146464722\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1703670860\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1801886071\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
memory/5456-585-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5456-643-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download