njrat | 1cf006fa584b222653b8a12bfee6c73a46e6aa38e6d14574cd503873e26f1d28

Analysis

max time kernel
118s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
publiccocos.exe
Size 54KB
Sample260331-ekvfesdv4p
SHA256 1cf006fa584b222653b8a12bfee6c73a46e6aa38e6d14574cd503873e26f1d28
MD5 88d3792263b23fb5ed2430f5e4b4dea3
SHA1 6cd30acc38b9805cef40319df89aca7b4a49ebdf
SHA512 0390ac5582c5e6ac52272a7f618c7088b816b1ae72eaab69a0297934290312573c01fd47f99825e010b801fd51ac038df4bd0b88734b182859a11fb23c99f37f
SSDEEP 1536:AJPCGsDnQwNgkpAAuF2DGwsNMDZXExI3pm2m:MsDnAuo2DGwsNMDZXExI3pm
TLSH
T151432844BFEA5A01E2BD8F3468F645150A34BA63F532EB1E48D668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence trojan upx

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 10 IoCs

pid	Process
580	5b74d41c05894fe3b13a04c5268669b2.exe
1688	bytebeat1.exe
1204	rgb.exe
3572	sinewaves.exe
4132	Lines.exe
1816	txtout.exe
604	patblt.exe
3676	txtout2.exe
2172	e657f1764e634767ad01ce738589e4f4.exe
7720	invmelter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cf98119ac4268af5028c8ddcbb8719cf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\publiccocos.exe\" .."	publiccocos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf98119ac4268af5028c8ddcbb8719cf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\publiccocos.exe\" .."	publiccocos.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	publiccocos.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b3d4-18.dat	upx
behavioral2/memory/580-22-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/580-73-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	invmelter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txtout2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	publiccocos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txtout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b74d41c05894fe3b13a04c5268669b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sinewaves.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lines.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patblt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	publiccocos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytebeat1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3188	taskkill.exe
5060	taskkill.exe
3124	taskkill.exe
7332	taskkill.exe
7424	taskkill.exe
8744	taskkill.exe
4640	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "79"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134194033424256177"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{32436D23-B433-4F7D-A1E0-AD8292EA5DD5}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3680	publiccocos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3980	AUDIODG.EXE
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	3124	taskkill.exe
Token: SeShutdownPrivilege	988	shutdown.exe
Token: SeRemoteShutdownPrivilege	988	shutdown.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: SeShutdownPrivilege	3588	LogonUI.exe
Token: SeCreatePagefilePrivilege	3588	LogonUI.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe
Token: SeDebugPrivilege	7424	taskkill.exe
Token: SeDebugPrivilege	7332	taskkill.exe
Token: 33	3680	publiccocos.exe
Token: SeIncBasePriorityPrivilege	3680	publiccocos.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3836	PickerHost.exe
3588	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 580	3680	publiccocos.exe	82
PID 580 wrote to memory of 616	580	5b74d41c05894fe3b13a04c5268669b2.exe	83
PID 616 wrote to memory of 1688	616	wscript.exe	84
PID 616 wrote to memory of 1204	616	wscript.exe	85
PID 616 wrote to memory of 3572	616	wscript.exe	87
PID 616 wrote to memory of 4132	616	wscript.exe	88
PID 616 wrote to memory of 4640	616	wscript.exe	89
PID 616 wrote to memory of 3188	616	wscript.exe	92
PID 616 wrote to memory of 1816	616	wscript.exe	94
PID 616 wrote to memory of 5060	616	wscript.exe	95
PID 616 wrote to memory of 3124	616	wscript.exe	97
PID 616 wrote to memory of 604	616	wscript.exe	99
PID 616 wrote to memory of 3676	616	wscript.exe	100
PID 3680 wrote to memory of 3396	3680	publiccocos.exe	101
PID 3680 wrote to memory of 2172	3680	publiccocos.exe	103
PID 3680 wrote to memory of 3908	3680	publiccocos.exe	104
PID 3396 wrote to memory of 988	3396	cmd.exe	106
PID 3908 wrote to memory of 4788	3908	cmd.exe	109
PID 3680 wrote to memory of 4348	3680	publiccocos.exe	111
PID 3680 wrote to memory of 1284	3680	publiccocos.exe	112
PID 3680 wrote to memory of 1560	3680	publiccocos.exe	113
PID 3680 wrote to memory of 836	3680	publiccocos.exe	114
PID 3680 wrote to memory of 988	3680	publiccocos.exe	116
PID 1284 wrote to memory of 4548	1284	msedge.exe	117
PID 3680 wrote to memory of 2076	3680	publiccocos.exe	115
PID 3680 wrote to memory of 4580	3680	publiccocos.exe	118
PID 3680 wrote to memory of 4684	3680	publiccocos.exe	119
PID 3680 wrote to memory of 3132	3680	publiccocos.exe	120
PID 1284 wrote to memory of 5196	1284	msedge.exe	121
PID 1284 wrote to memory of 5240	1284	msedge.exe	122
PID 1284 wrote to memory of 5240	1284	msedge.exe	122
PID 1284 wrote to memory of 5240	1284	msedge.exe	122
PID 1284 wrote to memory of 5264	1284	msedge.exe	123
PID 1284 wrote to memory of 5264	1284	msedge.exe	123
PID 1284 wrote to memory of 5468	1284	msedge.exe	125
PID 1284 wrote to memory of 5484	1284	msedge.exe	126
PID 1284 wrote to memory of 5484	1284	msedge.exe	126
PID 1284 wrote to memory of 5484	1284	msedge.exe	126
PID 1284 wrote to memory of 5468	1284	msedge.exe	125
PID 1284 wrote to memory of 5468	1284	msedge.exe	125
PID 3680 wrote to memory of 5524	3680	publiccocos.exe	127
PID 3680 wrote to memory of 5536	3680	publiccocos.exe	128
PID 1284 wrote to memory of 5704	1284	msedge.exe	129
PID 1284 wrote to memory of 5704	1284	msedge.exe	129
PID 1284 wrote to memory of 5704	1284	msedge.exe	129
PID 1284 wrote to memory of 5740	1284	msedge.exe	133
PID 1284 wrote to memory of 5740	1284	msedge.exe	133
PID 1284 wrote to memory of 5740	1284	msedge.exe	133
PID 1284 wrote to memory of 5716	1284	msedge.exe	130
PID 1284 wrote to memory of 5716	1284	msedge.exe	130
PID 1284 wrote to memory of 5716	1284	msedge.exe	130
PID 1284 wrote to memory of 5724	1284	msedge.exe	165
PID 1284 wrote to memory of 5724	1284	msedge.exe	165
PID 1284 wrote to memory of 5724	1284	msedge.exe	165
PID 1284 wrote to memory of 5732	1284	msedge.exe	132
PID 1284 wrote to memory of 5732	1284	msedge.exe	132
PID 1284 wrote to memory of 5796	1284	msedge.exe	134
PID 1284 wrote to memory of 5732	1284	msedge.exe	132
PID 1284 wrote to memory of 5796	1284	msedge.exe	134
PID 1284 wrote to memory of 5796	1284	msedge.exe	134
PID 1284 wrote to memory of 5892	1284	msedge.exe	135
PID 1284 wrote to memory of 5892	1284	msedge.exe	135
PID 1284 wrote to memory of 5892	1284	msedge.exe	135
PID 1284 wrote to memory of 6084	1284	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\publiccocos.exe
"C:\Users\Admin\AppData\Local\Temp\publiccocos.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\5b74d41c05894fe3b13a04c5268669b2.exe
  "C:\Users\Admin\AppData\Local\Temp\5b74d41c05894fe3b13a04c5268669b2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\9D74.tmp\9D75.tmp\9D76.vbs //Nologo
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\bytebeat1.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\bytebeat1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\rgb.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\rgb.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\sinewaves.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\sinewaves.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\Lines.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\Lines.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4132
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im Lines.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im sinewaves.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1816
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im txtout.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im RGB.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\patblt.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\patblt.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:604
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout2.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im patblt.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:7332
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im txtout2.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\invmelter.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\invmelter.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7720
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im invmelter.exe
      4⤵
      Kills process with taskkill
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\cubes.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\cubes.exe"
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\rgb.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\rgb.exe"
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout.exe
      "C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout.exe"
      4⤵
      PID:6116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c shutdown /s /f /t 60
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /s /f /t 60
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- C:\Users\Admin\AppData\Local\Temp\e657f1764e634767ad01ce738589e4f4.exe
  "C:\Users\Admin\AppData\Local\Temp\e657f1764e634767ad01ce738589e4f4.exe"
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c rundll32.exe user32.dll,LockWorkStation
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe user32.dll,LockWorkStation
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffd2a66c188,0x7ffd2a66c194,0x7ffd2a66c1a0
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2033793742987281646,16505396043573978016,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,16120540126888682149,6393255722954333020,262144 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,4569383113704374877,11253280934555827307,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,8387552742290186630,10762400974037461264,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,2653253625348052058,237874182261187533,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,15488660281175707320,11699611469933858812,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,10813421053058346600,12552821364609628148,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4160,i,8107396799240991046,6634213984812299648,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,12472080314739732780,13051747508148506890,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4320,i,13505899103540486060,3100559893030589954,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4912,i,7520504512840625825,17356235142349543472,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5044,i,1246683118565482922,14590480905274321766,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5488,i,13268616341373901623,6314214928325439439,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5508,i,4839856894846247557,14314663811847004668,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5796,i,8062687655629629575,15940468696168815432,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5980,i,8863603245568287961,16167698091562360290,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6048,i,13936982656435201982,14521175991213042783,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6300,i,14944549041325238628,5202538683483523051,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5984,i,15782187676805335744,4169403913385399058,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,14079956613153541689,8978292819085316401,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3568,i,11599437720994418442,7990959831279470065,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7264,i,14658042840392670130,3748622314512653430,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,14137469323022717023,2531820628039427783,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,13286432127828709051,9677055595905053935,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4568,i,984878585735553409,2301539954793359351,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
    3⤵
    PID:6892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3848,i,14818439120786349419,14452262142276475417,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
    3⤵
    PID:6920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8156,i,1958938174816044471,6198406112142724707,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8204,i,1720904197050834116,14824503076197776433,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7000,i,588364315566810839,8382643243518817207,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5508,i,11489609520486816740,12254743468263732254,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
    3⤵
    PID:6368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8724,i,14102244586535430923,3293075585134839587,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:1
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8872,i,9388972062282235518,17205712501745334475,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9012,i,10636096956754429456,11614447723112076700,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=9032 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9232,i,14365076292139450463,1773485436506084253,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=9248 /prefetch:14
    3⤵
    PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9236,i,3141777368108188485,16916581744013866841,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:14
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9236,i,3141777368108188485,16916581744013866841,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:14
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6220,i,1831598936272559646,15854518744078283042,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4532,i,6317819998200836518,10269136664142066373,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5100,i,9825152385736514945,7367435689036896507,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4524,i,13165445231824365092,4826984030904747622,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:7204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10124,i,15255279203664258050,14959521009685608850,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
    3⤵
    PID:7564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10144,i,9780370804464779122,17156964935202122003,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:1
    3⤵
    PID:7612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10480,i,12338080647769217993,3880665159859966468,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:1
    3⤵
    PID:7856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10636,i,17314334464962080956,10923345490935848914,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:1
    3⤵
    PID:7928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10448,i,6330964757550039031,11710163255492733392,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10796 /prefetch:1
    3⤵
    PID:8156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10672,i,9565127024345762562,5543802499804454569,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=10828 /prefetch:1
    3⤵
    PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11112,i,7437169157845378217,17678293989681076683,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11084 /prefetch:1
    3⤵
    PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11340,i,10737808461231906692,3992357425908751540,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11376 /prefetch:1
    3⤵
    PID:7900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11536,i,4932566891435913569,2206872436980094951,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11508 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11668,i,11406729110203444382,1778510576987740845,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:1
    3⤵
    PID:7960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11844,i,1351551906378972214,2610528629512210234,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11852 /prefetch:1
    3⤵
    PID:8308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11840,i,8022360294652349539,14830708096418828886,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=12020 /prefetch:1
    3⤵
    PID:8348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12136,i,9978567755713739358,18292910382092324077,2097152 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=12176 /prefetch:1
    3⤵
    PID:8496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,4887455202008737475,13359667379965326583,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:12
    3⤵
    PID:9144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17305230907239866761,17738367924100405183,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:9048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,13844890778137084910,16921109945949955741,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
    3⤵
    PID:9056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,10087260846484740672,7855576498874380085,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=12952 /prefetch:14
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12932,i,16757743537971145047,17930055119608258256,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13040,i,3586580891908539051,94430136978432019,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=11488 /prefetch:14
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13156,i,8712698265565200084,15961015797439442120,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=13012 /prefetch:14
    3⤵
    PID:8928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13148,i,13624695224896446963,5574272824453127166,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:8936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13136,i,9355736865888322111,3536087827449001296,524288 --field-trial-handle=2636,i,18131875421385676756,7067804179172711119,262144 --variations-seed-version --mojo-platform-channel-handle=13120 /prefetch:14
    3⤵
    PID:7764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:8048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:8224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:8320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theannoyingsite.com/
  2⤵
  PID:8420

