3362720148c0f55011cbeae9c029debeccae3345a46e7239be9cdca8cbe337bd

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
05/01/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LariaMC_Setup.exe
Size 88.5MB
Sample260105-vabtbs1lcs
SHA256 0ce96dfec31d1aeccf3393932124c36208a5c87629f17ae792b445398026deb7
MD5 c586db959f8fd685572f567cce37d92c
SHA1 fc57ced462c71210386a83021d29d43537099804
SHA512 8668e033fd158a6eb8f07de54cced0cf78c6de38cdf6edd451590fc3b55adc6c5c5ee784cb004d493cc0c6095f318660cb6ae8178f055ffb9ef41bf86a544ca0
SSDEEP 1572864:uv+BWqL9BHxqbP841wX4HXykPWfCjpdWwbzkiNoA2eNVxFxciBA/fsWnk9DNa8rB:uWB1hqz8owXCTWwbgiPp6ia/fsNDc8rB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemWatcherWD06cb1e9c.lnk	cscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemWatcherWD06cb1e9c.lnk	cscript.exe

Executes dropped EXE 9 IoCs

pid	Process
3692	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
2464	LariaMC_Setup.exe
2484	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5672	LariaMC_Setup.exe
1392	decryptor.exe
5020	LariaMC_Setup.exe
6684	LariaMC_Setup.exe

Loads dropped DLL 31 IoCs

pid	Process
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
2464	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
4380	LariaMC_Setup.exe
2484	LariaMC_Setup.exe
2484	LariaMC_Setup.exe
2484	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5672	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
5636	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
5020	LariaMC_Setup.exe
5020	LariaMC_Setup.exe
6684	LariaMC_Setup.exe
6684	LariaMC_Setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Software\Microsoft\Windows\CurrentVersion\Run\LariaMC_Setup = "C:\\Users\\Admin\\AppData\\Local\\Programs\\whidder\\LariaMC_Setup.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 46 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe
3908	powershell.exe
1932	powershell.exe
4128	powershell.exe
1604	powershell.exe
1552	powershell.exe
4180	powershell.exe
2812	powershell.exe
320	powershell.exe
4644	powershell.exe
5648	powershell.exe
2684	powershell.exe
5000	powershell.exe
1520	powershell.exe
5952	powershell.exe
5944	powershell.exe
3888	powershell.exe
3200	powershell.exe
2508	powershell.exe
5856	powershell.exe
404	powershell.exe
2916	powershell.exe
2668	powershell.exe
5268	powershell.exe
5108	powershell.exe
5348	powershell.exe
968	powershell.exe
1092	powershell.exe
5500	powershell.exe
4460	powershell.exe
3532	powershell.exe
420	powershell.exe
1452	powershell.exe
3844	powershell.exe
4628	powershell.exe
5624	powershell.exe
5200	powershell.exe
5400	powershell.exe
384	powershell.exe
2684	powershell.exe
4264	powershell.exe
1504	powershell.exe
3156	powershell.exe
7152	powershell.exe
5516	powershell.exe
2064	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
105	api.gofile.io
1	raw.githubusercontent.com
1	api.gofile.io
14	raw.githubusercontent.com
21	raw.githubusercontent.com
39	raw.githubusercontent.com
43	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5424	tasklist.exe
5616	tasklist.exe
5000	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6860	powershell.exe
4640	powershell.exe
6788	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LariaMC_Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
324	msedge.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	LariaMC_Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	LariaMC_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LariaMC_Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
3532	taskkill.exe
6244	taskkill.exe
6560	taskkill.exe
6504	taskkill.exe
4584	taskkill.exe
6012	taskkill.exe
2116	taskkill.exe
3892	taskkill.exe
6036	taskkill.exe
888	taskkill.exe
6108	taskkill.exe
6192	taskkill.exe
5344	taskkill.exe