C:\Users\Admin\AppData\Local\Temp\publiccocos.exe
"C:\Users\Admin\AppData\Local\Temp\publiccocos.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a26855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1da12a90f1238cd16c8a19ab9caf4f7a7d72ce5475628f16ba1a651cb0737842
MD5 6b9f6da3db6c132cd3254de14bbbd7f5
SHA1 81571888b2f8040a496e2dfd03faebd67cebe234
SHA512 4395aa4c37c404e97b2917f68da50d0feae134c5ee185b0fdd08f4b347f0e7ab7f9fdae407cd9cac78805c020d76133aac459ed6434e1377a99e0fc25b7e5639
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7k:fwUQC5VwBIiElEd2K57P7k
TLSH
T1FDB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 357KB
SHA256 932bd19d5dd3b05479db12e0bbc9d56b5c9da4951a2a421b241187359a1ddd9b
MD5 901f820ce23c973f54c9e053396c058f
SHA1 25a50360710067b06087a05b282fbbfbc3e5d6cb
SHA512 cc64c6652d452c11a7e66dfde6d29cf099e9450bbd23c696dd4635148ffae1433de90ff730b1f93ac1539c80b7c4b5e83170500288f3a23108d7774d9ef400f1
SSDEEP 6144:mpH1ROvpmN4ukcO7L4+Z+nNGso6DsNSAoROOoKeAZzrW1vE6sR087cSQ6OJmwLnc:m56LcO7LlZN6MfoRaOW1vETRlQ6fwLro
TLSH
T166742325F01D26125DD8D58F2424E7792EF69BA1726B4EC0BCFE7CC48D299B53082C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 79KB
SHA256 347dba43a69e577a915059d920073c86b8661b179ee6c4a2c5209108778d3483
MD5 bb2e196bd33b42d47ac91e716ef6ecef
SHA1 70f1402ade276e383a92411b53d5068553e72f4c
SHA512 e51d44824e0846ff015432a68ef47a7e103cb9eda95fcad64630def809bb47fdffed31641ba5b86810eb257395fdf06930554133db52bcba487287f56f6ad087
SSDEEP 1536:fkiYIkWGAk39vNWEI3ZOOAQRiq4aNuCzosCm3zk07VAotCBgkujulNoQCjI:f/ZkWGg13ZORQRv5HdCEzkOA7Bg3ulR
TLSH
T18D8312DA74C0BC8762372712517090EAA953E6E3E5D2A53503C91B9EBC6FCB0B3C0593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 79KB
SHA256 4d5ba78ffe29290daf55bca76a0e0e57a1d51bff8566f7e56b77ba6bebd6d1bf
MD5 2a8de19fd5a0c873d77c1b6064d9bab1
SHA1 baf4db2c96ef3dcc5edd9958bba031bd4b68706a
SHA512 dfcf70f6c0465f5311906c93eb8abcd90d553ab6c233d63749288805104f0541d71b595226aa56a7b773051972bf4c3a68e49e7f2ad5c6c61d5243294af9b1de
SSDEEP 1536:/ygPmlduYETvWtE2M20Jd/3UuX439HQQ3nZV3Qwod+cg57C5O1TQKx9KkiQ:odhjIJdfUu+tZRQtd/J5iTTak5
TLSH
T1F78302579DBB7A32E4BDC5152CA7520B24D27C120A72C7D76DA2E17538C30BCE2586E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 40KB
SHA256 7ccf2f21cbe39533c20f263aa498dfd263bd78f24b60d39f8d858e83cb3bd503
MD5 50cd746f3253a336be6cb98b4d41f558
SHA1 2e8aa7515829e4f4c06802fb106b02e9b47aac6b
SHA512 35d5dfb899889cfb34e83fdad9f76fbf539440793c957b3146ad5b33104cec01d837723b38db7380fd9235fc225841005db4df8c74bbf005b0813822df42710d
SSDEEP 768:jYHXpYZ/FTCCMZ/tv+H8K4p9ML+ZgwndEVaGGg2zts5NkkCdvySDEDOEvX9:jY3patTCCQ1mcLp9BdEYEvkhvylOWN
TLSH
T1BA1301FB1ECE9521906E1BCAA6FC56F890660F27684031170150E733E91AD792DAFAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 46KB
SHA256 25519584275cd520640e7dbd2a4e82a9176b42876dea95c86b6d1fe036c328f0
MD5 934dedccbaa9e7425cadb02efa43c32c
SHA1 987e7cbe4a38d6ef69a717d88636907653880913
SHA512 a039afd440d2a05c08e17887ee869690378a9ffa0e94b581705211c18685ec543bcfb772d51d50571c6141ba4bbd5dbab5a4e19336587ad27bac5e2ca64af5bb
SSDEEP 768:20lCDvqVtep6AqJR5m0SgTZFsrcFKzMFnPK4iybcMcgG0RoF1E+DfmJN2nTDJFdr:20wcEp7ER5m0Sg7+M5Xpzcx0Rb+DfQ2J
TLSH
T14923011EC81FC84C0C3A89A95583F0A1943CEEA4458F8974F53DF07AE7514D959A3AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 178KB
SHA256 162d4a69f852e2146a8e87957682239350456ec5a2165bd0625e66557db6f1fa
MD5 32e5d550d42892e87ca230a2f946a19a
SHA1 96f57efa7cf0914aa344964330a04edf61834fea
SHA512 95a27b554068fc59a80a3df38efde7ceae29e9b6f04d356dbd90bbb53312e6ed03d9b482fe30f51ce5faa013d7ada05b49bd7bb490a1830cca890237e6b977ab
SSDEEP 3072:MNfqAvwmHtHmTEHg7ABXQC9UmXEJIzG3+uhliLznG6SlSHCKz20Wy1MsYG7SIa36:UVvwmHtGT57KXxhXIIzIvhCa9l2DV1MG
TLSH
T11104128D2E49EC6A52BA0DDC5977EFBF2551C9090593FC26FA0900FE74B9AD8031319A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 87KB
SHA256 b1d1005b14deca1ed1e078758d7fc0dd9917748b46f71b0be16b44c57bd0088c
MD5 b95f972b9b33ef69ca3b9fb1b0adef5a
SHA1 d8ad42fab3f36712b6205d6205ac0947615caec3
SHA512 5448bcbca0acbc02b2cf12e81fadb1a0a1b5b27128a530a3620576b58a26926b8b07f814f2dbc60716321f883e75d08a3f606b14b8cae56e459065c7456b4def
SSDEEP 1536:CXVNM1U5gAODlROkxNOkt448G222osmY9XpZ8MQ4FABE2vhuRzih0wWbVB0GnN0x:IM2WlR0G448GamK8MQ4YvUzo0wW52GnE
TLSH
T188931212A7F2DD92C50DCCBE7692417BFF98C60C97F467E848281B16348A361D63D64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 122KB
SHA256 7a06aa89b6d054dd3e7242401ea81763b80480e1783f59d4ee482c38a36e4f6c
MD5 a432393c55d90221ccc0671a626ee80a
SHA1 a979560fd963b4fa64e3c159573f23081c6b5cb5
SHA512 e4dcfbb43861dfe13387018db9fc180af184c18522881ef2403e05088fd874e83be93ab8fab732b21831faa8c82fd6281bd5f24ee3a90e321749771c92ec3322
SSDEEP 3072:dOoEIVayYfkwBXhIKxoFi6ycGq/Hm440h6bP:dDEIVa98wN4FiAD/hQ
TLSH
T10AC3128CF3D7903525855A392211A3E35D0BD5A876E522C85CBEEABCE3E0CBD753121E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 141KB
SHA256 e0a4b1b62e0d527c16f795272b3b9f6bf243ddcf6a68bd6130e8bac8c060469a
MD5 428d45b845659469c74f35b5311815b9
SHA1 704b5b65dbf4502be72bbb3b72ad8b0a1487fba6
SHA512 bd6635dee07a7a669f757caf3c8acb4738bc22f540bbf63cdfb082f738cfc2f6b122260a0af58263a58851b7875018ace392b63995df571624428b565c69490a
SSDEEP 3072:xRUQPzO3xzJo2z8q3wb2JH+uCzB7EWcyXSc8D3cslk/:/PCBzJ2EW2JH+V7gyic6E/
TLSH
T135E3124889C1D5B80D63CEB15F8B9A608DCD2DED067171C12C4DE112BAFCE29758AE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 256KB
SHA256 416637f24cb99ec3f6b82140ccea2023c1bdb0a7a56d5e3fa34ea204d6a89ccf
MD5 b4ffbfa2ffc92ea91b9abbf60ed23459
SHA1 d5d7af51d52dfda54f2a24787700f0482f605c71
SHA512 d2a7d67221b2ee17a29b2cc6ea128b7647f1b869aec4f755a390675d8030d1594ac93c6eeb48881311c8c8f284c3bbf4392d822f3692a5e21335a8deac57427e
SSDEEP 3072:ujde7R8XQLtTj7uSXdzs5o99OlbbRE5QMli3vGEIm/EThWNBb1FgwOLL8t33gUlK:uRSRvTj3xsRlbbRE5kvl/YoXb1uP8RUd
TLSH
T1F3441336758B4997C425847FA87846B05F631AC03171D73FDB272662ACFC2BC98C626B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2852cd1b6e9a4c65_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2852cd1b6e9a4c65_0
Size 16KB
SHA256 849da8166b84aab89ac609e614322ca42fbd9deaeeb49b8cf7677a0c6b3aa431
MD5 35e374845d0cdc432503d319c0087a71
SHA1 1f220c0a4c7c8f0b696ffe2fac6ff002ed9674db
SHA512 7df87c4de909019ec916c3d31c27220fec996f1c8b7285b49b7f697de14904e83c95944b53307ac8a68697ab603b058ca177721224d0c13938bd055de30578ac
SSDEEP 384:jHBQcDmeP54H6mhixU82Xh/ce87Asy12mfrHwIEffHjY1/:r6Phh/c/xyk2HwIEffU5
TLSH
T1B77274B1B3817FADCB3797F406528BB66F31906F2A93D303A2F0A3285D551D84C54E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d9fcd762738e322_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d9fcd762738e322_0
Size 20KB
SHA256 c4a1ffec87058680fe4db27d642d1ad4cd485588ae2777a08a24c26e2e0ba00b
MD5 16568cd2641fca677c9d9e6a6d96d9a8
SHA1 80d8c6bf12332903c4bafbc64661c2f89c9b4dc4
SHA512 ad98fe496d2e2d65c90b80a486333247b78869fc0d70d81bb22a2e577c51f6a45392287bbed294596538655c0ca109043902da0dd75703499998016a978fb266
SSDEEP 384:ge8IB9o9W1/5AsdFEvclpr5Po+vGS89PW9EV6:gZ6G6FEvclFVbvGzB
TLSH
T1CC9264B5A3C65BD5CF3A57F08A9269823F31819F1ED3C34BB0B0D2582C1A2D54D55ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eab38dd5bb7541c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4eab38dd5bb7541c_0
Size 357B
SHA256 66f21a66dd12b559e9bd84d4b43e32902a15fe18915117b09daee191f23b88f7
MD5 908c4fcafd1341db17c4b5e5e4c1ff82
SHA1 cc10f9d216c9144af55e4d0fa6ede1ca7ffd1b84
SHA512 d305598da1bd5bb9b8477835c4fe387df790397630102f082808a1fc72108842cd3f4a145fe24b017a52c70101484e001a16b05e168ccc73fcd66046494a4b64
TLSH
T12BE0C6631164AC88CE2AEA74CF31E22AA51382000CAC8187880422BF888ECA04F0A2C2
MD5 SHA1 SHA512 TLSH

Submit Download

566fea7eb2198e20_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\566fea7eb2198e20_0
Size 383KB
SHA256 f29b655cf538e760cdfa4fab9ff578d069b6d95d2532651a80d419b65e8e098c
MD5 10c97c8241cc20b59f72dd70175984d3
SHA1 ac6e17f706b36bd92258dd30efdde8f3170e967d
SHA512 ffaf5fb687dded7b1cd20e58bca3cfb5a626a977725938eb1f30253c91a1b6e56d0e1fc2f600df745b26019e18546306117d90757f045043a123c417dfd4f6c0
SSDEEP 6144:jVSFBoLSrHdaYTX9YeWfeQHgVu7VAYdPiCYdKrnn1V5y:pSFxTX9z+JXPRpn1L
TLSH
T1BD84A445DB81BF65CBB256F50293C5667232449E2E93C20367E0EF292C4E1DA2E97C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d8b60dbdda74173_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d8b60dbdda74173_0
Size 246B
SHA256 764a373c5fb201810e2821f1431114146688faaaf01396d8963dcf8c5bf8bc4f
MD5 1449c05ab10b84b70878d6536c90b02f
SHA1 5d42c157698686e09198b9a92d2f55740a53ffcd
SHA512 44a1f767215d8cd929ff782163c18277aae75ac84be3210d51d6dd4a66e6499a0e9c49349a325a0954749a2482cd17a8c31c17f973e752166196351f95a6053b
TLSH
T156D023BB5D3A0804CE4B97F0FB7B045EC63351FAC658C58BC101D06F481C4B8B6D9005
MD5 SHA1 SHA512 TLSH

Submit Download

5d8b60dbdda74173_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d8b60dbdda74173_0
Size 14KB
SHA256 21453e3e9f8eeec6a0cbbde7622a598f02bad1f9d88a727f492993f336fe7d55
MD5 2397fe34e9036cb83b58bdda381bcf3f
SHA1 67b6cdebf857bce8cdb7132bc7e02fdb31bc9799
SHA512 346ffd0242159ce4cbdc6f1568ab49670f5a37549b2d29f22ff2cdcba3c3b87543e5ffe568ce585c482cb1c60fcf017c8197ee60503816cfa43fda26079cd056
SSDEEP 384:Xu8VWJn8fspiQ77TszGyYDl3bEFZR62kq:XVkJusgQ77YS9DlrEPR6Q
TLSH
T1E662D9DBFB82F209FE7212F851539376DB2A829C0DE6C21B849023545C975E65CDB88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80de7d546bf90003_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\80de7d546bf90003_0
Size 77KB
SHA256 de2a3ec5dde2f4d53d1273269d8bf5a23479a5b598e9ec8d192381a3b5fedb86
MD5 1a281f79bcb2e31e52ca1423a75e70a3
SHA1 fbe0448d17dfb129ed659eb21476611d20e8448b
SHA512 f8d80e12a319170f2adbb931619f300d5108baf0020e60b059edf3ca41ee6723997c0ce28f0739812f636c6626daad57f4aa5e923849ee5511bafd1e9a4bae89
SSDEEP 1536:YoLY71ULP1SdDAhL9kMWic6R5QeLO37B9DehIl7u+DTXA:YgC18P1ossdic6Rg311ehAU
TLSH
T1C07308142751B97ACF2643B6A6768817B23602CD3ED7920617E0B3353C662F65E8EC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

814184927ce65ec8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\814184927ce65ec8_0
Size 231B
SHA256 18946d3a9792cc6bee20d92c753f325eff7bbfba9188e4a27fa3643315b00596
MD5 161315a1c1ff4d1921a5ddbf96c7738b
SHA1 c2c630e201c59886fadc962256fd64fe3ae3418a
SHA512 a7981d5fc4c4137ca4abe012008a5d1f0da8ccd5a84fb9935167380345d9bf395f8db3715923aa71058dc18eeb4b25af00baaa6b984b688b2eeb4983744cafe5
TLSH
T1EED022F7E7260644ED9D82F0EEBB9159C623E46649BAE6D35288A07616240F2B34AC01
MD5 SHA1 SHA512 TLSH

Submit Download

9c9c19a23ebf86c9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c9c19a23ebf86c9_0
Size 3KB
SHA256 b5f0f3db0d223e406078601907c83a833aed05aa7b4548642ca7e9632af353fd
MD5 b4578f634d8800b404ae058b543db499
SHA1 0ac88033876c07b758e13e0b086d27a5a9c5ddae
SHA512 dc1d981d5485562abdb31c56b5e4d605673a694b9f94f987e3b9a012ebd9ff7b5a6c8412776a78a7d49efada0fc3f131cc0fa38cda1c51a86309490483a0683e
TLSH
T18781D7F283826DDDCB2756F4855535562E32515F2ECAC383E0E263652DB31E14C14899
MD5 SHA1 SHA512 TLSH

Submit Download

a00988fda9c9e3f4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a00988fda9c9e3f4_0
Size 259B
SHA256 b7acbb029ceaefcece7d761a6fb5ac318d4bc179d57a0df3f4a2035da0ff833d
MD5 608608b92f5cbb429db19a78c5c35de6
SHA1 e7062cea1b1d0dde3d1e0a78e01c4df559db4680
SHA512 dd8427a1c92c66f044954e6b83bc3fdec1fc3b7c271f59b3ea4193ddd418dec040fc4fded2a865c5dd5f94181df7bbc197e375db8410e32749b23af4eea26680
TLSH
T1A9D097A7C9342101E44792F5FBBD2210FB26EB640C8CD5A001010EA2032213212CD1CD
MD5 SHA1 SHA512 TLSH