2208	taskkill.exe
5336	taskkill.exe
6656	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134121177657102512"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1879222327-309181551-1066679662-1000\{4D66AC8C-E56F-4639-B316-D6DE954833B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\0e12e1e8-84d4-4f83-8ea0-2ffb0de75e29\fallback-cookies\Edge_cookies.txt\:Zone.Identifier:$DATA	LariaMC_Setup.exe
File opened for modification	C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
432	LariaMC_Setup.exe
432	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
2684	powershell.exe
2684	powershell.exe
1552	powershell.exe
1552	powershell.exe
968	powershell.exe
968	powershell.exe
4264	powershell.exe
4264	powershell.exe
1932	powershell.exe
1932	powershell.exe
3112	powershell.exe
3112	powershell.exe
4180	powershell.exe
4180	powershell.exe
404	powershell.exe
404	powershell.exe
5000	powershell.exe
5000	powershell.exe
2916	powershell.exe
2916	powershell.exe
1504	powershell.exe
1504	powershell.exe
968	powershell.exe
2684	powershell.exe
4264	powershell.exe
3112	powershell.exe
4180	powershell.exe
1932	powershell.exe
1552	powershell.exe
5000	powershell.exe
1504	powershell.exe
404	powershell.exe
2916	powershell.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3692	LariaMC_Setup.exe
3156	powershell.exe
3156	powershell.exe
4628	powershell.exe
1092	powershell.exe
5108	powershell.exe
1092	powershell.exe
5108	powershell.exe
4628	powershell.exe
2812	powershell.exe
2812	powershell.exe
2100	powershell.exe
2100	powershell.exe
492	powershell.exe
492	powershell.exe
3844	powershell.exe
3844	powershell.exe
3908	powershell.exe
3908	powershell.exe
1520	powershell.exe
1520	powershell.exe
3136	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	432	LariaMC_Setup.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeShutdownPrivilege	3692	LariaMC_Setup.exe
Token: SeCreatePagefilePrivilege	3692	LariaMC_Setup.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	3692	LariaMC_Setup.exe
Token: SeCreatePagefilePrivilege	3692	LariaMC_Setup.exe
Token: SeIncreaseQuotaPrivilege	2684	powershell.exe
Token: SeSecurityPrivilege	2684	powershell.exe
Token: SeTakeOwnershipPrivilege	2684	powershell.exe
Token: SeLoadDriverPrivilege	2684	powershell.exe
Token: SeSystemProfilePrivilege	2684	powershell.exe
Token: SeSystemtimePrivilege	2684	powershell.exe
Token: SeProfSingleProcessPrivilege	2684	powershell.exe
Token: SeIncBasePriorityPrivilege	2684	powershell.exe
Token: SeCreatePagefilePrivilege	2684	powershell.exe
Token: SeBackupPrivilege	2684	powershell.exe
Token: SeRestorePrivilege	2684	powershell.exe
Token: SeShutdownPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeSystemEnvironmentPrivilege	2684	powershell.exe
Token: SeRemoteShutdownPrivilege	2684	powershell.exe
Token: SeUndockPrivilege	2684	powershell.exe
Token: SeManageVolumePrivilege	2684	powershell.exe
Token: 33	2684	powershell.exe
Token: 34	2684	powershell.exe
Token: 35	2684	powershell.exe
Token: 36	2684	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	powershell.exe
Token: SeSecurityPrivilege	4264	powershell.exe
Token: SeTakeOwnershipPrivilege	4264	powershell.exe
Token: SeLoadDriverPrivilege	4264	powershell.exe
Token: SeSystemProfilePrivilege	4264	powershell.exe
Token: SeSystemtimePrivilege	4264	powershell.exe
Token: SeProfSingleProcessPrivilege	4264	powershell.exe
Token: SeIncBasePriorityPrivilege	4264	powershell.exe
Token: SeCreatePagefilePrivilege	4264	powershell.exe
Token: SeBackupPrivilege	4264	powershell.exe
Token: SeRestorePrivilege	4264	powershell.exe
Token: SeShutdownPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeSystemEnvironmentPrivilege	4264	powershell.exe
Token: SeRemoteShutdownPrivilege	4264	powershell.exe