Submit Download

d226054e7ef2915b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d226054e7ef2915b_0
Size 5KB
SHA256 19fb42f3a5539e69fc029c75e57d206488277537d04b1cc0802e6a1cd7188edc
MD5 f6472384b55d64fb12fc991fbc88b50a
SHA1 6118879406f6aa5b8db24bd5928d013affa0fd19
SHA512 b270bdfacf4079f3b833021f66e85cbf9d8c4a43cafe7ad64dc7ae40ec91e3fa726a99d10a5e2c848533aae436b99145a3f197f1216981ccaaf3e1332bd35159
SSDEEP 96:PMAPS+cRNF3IdsSbOJ2Y2l0aJmOY3Byy0Eg+AUq:/sFYdsGHJ0aJmhRyy0Ew
TLSH
T100C1A5B15681FEEECB270BF241A59F63AE32019F1AC3D11726A4A3A42D715D05B64C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9fc4789d4a1d1d8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d9fc4789d4a1d1d8_0
Size 1KB
SHA256 b7ba0d58cf0382386abf82ba8ebe8d79002d870633d9bff97f76840c15496672
MD5 c424b5144464b650d70e50ed27ecc93a
SHA1 36eba4dcd042da730d11085898f4ec18d4eb111c
SHA512 a9c1d69ffab0755a53a5192e7405e8207d3a49050d46f9df0215f557b80be1bbad2fa09f1d17d4e1ae56923ee79d4382049738344898873070bd2eb6c8423f30
TLSH
T1CB1189F29006ED95DBE6F7E0E25373897D32F0074EEDCB9495000A6535F3428D9684A2
MD5 SHA1 SHA512 TLSH

Submit Download

e9ab982c7a6b8079_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9ab982c7a6b8079_0
Size 313KB
SHA256 67c5613763325c26744725e586dbf64a0ad699f56cbe1b36325fd6972f2ebc20
MD5 2afd090dc21e6a86b5cdd6f76527c34d
SHA1 56c5eefc671606bbe8f6bf7ce8b665602b67ec79
SHA512 859f60f7871ab5576fb4da383eb6629bfc5bce63efb589cbcfcba7e55d99a675adaeb0a8d564a15293afc5182ddc45874ca72bde6134241682f7d17c04a1e3bf
SSDEEP 6144:N7GHJ0Iz79FlGhh4wuCyU9ANfBLknQ7Kyui/yawgoLokVAre6ERpJRTZ6vp12iQb:0zf9VxIzpWrTRmSy
TLSH
T16764C891D7CA6EBECA2793F943629E57B232409E2FC3E30723E097652C153E24E55C49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 810330bbdee8aee8256d6a0128960a04cd2ebe5d7a0e781b5062f50d8f81a129
MD5 3d97d964f54f2a398db4cba4c65c322c
SHA1 acca89b3081d34e7d65843ae80dc014cccd0be3a
SHA512 1321ac42ea1a529026daa0862d786038d9bee85c913b18747be77333fcaab7390cc5b7a50f447724ae055ec96019aed97eb0051cf5d0b5b231836a3b3f54ab84
SSDEEP 192:zZwRdyM//K1Ml8MNx/fsstD8fpq9EdpRtz/W6+WNrx5hYM19FAO0Ig4J:zZwX1x/fsstIfwW7/bbht9Qc
TLSH
T13752E816AA346A77CCDBD208FA41BF53D6F51562D2900D489EFCCA1C01E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b0021538e327c77e8142f493534f43a15d30ca740439746c36321270e08be850
MD5 443efc6b49914a7b27871136b55d89c8
SHA1 6550e0de91b7dedfc24a98051ddd6a34ddc63090
SHA512 875425955ac9443895e48a1da7ecd9500526563ba154fbc40a9465c45e7ed8693a4192ad29da3c0a7ff2ecaff6a104aaedbaaa891e729d9736087440b05eee18
SSDEEP 192:sxZwRdyM//K1Ml8MNx/fsszD8fpqyEdpRtZY/W6+WNmFykx5hXvM19FUpO0Ig5YJ:sxZwX1x/fsszIfwFy/bNahW9Ya
TLSH
T1C752F956AA745A778CDBD208FA40BF63D6F51562D2900E489EFCCA1C01E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4bcb2d546677a6d22ec2ead30407855c52ce6d04c3efc033088e8958f45fea2a
MD5 020891de4c586d3d5d620c73380bf360
SHA1 015d589fe68210da7cf5be40987208ac4666b37b
SHA512 9f01f0162ed9d637202d305b0f262956a4db8143ef2b826aa769ec49133ab84da59c53f501e755c761702f5fdca2da755d48a13933fe13790d6b0cc7c670459d
SSDEEP 768:hMP7x8t12K0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MzLl/cK0FpOroYN:hMP7x8t12K0WRmoMQ3Au1jaKMzLpcTFK
TLSH
T1DBE21B3B284CC77E4F844E9CDC26AF966ED802CB66684D5447FA884C03C77EF951A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e64647ec3215fd4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4e64647ec3215fd4_0
Size 171KB
SHA256 3ce4f97c874c1a729f94f5844f5fb4a3de8988f581a4a9848daecc445b2693eb
MD5 a9f4331e50f2ba0ced4f576bc7eefc57
SHA1 beee63380cfb00c3761e3f22e2f8efd682a42978
SHA512 13b5f61a2cda89ade7ad032e3ed9da52466e420873d50f58c3b9219d3dbb2bb36d477513982132eb74d92afc51f4e349f4bd3dee59993de32cf4833536a6ab5f
SSDEEP 1536:ZoOegBegBEcLS23bJnd3bW/IV6QjtIsUnZlZ7W32WtvHabHXc50iIReIN/lTrW1:b3ZSYbZ6IVDg7Sr9IrN/lP3
TLSH
T18D045C326300B83B6513CE61A57E7F4E3C35E16BED0686FCA5E4E970AAD6CF20525748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2d3af8cbdb51f0f14f9e5274282a0e68271c5aa1a6e9f5dcea1e88f0c8fa6856
MD5 0419304a8b5627b38e624088e6ec231f
SHA1 10f090e5116fa40177822d0c829fe8c8782c3455
SHA512 65cbc4e0caa87ccea090d5e6e13685b666743153aff68948cace05eeee3dea998ac64ce07ac838e5b07b2926400a7f2b081f44787b7ad836a5c46f1531370a9a
TLSH
T14AA002982294D547D414C2B01CD2434037F1C8909323520152D941B48C507E0421E0B2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 71680275156fdceb87aece6a07271bb835ee6b2edf5ae166c4ce5d5e14099b8d
MD5 e3753db4a85135eb329e7216317a61a1
SHA1 94140bee656daf7893cd497410277987c42c008c
SHA512 4e8fc855a36668f45dadb6160c081c30c388fd03403c907ba149df5e02c28b9a733cd92e67e04ab51f2b0ded541acba2ac7524eea2417d0f1b2bea6b29a741cb
SSDEEP 96:K84YKhq++n+KIo+aQIKJ6OuEKnKCq4YK5yOz:y7VtfOH/d
TLSH
T17CE13550B37A13802A7D388AA1D4B87F46C134A33025A47B7BB955664F6BE20DEFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d97a80ead887e61d35ecd72f087a9bfb7fde1f3d52678e6d081704625cba777e
MD5 8fe2f370597e7ec027b8f5c791fd341f
SHA1 34cdef08aa79401a4183f3f63104f70124cb9589
SHA512 44e89c2437dc89a56f257f88cfa4782b061d2b1fc466ea3dbef2ddb460c544377541c464e905f4de0e9abd44d985d8775bef1490609624bc804c4cb3eb30e1b7
SSDEEP 192:zkGNg1PtQvAQmiU1DtavOY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIemY/FJm+2y9lU8
TLSH
T101220834A8A8AC374CD7E954F48777A39EA420B789859F59E9E91F1C01C7298270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b0ff6090c6494b2eb448fe33d2502ae8a351fab7c11e7e9bb7baee175ef95b72
MD5 3e9a902f34e32d30de703dba3024ebb1
SHA1 5a9a07f84eafe05471150777fbc2b0d81837e2eb
SHA512 ba87fc65002174dad9d2e9328019b8f3d54379fca1f6b2cdb50f6b405abe6a7590a0b41929e367b5ea486f78af79293e58bf5fe2e6d6eb4e9f9187e333411d5d
SSDEEP 384:nmjccCs+Bt0S3v8NgmMoCoQMXJY/FJm+2I9lhx39JSCwW7Ev40:gccQPFoCaq/FMlI9lhFjw0y1
TLSH
T1ED828D3424785C3789E3EA45F0863793AEB400B79AD49F69E9DC8F1C05872DD2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b9143e7bfdc4a42b566fe877619968e63e7fd10d184fc9d25b9b4777b22dcbbb
MD5 4d7b9316243585ff772b70b3e873ce01
SHA1 315af80e9521c45ebd29e758cbbe6a0ae1e525fb
SHA512 376f0a37f6e2ef4bf16246ad29498bd339cd5c97597c90b6d57bee32f24e732d536d9ad1c2e390d74cf492a59cc485664f3c68160a5c316a921d120ac0103c8d
SSDEEP 192:uuWL8NgPQhoCmtQv0QmiU1Nta9HY/Fl8AbR5m+21cFXqkhlQZzez+lR5:n88NgPMoCoQM09Y/FJm+2i9lQZSz+J
TLSH
T15C423A3868B89C379DD3E545F48737A39EB410B789D88F59EAE85B0D02C72C8270B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88e81912e67aa832a1a95a07880f0097da6dc32580548543932895adb1b44cf8
MD5 ed0dafecc1fbe73c2b2eb579685c7d15
SHA1 d5d9e217c439725258f97fb47377f29a6b19412a
SHA512 d39b258d59d17f632a5488879c5f9d2420ca30ad5dcbe7320e73419975baddb56e1bee08a1507c633eaedeaf062ae2d9d22a7581282626f90fbef9837d6d8125
SSDEEP 192:/GNh6Pt8QmiUy8ntY1B/Fl8AbR5m+2in4XqkhlU6:/GNh6FMVW1B/FJm+239lU6
TLSH
T16F120834A4B8AC3759D3E954F48777639EA420BBCE859F95E5E41F1C01C769C2B0B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b76e78d08b07fa8f69ab20415773fed1775a92a0c30070e7e6943f43d1d89fdf
MD5 d3cf0584f197cabb1d0f929484468c49
SHA1 a691fd4f15867aecb9dd2400517f4ea9b8920b61
SHA512 596c83ce279e6794c6f79dd25982071ac6e882f5488cc47b0f674ff978b9a7a8e0cb67109eb2092649170182c66d54b7639ef756ba49ddcc45e9036049cfaf8f