Token: SeUndockPrivilege	4264	powershell.exe
Token: SeManageVolumePrivilege	4264	powershell.exe
Token: 33	4264	powershell.exe
Token: 34	4264	powershell.exe
Token: 35	4264	powershell.exe
Token: 36	4264	powershell.exe
Token: SeIncreaseQuotaPrivilege	4180	powershell.exe
Token: SeSecurityPrivilege	4180	powershell.exe
Token: SeTakeOwnershipPrivilege	4180	powershell.exe
Token: SeLoadDriverPrivilege	4180	powershell.exe
Token: SeSystemProfilePrivilege	4180	powershell.exe
Token: SeSystemtimePrivilege	4180	powershell.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4380	3692	LariaMC_Setup.exe	79
PID 3692 wrote to memory of 4380	3692	LariaMC_Setup.exe	79
PID 3692 wrote to memory of 2464	3692	LariaMC_Setup.exe	80
PID 3692 wrote to memory of 1776	3692	LariaMC_Setup.exe	81
PID 3692 wrote to memory of 2988	3692	LariaMC_Setup.exe	82
PID 3692 wrote to memory of 792	3692	LariaMC_Setup.exe	83
PID 3692 wrote to memory of 3140	3692	LariaMC_Setup.exe	84
PID 3692 wrote to memory of 1716	3692	LariaMC_Setup.exe	85
PID 3692 wrote to memory of 3688	3692	LariaMC_Setup.exe	86
PID 3692 wrote to memory of 2240	3692	LariaMC_Setup.exe	87
PID 3692 wrote to memory of 3196	3692	LariaMC_Setup.exe	88
PID 3692 wrote to memory of 4328	3692	LariaMC_Setup.exe	89
PID 3692 wrote to memory of 1156	3692	LariaMC_Setup.exe	90
PID 3692 wrote to memory of 2004	3692	LariaMC_Setup.exe	91
PID 4328 wrote to memory of 1504	4328	cmd.exe	103
PID 3196 wrote to memory of 5000	3196	cmd.exe	104
PID 2240 wrote to memory of 1932	2240	cmd.exe	105
PID 1716 wrote to memory of 2916	1716	cmd.exe	106
PID 3140 wrote to memory of 404	3140	cmd.exe	107
PID 792 wrote to memory of 4180	792	cmd.exe	108
PID 2988 wrote to memory of 4264	2988	cmd.exe	109
PID 1156 wrote to memory of 1552	1156	cmd.exe	110
PID 3688 wrote to memory of 3112	3688	cmd.exe	111
PID 1776 wrote to memory of 968	1776	cmd.exe	112
PID 2004 wrote to memory of 2684	2004	cmd.exe	113
PID 3692 wrote to memory of 3748	3692	LariaMC_Setup.exe	117
PID 3748 wrote to memory of 1932	3748	cmd.exe	192
PID 3692 wrote to memory of 784	3692	LariaMC_Setup.exe	120
PID 784 wrote to memory of 1696	784	cmd.exe	122
PID 3692 wrote to memory of 2092	3692	LariaMC_Setup.exe	123
PID 3692 wrote to memory of 2396	3692	LariaMC_Setup.exe	124
PID 3692 wrote to memory of 1836	3692	LariaMC_Setup.exe	125
PID 3692 wrote to memory of 2496	3692	LariaMC_Setup.exe	127
PID 3692 wrote to memory of 472	3692	LariaMC_Setup.exe	128
PID 3692 wrote to memory of 3820	3692	LariaMC_Setup.exe	130
PID 3692 wrote to memory of 4056	3692	LariaMC_Setup.exe	132
PID 3692 wrote to memory of 3024	3692	LariaMC_Setup.exe	133
PID 3692 wrote to memory of 2112	3692	LariaMC_Setup.exe	134
PID 3692 wrote to memory of 3960	3692	LariaMC_Setup.exe	135
PID 3692 wrote to memory of 4656	3692	LariaMC_Setup.exe	137
PID 3692 wrote to memory of 2064	3692	LariaMC_Setup.exe	145
PID 1836 wrote to memory of 5108	1836	cmd.exe	250
PID 2092 wrote to memory of 3156	2092	cmd.exe	148
PID 3692 wrote to memory of 2244	3692	LariaMC_Setup.exe	149
PID 472 wrote to memory of 2812	472	cmd.exe	150
PID 2496 wrote to memory of 3908	2496	cmd.exe	153
PID 3820 wrote to memory of 492	3820	cmd.exe	154
PID 3024 wrote to memory of 3136	3024	cmd.exe	251
PID 3960 wrote to memory of 1520	3960	cmd.exe	156
PID 4656 wrote to memory of 3844	4656	cmd.exe	157
PID 2396 wrote to memory of 1092	2396	cmd.exe	307
PID 4056 wrote to memory of 2100	4056	cmd.exe	152
PID 2112 wrote to memory of 4628	2112	cmd.exe	249
PID 2244 wrote to memory of 4640	2244	cmd.exe	161
PID 2484 wrote to memory of 5636	2484	LariaMC_Setup.exe	163
PID 2484 wrote to memory of 5636	2484	LariaMC_Setup.exe	163
PID 2484 wrote to memory of 5672	2484	LariaMC_Setup.exe	164
PID 2484 wrote to memory of 5716	2484	LariaMC_Setup.exe	165