SSDEEP 192:ZGNI6Pt3QmiUyuctYqB/Fl8AbRo7rDvEU6:ZGNI6FZlRqB/FWrEU6
TLSH
T1FB021B34A8B86C7B9EE39E45B487B7235FA4107BDA945F84DAE41F1D00D768C2303832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 79e44d3bc9d6683511ca60f67ebe9f972d2127d0432be0dc8466b7b7cb026c2b
MD5 dd07019de0a5c390f7e63bae971f0e17
SHA1 fae8ceccbe005e54df757f621313a9705d19981e
SHA512 769662503c00a31b37dc3a7ee97a5679364c8779fd0357d1524c83005095a7d5c72bbd8dc63896aefdf4b87b53188194cd68fea0c366c8f6c430eb32709c286c
SSDEEP 192:zkGNg1PtQvAQmiU1MtaI8UY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQI1IHY/FJm+2y9lU8
TLSH
T17E220934A8B8AC374CD7E554F48777A39EA420B78E859F59E9E81F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f4b2e63f83624a0ee0eee473beefbd1365c791996d4508c6026bde549ef2efe1
MD5 b4f3b08c6a98014ee3345c34e6c49d87
SHA1 f678434d75c9f06e9024e237b239e3a149bac666
SHA512 7934cf0ac935b252d1a055cd4804054eb9d9c967307220bbfcef9714782c9516996ae56ae24fdbf469158ca19505277e030b3a6832ce817fefb62c30af854006
SSDEEP 384:nwjccCs+Bt0S3v8NgBMoCoQMXJY/FJm+2I9lhx39JSCwW7Ev40:OccQPuoCaq/FMlI9lhFjw0y1
TLSH
T1CC828D3424785C3789E3EA45F0863793AEB400F79AD49F69E9DD4F1C05872ED2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 18398b05aa18a4e6b5f1ace97c384617ac29ac75d82c81582a366c37c2979daf
MD5 4e457d92f8294604be6509df9224c230
SHA1 288538a5531c738b66b704627cc35fa3e3048082
SHA512 4feb15bd0a63c9c22392f9c39351f36e660d8397ab0d8b4745cf8ef971a54c904ba133cf9d2f19ba9136186e027c3f369a4782b86d9dfb27d3d10753cd874eb1
SSDEEP 192:zkGNg1PtQvAQmiU1GtajyY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIfuY/FJm+2y9lU8
TLSH
T1F322F834A8A8AC374CD7E554F48777A39EA420B78D859F59E9E81F1C01C7298270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 87dffc95c1a5941533e524bb3eaa4eee33051ae1046093bd2aba467f71d6e6ec
MD5 319e1331f1bdaa99898acffa96f7ee1b
SHA1 ebfed0f329dfe4901b7b7bbcbd09f43f8de062d3
SHA512 63ab84369dc7937e1fe82be8c206ac1113f838baf3ebbc62e3387cb383f575b1b66df8a94c341a05bcf60947b74b23e5c86c81b01d42ff99066d5211e674563e
SSDEEP 192:zkGNg1PtQvAQmiU1lta4ZY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIEyY/FJm+2y9lU8
TLSH
T186220934A8B8AC374CD7E554F48777A39EA420B78D859F99E9E81F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bf857b2ce4ae7339003495b3192ab17156bafb8d93505beb3cbbe1123b4ad548
MD5 70e36a1164243c657e277f8728d274d8
SHA1 ea596e5732207313fa1fa7703b7fe1870d23d969
SHA512 907684212284f7a9a52eb7ab9d53ae95c1194707a64168011df48039496ef31bb52b85094c4122b9ccbdac68ae0391df327d581748626494c5209f4edc3b3ce9
SSDEEP 192:zkGNg1PtQvAQmiU1Xtam/Y/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIW+Y/FJm+2y9lU8
TLSH
T152220934A8B8AC374CD7E554F48777A39EA420B78D859F95E9E91F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6b7782f670ae105a358c6a623294f350513b6662ccb4b2341b8072645f03c88a
MD5 630efae249447c53b6568471825899c0
SHA1 9f12e4612cdc8b290903c641450c1d9690a86a1f
SHA512 afbb29210939b85d43921cc0d5c5b1c2da5edb7248a4210f245f4289bfc995eaa737218a91cd684deab7d160c4ac3584f502386aa645eb7ad26ab5df9decadc2
SSDEEP 192:zkGNg1PtQvAQmiU19taRgY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIgCY/FJm+2y9lU8
TLSH
T1D2220934A8B8AC374CD7E554F48777A39EA420B78D859F59E9E81F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a68ea4a26a3b430546e4f8b4965afade02fbac017ba66016809d14bd133e088a
MD5 fb4be1dec7d96be8e0ca31013a0d94bf
SHA1 6b2b0d842f7b4c81e01791bb370f1ae5807ad2b6
SHA512 5d2dadca1c0773ace631494587bad20b40f204208fcb3b2b55188ddf704556af2db489d2f2b98e53bcd21961cc69bc23b9f2dbbd2fa9676bb05e2fc9a67cd882
SSDEEP 192:zkGNg1PtQvAQmiU1YtaQxY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIlSY/FJm+2y9lU8
TLSH
T1C5221934A8B8AC374CD7E554F48777A39EA420B78E859F99E9E91F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c9215f82025fc2739599e1848f376be5663cd4caff68bbc885e6a652f65fec03
MD5 d7d7f3abf0536da035d437ec3d930ffe
SHA1 2cd5b6dd2b27dda6d4f556b6c0735c7371c3820d
SHA512 236754d3363cc1335b6f02480a5b2da662830050e4be66a2c9e94443079d360c256fc87d42987319c61cb3face3a665f0b2be9f3a935b7c1cb9b73ee7bc5e3e1
SSDEEP 192:zkGNg1PtQvAQmiU1kta01Y/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIRSY/FJm+2y9lU8
TLSH
T1C5220834A8A8AC374CD7E554F48777A39EA420B78D859F59E9E81F1C01C7298270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2f15ebc85886669bd078f537adb29dac5ccbf58a2f4b5ad6dc76d9b59c0796a2
MD5 21c609305b97cca277b07cdda4c1f84c
SHA1 dea614588355a00ec2286015d46b385c16bbf7c4
SHA512 a4851de2e837f724aa5d3d91f48b324c3ec0b59297686df529838bde198d465c495dcd343e2a530f7cc2518c2652c50d3d4421ca0d629d015f737e8532dcaeec
SSDEEP 192:zkGNg1PtQvAQmiU1ytaCrY/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQIHWY/FJm+2y9lU8
TLSH
T19F220934A8B8AC374CE7E554F48777A39EA420B78D859F99E9E81F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d93c0bf94e845071e61089236c3f59c52d99bbccda996a4a57f50dc3825631b8
MD5 0440774391b4a52d1e956856e10cfbaa
SHA1 db87ca9e2968c16240799b00d49efe27fdc3cde2
SHA512 539e8f8712543fe3f3847fc6146e4a6f637c04a02edaaf47a7007f0cba51b2401b6961b2d5431794ebdb85641b5a3137ae7ab193df5553b1a73e91012f2f5d2c
SSDEEP 192:zkGNg1PtQvAQmiU1htae1Y/Fl8AbR5m+2inFXqkhlU8:zkGNg1FQI0mY/FJm+2y9lU8
TLSH
T1BB220934A8B8AC374CD7E954F48777A39EA420B789859F59E9E81F1C01C729C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b16805a8f006baa711f17608b5f08f63c00e6af4ac5f58d9dc1ec535853cf72e
MD5 13744112458dd93ceaae68362e7ff405
SHA1 0a1a4bd8d5b02d1bd89673af54367e9a4287274d
SHA512 2ddef2a1c699a0cb6c2048fe56212b221872ca0f01653a63574cb99453922ac5f947078f159113971acc1b48b063bd849a1b3a997c66c6e8aaa9a3cea5702ac7
TLSH
T1E5E0021AD30040C7D554033220C31F143FB2D120430303165B30417D3D243006E44050
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59f0a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f0a0.TMP
Size 392B
SHA256 0fdf94f8bf19e65ba8c158e4f640d307cd4834dbd0744d7cd9ba0f2eaf6c8de4
MD5 ddc43ba045fbb8d9d12880d0de33ee8b
SHA1 e224379c38aead0f02f7ced5a79c90c26987ed2f
SHA512 995ecf2edd9b026772d1625d119f0ce62c71fcd0e521cf495580a9d57f8644a254bbec05c9d8b779764d50c227c0302f41567d7acc9545b3aab368e3366eaec9
MD5 SHA1 SHA512

Submit Download

28ed4982-8e89-4fe7-8ae2-88084e9bd38b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28ed4982-8e89-4fe7-8ae2-88084e9bd38b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

06c8a591-4952-4091-8f17-9ca0542bda37.tmp

Path C:\Users\Admin\AppData\Local\Temp\06c8a591-4952-4091-8f17-9ca0542bda37.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5432d2af-ea6b-4304-ada0-d6adf44ecf2a.tmp

Path C:\Users\Admin\AppData\Local\Temp\5432d2af-ea6b-4304-ada0-d6adf44ecf2a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b74d41c05894fe3b13a04c5268669b2.exe

Path C:\Users\Admin\AppData\Local\Temp\5b74d41c05894fe3b13a04c5268669b2.exe
Size 545KB
SHA256 2d428390ca65b7afa84dbbc1c0c7de398a9131d21c7c54f3af7bdf5e33889173
MD5 88b668f7f41cd4e6bb6043cd1e2d8008
SHA1 447a31768237887d1b6f434909ed38c50124591d
SHA512 2eb812187e92c3180fc7cf3af252ccba9258b6a6bd19685c364287501edcdf66f4bb94fa7c71d7da99bdcf25b09097c4a8adf00c724c97f357828e31fa9ebb1d
SSDEEP 12288:+gyq+/ihPoDOBjTYZnGEL/Kp+Fg0sSVKIKcPbA+h4cQkuoS:PyLkPoDAYZnGaQMsQKFUrS
TLSH
T123C423901E6C17ABE62247BC5B4212B2CD6FC317B0195A760BA82F1FFF875D0610D5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D76.vbs

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\9D75.tmp\9D76.vbs
Size 3KB
SHA256 249c8567b26a2f26d00245476cbf07f065a4d3dbe590b4aaaf57df4558d8a076
MD5 c2fb837b63810883832a3bf675ada00f
SHA1 bc9541ff8deec61e0211473bf33336d527c4ee42
SHA512 3d95bd62e4b0ec64b03b7a52c2c185eae69fed97c84f0a0b5ad3cdf4194105ec134551ef313b0946a13ebbd92e60ed8f96156a0b5eb06067dfee8c2fdff14c4e
TLSH
T1A561FE165FC20710B2F26F957CF05A9B4E15BB21F827EB5D1D800E4E1CB298C8CA8F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Lines.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\Lines.exe
Size 103KB
SHA256 df3cc9a807a80697cd8b72f8f17a365849146cb4e41b4340e42f78d1bc1722e1
MD5 6381e3e4b02204e1353218ee6ec45c2a
SHA1 a350d4432d2a1a8c7a34d5ea7214326ffc02c270
SHA512 ac7f21c539667a77236b78006740c634b7d4c0a55dcb776872bb339501112c62e1990bbb73b8f3c4e5b065167b8102fe35aa4633248b19dca602606b68b15015
SSDEEP 1536:ob5iT50crY0Xy4WOsu3yUyJCbcVDG7O/Ybx:oc10cXXy4IJXK
TLSH
T17DA308D7BE8AADA3F925133989F58329133DF7C00B828B171D35993A07176A17FC9246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\bytebeat1.exe
Size 102KB
SHA256 41ac58d922f32134e75e87898d2c179d478c81edaae0d9bc28e7ce7d6f422f8b
MD5 6b673ece600bcc8a665ebf251d7d926e
SHA1 64ef7c73a713bf3c55fb4ac4e5366a7a425f1b4e
SHA512 feb18a1aa72de47fd67919e196abd200afdf22ad5a7e5dac20593252d8b2ca86982bb07c2fed3681ef06c9933c6d197590c1df65aa5df93cb6abafca5e53e9ff
SSDEEP 1536:FlU5iTH9c7Y4yXKOau3yUyJCbgwmw7LgBB:FH79c/yXyJrD
TLSH
T14CA308D7FA86ADA3F925173989F58329133DF7C00B828B171D21993A0B176E1BFC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.wav