PID 2484 wrote to memory of 5724	2484	LariaMC_Setup.exe	166
PID 2484 wrote to memory of 5732	2484	LariaMC_Setup.exe	167
PID 2484 wrote to memory of 5740	2484	LariaMC_Setup.exe	168
PID 2484 wrote to memory of 5748	2484	LariaMC_Setup.exe	169
PID 2484 wrote to memory of 5756	2484	LariaMC_Setup.exe	170
PID 2484 wrote to memory of 5764	2484	LariaMC_Setup.exe	171

C:\Users\Admin\AppData\Local\Temp\LariaMC_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\LariaMC_Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
"C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,15086608864238127309,13944596188108084604,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4380
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --mojo-platform-channel-handle=2024 --field-trial-handle=1820,i,15086608864238127309,13944596188108084604,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "LariaMC_Setup""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "LariaMC_Setup"
    3⤵
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v LariaMC_Setup /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v LariaMC_Setup /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ItemProperty -Path \"HKCU:\SOFTWARE\Valve\Steam\" -Name \"SteamPath\" | Select-Object -ExpandProperty SteamPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalzWD06cb1e9c.vbs""
  2⤵
  PID:5932
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalzWD06cb1e9c.vbs"
    3⤵
    - Drops startup file
    PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }""
  2⤵
  PID:6584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6788
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\lib32winmzWD06cb1e9c.vbs
  2⤵
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:1460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)""
  2⤵
  PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:6220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:6236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:6252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:6272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:6616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:6280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:6288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:6336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5896
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:2688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:5736
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:6556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:6560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:3248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:3784
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:4340
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:6780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:5668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:6192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:6944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:6476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:6656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:2652
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:5488
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:6428
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5616
- C:\Users\Admin\AppData\Local\Temp\decryptor_f1739154-c525-49c7-adf3-400ab1db8931\decryptor.exe
  C:\Users\Admin\AppData\Local\Temp\decryptor_f1739154-c525-49c7-adf3-400ab1db8931\decryptor.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffeb123c188,0x7ffeb123c194,0x7ffeb123c1a0
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,3880750383369469216,14474925193898747453,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11274461834054834765,15671925869876051726,262144 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,6533247913852672700,3417566035604668936,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:13
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,5219072437661303268,7651395481299232360,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,2294488610037989002,5747638875725167553,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,17153415183417686981,6765602618863480737,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,5563554065873070871,6749114671454975882,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4144,i,1490704522572407090,17380910673005029962,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,6381945470958252619,14339692731673023628,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4680,i,17694019610331317261,8876315376334169082,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3720,i,7477935816373930631,4022762168188611670,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5668,i,10650121650819613091,7995027192034660789,2097152 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,4249783223123143971,5758779164320700402,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,9585434706507753118,7580277650712145457,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
    3⤵
    - NTFS ADS
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8784158995773633785,5460323576366460054,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7018870768260840668,4246440289195548771,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,6427740229981072111,2712585214060168726,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    - NTFS ADS
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,16371660888517218762,11436827237751270576,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,8605859884362897928,10503564216261285963,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,16371660888517218762,11436827237751270576,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16889938269233406872,4426972424090804319,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,3802398791953184024,8004567686485562604,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,215469156208433142,5566501288734079304,524288 --field-trial-handle=2248,i,15969559155333256719,10957413936351151436,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:6800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:3532
- C:\Windows\system32\tasklist.exe
  tasklist.exe /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:5000
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2900 --field-trial-handle=1820,i,15086608864238127309,13944596188108084604,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5020

C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2212 --field-trial-handle=2220,i,9051282405034751507,9683429947612403092,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5636
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --mojo-platform-channel-handle=2296 --field-trial-handle=2220,i,9051282405034751507,9683429947612403092,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:5716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)""
  2⤵
  PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:5748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:5764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:5780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:5788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "LariaMC_Setup""
  2⤵
  PID:6600
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "LariaMC_Setup"
    3⤵
    PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }""
  2⤵
  PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$processes = Get-WmiObject Win32_Process -Filter \"name='wscript.exe'\" -ErrorAction SilentlyContinue; if ($processes) { $found = $processes | Where-Object { $_.CommandLine -like '*lib32winmzWD06cb1e9c.vbs*' } | Select-Object -First 1; if ($found) { Write-Output 'RUNNING' } }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalzWD06cb1e9c.vbs""
  2⤵
  PID:3360
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalzWD06cb1e9c.vbs"
    3⤵
    - Drops startup file
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)""
  2⤵
  PID:3136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$os = Get-CimInstance -ClassName Win32_OperatingSystem; Write-Output ($os.Caption + ' ' + $os.OSArchitecture)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name""
  2⤵
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -First 1 -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:6632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:6624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:6308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:6316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7152
- C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe
  "C:\Users\Admin\AppData\Local\Programs\whidder\LariaMC_Setup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\whidder" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2492 --field-trial-handle=2220,i,9051282405034751507,9683429947612403092,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6684

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:7008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\6e483c272c3f1c04\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ea7d35662c775981bfd2f94129eb6c8317e6a5aac89390af163f621e08976632
MD5 ef7f755707cca29799da720639488f9f
SHA1 cee328dd779b6b01b6a6e5052d3ec8fde9805587
SHA512 f0323fe00d44fa168a516b0198cc40505eb43b29915b0a1d408b0943a7a4f1d98e4cf91c16f0e85a53246b0221f6d319064a59d77d5e5c9043448cb76a932b64
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 26411d201c45b80c70f74342cdccd6a5e9028d942ca316b91e24de3b36e9f1ed
MD5 df5148911145f9beb7628431e62e29bd
SHA1 fcb9fa0a3c8ab7cb7575ac31684a692290f8fc35
SHA512 f01e22fa768218ccc811bf37743ac887551213b154754cafb3bd9c4e85cdc83fd13819044d9c87d07237c2edc26e6c7f4992807cb157a1e7506a793b6b1d2c35
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98de3353db3d3d82201332dca8f8e57e55fab7693269ea240f312e918017b70d
MD5 e137f2f9caa474791436e625d213a3b0
SHA1 eaa7f8296d9200123823e6c76ddd5265122a526e
SHA512 3aac868cb05a1ed7eff739320a9b037f5f0de67a6945b74bbb7ea130d6aa95f94b4c536b1a9bfa41c70fc9c157a47768f6887ee131d7c481a37ce962b1ed9b1e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1a416b0692512c98c9d7f2ba39dd8791c6faed1f3fda0cd69b47047bf858aeb4
MD5 9afeccb941d6d0e33d7f7d42571ceb33
SHA1 b86006ac3a98781b4ee57cda792a5916ab8b807c
SHA512 def4051e53dcd732d70077a5630a05fadb36e83927128119aaa59ed1f4f6005bbdbd546714c1d42b76b7852089b93362d2935f350faac88283a0dbaf292df797
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 5abb5eb9a749a6e6e24cd87935d5f1c41309ce1943d6464030d36a278754867d
MD5 dd66424ce247ae2e31c8b8daa280df8f
SHA1 096010d66a999248d59f06cb7fc73e5bdbdaf67f
SHA512 ed81fdb622f2153d7fdc9c9ae034200e279824eedf5f53f23638619cdd51063bb75e83fc10daf11b80d9b2130cfd6e69827dddd0a9b42df7ec66610d9ada4c88
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59b5f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b5f8.TMP
Size 3KB
SHA256 2ae9f7f0e582728017a700ba5295eaf0a892adbb6d6ab597bf14a0698982fd82
MD5 e0c3fe12c1ed96c42539a8dace7df7c4
SHA1 98bc208aad92039c68d267bfc83f86a89bad53e6
SHA512 640e5c830502970b6fdf98392f702b2243fbd66d58291509cae9d1784213948eb25f80a21d333f4ef2ec8a5435e280e76a53352aa6941fac95452578c2ded967
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5bb2f35571049f977a169159a507d12ff588d880d2dc6c796566281a758e2142
MD5 194ce473c63efc93cbf5b4cd994386c9
SHA1 fb276a4897810c55fe6de0f05db2098daca620fb
SHA512 67bc9f04ef3e36c04da71b1ea6fb9236209fb84050e74264e73a19da04b52391107fdb3f4bd87e07efc94a208e39132351a2d52999b8b881bd2b615f49727cd7
SSDEEP 192:sxZMWRxyM//K1Ml8MJ0F/f4sNfQbkHSfqhidpjX/W6+WNB6Y/Y0Xw2AgIg4J:sxZTzOF/f4sN5HSD/b7/5/Fc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 af61876111fd008c5a949c2aac3206e19991a34837c80dfde300da1bd7286736
MD5 56fb0c4f7ae0ca6293e47938f6720444
SHA1 4fe823510d1da0d8ec9e34a4bfdbb1b622b55ad1
SHA512 cdd6fa9349f0cee4bd8eb348ccc34c57ce5514cd2ddb7a3d72e48b76d3b09cbfb19f3493772eb0fdc1f0498247524a9058fd01ba17c24a8f45eba44b766f0b0c
SSDEEP 768:d0ogY8q82sjWRm/NQTI8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3yrLl/7d0ij4imru:d0ogY8q82sjWRm/NQTIu1jaKyrLp7ai1
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2259a172-f013-4807-8948-66dcda3788cf\index-dir\the-real-index
Size 72B
SHA256 e3d15d78ec98ec95219f194e59f34c66937219dec02b833e6455071d552e6415
MD5 5ee989741e6d57d9dada94271a28ce39
SHA1 8710a8d07994b177741a024f3abeb93084ed55bb
SHA512 a36572acc6d04a1a174d9be9beed32c1e919345faecd332a23eb17f658e88662499588703f7e86ccb88b08186a071bf63dae73a4ab5e4c9ffec9dd6a7aa84142
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\23036a5a-4f3d-42d7-80ce-928b44a26144\index-dir\the-real-index
Size 2KB
SHA256 8ef012113c6cb78b96c3d8cef1911597bd02fc1d745a722a14a0fed614c0f689
MD5 88a9898288b33ad9fb587b30b2861ccf
SHA1 13c89cf224a6bf132984af2c4c05bf243ac67a98
SHA512 15c8b2cc124d964637f46852aca43456e271738b27fc80b7cef71539e24d24d981923080f0ede28864ff5b0c5de72172457e1ea4e5ad928e2f2eb539950aa4c9
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59ad3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\23036a5a-4f3d-42d7-80ce-928b44a26144\index-dir\the-real-index~RFe59ad3e.TMP
Size 2KB
SHA256 f2cc51224af0ed235386a2dfcbfc6dc10df4a750c581e4e61f4df67bbe1e4007
MD5 c51a53be9531e8b3e37bfb574733530c
SHA1 7057353c816bc285691fa73dd99ef671f11d30cd
SHA512 5db9f491fe2f64b8343b41059da3ca03c7a3d7ffa36af92f309f05fc13e225111f50d11d12e9c917fd6a37d44712348629d7d24ce124d15644d35c96112dfa93
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a12671c5-3033-4260-90a4-e8eba71ea97d\index-dir\the-real-index
Size 72B
SHA256 1daddb42c680e6f26d34f0b3475d31cc07055f4d8e77f3cc3245d68f059065ab
MD5 21b1eab2498be3c765e6dec3a22d7d16
SHA1 757b3c94a97420a1aab5863542dde999bf66c789
SHA512 d5674f94e770cbb5ce8a74ce41ac13d75c20f981a6b904a926d34f3752d708475c968f9a478360a79d19b96aae9e1bfb062170aa62467d3f9d8863dc602ba198
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59b731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a12671c5-3033-4260-90a4-e8eba71ea97d\index-dir\the-real-index~RFe59b731.TMP
Size 48B
SHA256 df4bd6cf3604049dda53e80b4bc40aa2f69ec0253b25f78098b86ccd20536d25
MD5 deaebc7225834d7f3b7146ef9939e042
SHA1 71b1325a320f775a28ba50231e9e07d5bfc2611a
SHA512 bad449ce3ff4a6a3503024b96f4ba1814c6c6242dc8b5c39c4533272934b23120c247677ca70acde79fdefbc555e82e858b78343723b0cab8abdc297d372aa27
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 2ee6ec80b361b75990f926f6a4db030ef48e1ba6487058719664b6a19e6986dc
MD5 2170050d803196814d792d7806a94dbc
SHA1 1b64501c18159716c05a09eb77d3bc2e355c8595
SHA512 5755ed3df0a244c4dfef7c3fe97c315abe867604b8a867ed4978a70e943ba4b74747f092bd925b1ceeabc8efc5954a7ed17802d4c0ebf9bb1bb9b247cdf54971
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 3ea810f096220531ab64fa05d59ebe6696cf543144cfaf70ebee7d5f89133d22
MD5 8f6b3008bc08a2f53088316221d5d916
SHA1 fb82d05e581928721d4771ce395323f6ca6d0a36
SHA512 b8a0bcc6016abad85b7a8de52a9901ddec5abff0d3f452807f8251518f3292ee8bf7dc1c081d47d73f7ee4d3e73c8d5c006c2b7119a0e8ce27fd378146188131
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cc97b1ea4786e8a7ea36d6709cb3ffd2f351918c195fafe71b4752d1eae17850
MD5 1b3c24ff9b41365f4701b5865923ddc6
SHA1 27858ca327de0e130f4bd9bbbd69902d01a4aea8
SHA512 8a67b12ab7770e55fd4627eb233e112498569c12e3fd45e0e0d6f1181d2315959ba41b7a2c686984ab3f6351a810fa308541193a95ad18b23fdc33506a78129f
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59aca1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aca1.TMP
Size 72B
SHA256 69985ebf3b4ef35cee8cad7b5f9907a840f02ae327d6d5fc7c4b9821decc8446
MD5 d98ec7c90b386bcce5826834aabe6325
SHA1 224a608c596c940f9af90870e66db21bc83c4947
SHA512 7b4f92f820bb13453603dc5798e4ec145269cbdb64545a6a193d0a6ab9da85a5407fd760add3e30646c68e80db4d01fbfd0f91b2c357cd293d04e9b4dd1821da
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 58d17195da07d489e867d0d320b9360f1308cd62fc0b0886384cc8712e84670e
MD5 08a8caf597c83930437b7c3e2ddd67e2
SHA1 3083e8105a67d423e13b7a67eea98c8d01d4211f
SHA512 7f55df17b2ea3428ac6bb2098007dde2004bf701e2ee4062554fbee64d8b092b48d0a05cacf3cd40c192b0eb08c5c2298c0de9ea7f6e8518835d4685564d2a2f
SSDEEP 96:BCKx2npKMm1dIvbd/fxS7CvzxKYr9xcVNazkIKna2SKhU:Ym1dIvbd/fc7Cvzpr9KVNazJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95e0d498ee53f9b314749f25bd9a94edb4e0b496b01c2c62257f631789d61b8c
MD5 21519cfb62986c6b095cc80c4c6fb215
SHA1 76bea234881f24584a3bab454cad55b1542b9632
SHA512 344a0b9fa75c107d9e718d6573d88229d3334e56b91bcf327166e850de72260fd8a469ba60585631b83c49a60083f84bd38e188fd443d99cce783ab24877c718
SSDEEP 384:nYvqM98NJJUTjBKtNN6J2sW2u2XusD+SXuPpg8ttUM/6YJDiq:YyMQ6JRW2DX1DJX8p3tr6YJDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 23172b990c1aa62ff9d85923fc46be54cf60ffc6876fee0f63d2945ca59ea431
MD5 691245424a83df2742eff439bfbb2133
SHA1 27cf7cd7828a4caa8b73c7b4c0f5639be61d8c32
SHA512 39bca93b1f78ac7fb628b80c75281a500443058ed09c4b9f1239173addc70f245b5564f19e0e24d0d4d24ff356ec6ab3503d85ff77592a6e47da7b4698d859c2
SSDEEP 384:ngvqM98NJJ1TjBKtNN6J2sW2u2XusD+SXuPpg8ttUM/6YJDiq:gyMV6JRW2DX1DJX8p3tr6YJDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d58baadfd2990ca9606b2671976aa3028d3be26fa5bbe8ed94ea1fb7ee9c1729
MD5 05ca77cdb565b8ec2a2488debb6186c8
SHA1 41d76112c916db2de4944c0d4b9235e22d3d186e
SHA512 28a639ec2583fb09b9573cdb418e5ddc3bdf40fb6a202dbecd6ba76628098d42d38ad0b712a21e8f25bbeaa273609741411d2e2cf46752e80f1e1e782eb7d173
SSDEEP 192:VGNO61uXDQmiUyHNscZvO2uzgMmhpus6Uh0QhcKLFrNU6:VGNO6glMScZW2u2XusD+FWNU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2efe0c8a327a4f40ed1d15e95fea907285c31c78795e6c802ceb2bc5abda9433
MD5 0ef11ac596576cc4febff1a9c3b0faf3
SHA1 94f0e7ab5885cde49c93be1fe3bea48133d0be8b
SHA512 e1259a2ced471f3aef8ec3a47fba147f06e869821e1dfe3d594f731fffd12c835e7dcecadd095921ab6a3e1405f65371b5e5a9e70ef9507ff17e18b187647ba4
SSDEEP 192:VGNlo61uX7QmiUyunspZvO2uzgMmhpus6Uh0ShpupGAd3KT/kU6:VGNlo6gdJspZW2u2XusD+SXuVpU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

d65dc0e9-1ac9-4c69-9cdf-7631cb4cdb97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d65dc0e9-1ac9-4c69-9cdf-7631cb4cdb97.tmp
Size 19KB
SHA256 b0b8873f22ed4d41f145499b96a1b39d4c265cd01cf6c3ebcc9c19376753a849
MD5 acca297a55156df962bc59acfd2ccbd1
SHA1 d3e406c38f16bfdf7a7240bf93b9c37e6bd11bd0
SHA512 bd1e551ae5b884b1d60e41d1db1e717e56fef641818ce38ac035ce7349c046a86a5225d5af8a9159db7ad90f03a09c2681dbdb5585fbc7fa10ac81bcad3354b2
SSDEEP 384:nYvqML8NJJUTjBK6oN6J2sW2u2XusD+SXuPpg8ttUM/6YJDiq:YyCS6JRW2DX1DJX8p3tr6YJDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ab40a28-049b-4bbf-b0b3-f382e01e37fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2ab40a28-049b-4bbf-b0b3-f382e01e37fa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download