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\bytebeat1.wav
Size 1.3MB
SHA256 4599f6f06c7f491a50e3c4012a83cce9f3ee13ae209189cb8964f0b6ba14614c
MD5 09d2094f56d2d38aa64eac1d90c5a554
SHA1 c6268759b1eee9fdfafa0d605d62bbbf85defbca
SHA512 4ca756a06612c281ec03dd9f064b9ddaf6756b00a5d54dee62728f5cdd7ad3d928559b9857ed2f733b8b3e842b396fed94b212ef2a384265ac623433d67010f3
SSDEEP 24576:QWLbSujLfL7L/3LbjLXzjXXjzPbxNTHzXdHHHDHHHLHHH3HHHfHHHHHHH5TjTzLa:QWLOujLfL7L/3LbjLXzjXXjzPbfTHzXy
TLSH
T1DA557C400C3E555EF432B9AE5CF59D04C36F12E58291B222887FD0AA79D7BD943ABC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invmelter.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\invmelter.exe
Size 103KB
SHA256 229f07414798adb8f850697cb0ad12a1911443c8b31c0484c1b96a16efee9a02
MD5 0928425141c06ebb894e50a54c2aa1f0
SHA1 5f27cdf914df73946a0d2e35bfa38ade93a16bd2
SHA512 bb734885ce1e6a8ec2bf32bc0bdaf89298a419b25d6ac73362b850742f5bc11f4e6bf3cf03cc6d1bd025487140a778859211f70cbd2798fed1ea8fa57c957371
SSDEEP 1536:cJ5iT50crY0Xy4WOsu3yUyJCbcVDG7x/YCp:cq10cXXy4IJsf
TLSH
T1CEA308D7BE8AADA3F925133989F58315133DF7C00B828B171D35993A0B176A17FC924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patblt.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\patblt.exe
Size 104KB
SHA256 ad088fa2c014bb718c005149138f284b183c494dec633ccb88c6c14ef1935199
MD5 02a349c19fa0cef84bc88abf65f8bc2c
SHA1 65a1215867c12109150c10f3f831e997e411e131
SHA512 33a1517cd1ef56429dc387fcec7e1b6f90438c5608deefb408d310239520a8e5b6c977b13b419d5795f7ba68c7ef03e951ff61534fd53fe6d36912a6fa93d06e
SSDEEP 1536:ZqpVF5iTePcCYMyaaOOu3yUyJCb4NET7xa:Yc6PcQyaWOpa
TLSH
T198A3F7D7BA8AEDA3F925133989F58329033DF7C01B828B171D31993A1B176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rgb.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\rgb.exe
Size 105KB
SHA256 33cbdb6e00f3f42f58502af8a9150604a44bb9b26825c909aa0edb5c744a1f13
MD5 bfc9e8ab494313d6efb67fc8942f5ee9
SHA1 1b42cc97803221538e020cb90517cb808cf19381
SHA512 2d01f92397b65eade1f6140f80e2cb626b3e53b112c7e77e84ea7f6092b07c05eacb9e5e9bcb4676c8bdd10fcfba4fe297f2a01eedffffa594af87839baae030
SSDEEP 1536:/+hs5iToacXY5y8rO+u3yUyJCbchGf7y8y:oVkacuy87Ee8y
TLSH
T1E9B3F7D7BE86ADA3F925133989F68329037DF7C40B828B171D31993A1713AA17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sinewaves.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\sinewaves.exe
Size 108KB
SHA256 edce21b4ec9b68e4e8a5232c1432d5de0865f1fded27fc69965a2d3d568de909
MD5 e9534d452e7b06b5591e0509553f8d86
SHA1 2be1075e3ffe29c95fb0fcbed4dcf9fc54788a58
SHA512 21c40c98f9351676f9a105a733472b4b9145a2a2fe13a82b681fec1c73d893bd2be472938e2b84b70836875ed18d0e615a003b4af0f99d5d463f2031500b57c3
SSDEEP 1536:h/5iTducLYAyCEOEFu3yUyJCbjNYdZikN:S5uc7yC2TrdFN
TLSH
T1B8B308D7BE8AADA3F925173989F98319037DF7C00B828B171D31993A17136A1BFC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

txtout.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout.exe
Size 12KB
SHA256 89d6b417fad69302f1f3c50e672e90dc97560b1b769b5a9bd5d0afed40aed26d
MD5 1914c6ba37c1a38bf0ff70e6158656f0
SHA1 0a060af531d8a149c5d8cb0e6ddd2d436a63172d
SHA512 98e64fbe9603ba546664b8b942dc708450651b2d553d630b84284c755fec371033ae629e77d8a85410e2a31c20a57941fbda16b53611e67f819575f2743a1b8a
SSDEEP 192:4HdGmGhPlFIfTbSzCx945a71HjLoNsGEt9XNb6fT7Uz+:MElFIfTmHa1HjasX3bos+
TLSH
T1A042E817E283ACB2E827C0F845FBAB7A8D33F9528D25447ACFF0FD8666525E17409614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

txtout2.exe

Path C:\Users\Admin\AppData\Local\Temp\9D74.tmp\txtout2.exe
Size 105KB
SHA256 ecadb0f872cf2c112620e0bfdb9f657dd5ac25188c762b2ed7261f9612163757
MD5 21d90b4350b6c69d01174240997806c3
SHA1 ca6cdfe5f7f0a15ca177eabf7596d64bc284215c
SHA512 1e8089c7c6f1660652b29ab5a5ccac7a51dfa5fa2e28144df5a196b232b4ac489d5eee7e873144365004b76995ce8315d29f7af5ffc90130b61c38a06f1966a7
SSDEEP 1536:iK5iTe3cPYvyp1Ovu3yUyJCb0thM7GGL/e:2a3coypuzgy
TLSH
T10AB3F7D7BE8AADA3F925073D89F58325033DF7C01A828B171D31993A1B176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e657f1764e634767ad01ce738589e4f4.exe

Path C:\Users\Admin\AppData\Local\Temp\e657f1764e634767ad01ce738589e4f4.exe
Size 844KB
SHA256 00201a2fd4916193c9c7bbba7be6a77fa5876085480b67da4e1228fd8b23ae5f
MD5 8cac1595b184f66d7a122af38d5dfe71
SHA1 e0bc0162472edf77a05134e77b540663ac050ab6
SHA512 88d3753ce73bbf95ee1fdbdff21eb9331e59ca92cfa5c489f141c07dc90871e3032e331c9dd77b1fec4522add3ac25c51d5c699d7801a5343dd2ae447c60f8f8
SSDEEP 24576:Twbdh4Y2uoLtciBtgFD3O7iPTr8pYocr6x:T212uohceaYg
TLSH
T13E05DF67E0040E32C499933E2863773243345C28EF670B2456D8FD696ADF9F86769BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a9405eb-918b-47d9-b2e4-2e02f4606f7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1284_1707406318\6a9405eb-918b-47d9-b2e4-2e02f4606f7d.tmp
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1284_315792707\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-22-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/580-73-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/580-74-0x0000000000A00000-0x0000000000A7B000-memory.dmp

Download

memory/604-231-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/604-232-0x0000000000790000-0x000000000080B000-memory.dmp

Download

memory/616-75-0x000001CC326E0000-0x000001CC326EC000-memory.dmp

Download

memory/764-9-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/764-8-0x0000000000A60000-0x0000000000ADB000-memory.dmp

Download

memory/764-2-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/764-3-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/1204-79-0x0000000000A70000-0x0000000000AEB000-memory.dmp

Download

memory/1204-78-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1688-77-0x0000000000810000-0x000000000088B000-memory.dmp

Download

memory/1688-76-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1816-120-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1816-121-0x0000000000720000-0x000000000079B000-memory.dmp

Download

memory/2172-151-0x000000001C160000-0x000000001C1FC000-memory.dmp

Download

memory/2172-149-0x000000001B590000-0x000000001B636000-memory.dmp

Download

memory/2172-150-0x000000001BB30000-0x000000001BFFE000-memory.dmp

Download

memory/2172-154-0x000000001C2C0000-0x000000001C30C000-memory.dmp

Download

memory/2172-153-0x000000001B650000-0x000000001B658000-memory.dmp

Download

memory/3572-82-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3572-83-0x0000000000780000-0x00000000007FB000-memory.dmp

Download

memory/3676-289-0x0000000000A60000-0x0000000000ADB000-memory.dmp

Download

memory/3676-288-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3680-1-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3680-5-0x0000000001070000-0x00000000010EB000-memory.dmp

Download

memory/3680-4-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3680-6-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3680-0-0x00000000751F1000-0x00000000751F2000-memory.dmp

Download

memory/3680-11-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/4132-94-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4132-95-0x0000000000A40000-0x0000000000ABB000-memory.dmp

Download

memory/4788-152-0x0000000000A40000-0x0000000000ABB000-memory.dmp

Download

memory/7720-1350-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/7720-1351-0x0000000000A80000-0x0000000000AFB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads