Overview
overview
8Static
static
3CW-Log-Ext....0.exe
windows10-2004-x64
7CW-Log-Ext....0.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3CW Log Extractor.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
8d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows10-2004-x64
3resources/app.js
windows11-21h2-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
608s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/05/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CW-Log-Extractor-v1.0.0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
CW-Log-Extractor-v1.0.0.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
CW Log Extractor.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
22 signatures
600 seconds
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
resources/app.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral15
Sample
resources/app.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral16
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/elevate.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral18
Sample
vk_swiftshader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral19
Sample
vulkan-1.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample260502-txadcab15x
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Loads dropped DLL 1 IoCs
pid Process 3412 msedge.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Windows directory 42 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_718407177\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\keys.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\regex_patterns.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1165832820\typosquatting_list.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_632546941\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\autofill_bypass_cache_forms.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\edge_autofill_global_block_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\v1FieldTypes.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_766795742\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1604720841\deny_full_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1604720841\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1495983167\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_105003256\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1848835270\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\classification.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1604720841\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1165832820\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1165832820\safety_tips.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1495983167\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_766795742\smart_switch_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1604720841\deny_etld1_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1299652848\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1165832820\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1848835270\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1848835270\sets.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\travel-facilitated-booking-bing.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\travel-facilitated-booking-kayak.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_702130595\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1299652848\domain_actions.dll msedge.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_105003256\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_766795742\office_endpoints_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\extraction.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_632546941\crl-set msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_702130595\arbitration_metadata.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1848835270\LICENSE msedge.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4896 msedge.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222129489947811" msedge.exe - Modifies registry class 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4695" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134142267872437866" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070100420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000039603be1ae91dc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "960" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400540010001000ffffffff2110ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{81741B74-A601-4C1F-894C-46BF5A1D1D44} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4695" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "960" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5662" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5757" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4790" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "990" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \Registry\User\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4790" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1927" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{52288015-F334-4046-84A1-845EA34E6129} msedge.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3676 explorer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2908 msedge.exe 2908 msedge.exe 3676 explorer.exe 3676 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe Token: SeShutdownPrivilege 3676 explorer.exe Token: SeCreatePagefilePrivilege 3676 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 4800 sihost.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe 3676 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3676 explorer.exe 3676 explorer.exe 3904 SearchHost.exe 4904 StartMenuExperienceHost.exe 3676 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4152 3412 msedge.exe 79 PID 3412 wrote to memory of 4896 3412 msedge.exe 80 PID 3412 wrote to memory of 2964 3412 msedge.exe 81 PID 3412 wrote to memory of 2964 3412 msedge.exe 81 PID 3412 wrote to memory of 2964 3412 msedge.exe 81 PID 3412 wrote to memory of 4160 3412 msedge.exe 82 PID 3412 wrote to memory of 4160 3412 msedge.exe 82 PID 3412 wrote to memory of 3976 3412 msedge.exe 84 PID 3412 wrote to memory of 2388 3412 msedge.exe 85 PID 3412 wrote to memory of 3976 3412 msedge.exe 84 PID 3412 wrote to memory of 3976 3412 msedge.exe 84 PID 3412 wrote to memory of 2388 3412 msedge.exe 85 PID 3412 wrote to memory of 2388 3412 msedge.exe 85 PID 3412 wrote to memory of 1580 3412 msedge.exe 86 PID 3412 wrote to memory of 1580 3412 msedge.exe 86 PID 3412 wrote to memory of 1580 3412 msedge.exe 86 PID 3412 wrote to memory of 3772 3412 msedge.exe 87 PID 3412 wrote to memory of 3772 3412 msedge.exe 87 PID 3412 wrote to memory of 3772 3412 msedge.exe 87 PID 3412 wrote to memory of 2084 3412 msedge.exe 88 PID 3412 wrote to memory of 2052 3412 msedge.exe 89 PID 3412 wrote to memory of 2084 3412 msedge.exe 88 PID 3412 wrote to memory of 2084 3412 msedge.exe 88 PID 3412 wrote to memory of 2052 3412 msedge.exe 89 PID 3412 wrote to memory of 2052 3412 msedge.exe 89 PID 3412 wrote to memory of 948 3412 msedge.exe 91 PID 3412 wrote to memory of 948 3412 msedge.exe 91 PID 3412 wrote to memory of 2492 3412 msedge.exe 93 PID 3412 wrote to memory of 2492 3412 msedge.exe 93 PID 3412 wrote to memory of 4636 3412 msedge.exe 94 PID 3412 wrote to memory of 4636 3412 msedge.exe 94 PID 3412 wrote to memory of 4556 3412 msedge.exe 96 PID 3412 wrote to memory of 3676 3412 msedge.exe 97 PID 4556 wrote to memory of 2616 4556 msedge.exe 98 PID 3412 wrote to memory of 4564 3412 msedge.exe 99 PID 3412 wrote to memory of 4564 3412 msedge.exe 99 PID 3412 wrote to memory of 1872 3412 msedge.exe 100 PID 3412 wrote to memory of 1872 3412 msedge.exe 100 PID 3412 wrote to memory of 2484 3412 msedge.exe 101 PID 3412 wrote to memory of 2484 3412 msedge.exe 101 PID 3412 wrote to memory of 2160 3412 msedge.exe 102 PID 3412 wrote to memory of 2160 3412 msedge.exe 102 PID 3412 wrote to memory of 2728 3412 msedge.exe 103 PID 3412 wrote to memory of 2728 3412 msedge.exe 103 PID 3412 wrote to memory of 4484 3412 msedge.exe 104 PID 3412 wrote to memory of 3560 3412 msedge.exe 105 PID 3412 wrote to memory of 5040 3412 msedge.exe 106 PID 3412 wrote to memory of 1964 3412 msedge.exe 107 PID 3412 wrote to memory of 1964 3412 msedge.exe 107 PID 3412 wrote to memory of 3172 3412 msedge.exe 110 PID 3412 wrote to memory of 3172 3412 msedge.exe 110 PID 3412 wrote to memory of 1128 3412 msedge.exe 111 PID 3412 wrote to memory of 1128 3412 msedge.exe 111 PID 3412 wrote to memory of 3892 3412 msedge.exe 112 PID 3412 wrote to memory of 3892 3412 msedge.exe 112 PID 3412 wrote to memory of 2908 3412 msedge.exe 113 PID 3412 wrote to memory of 3084 3412 msedge.exe 114 PID 3412 wrote to memory of 3084 3412 msedge.exe 114 PID 3412 wrote to memory of 1276 3412 msedge.exe 115 PID 3412 wrote to memory of 1276 3412 msedge.exe 115 PID 3412 wrote to memory of 1372 3412 msedge.exe 117 PID 3412 wrote to memory of 4300 3412 msedge.exe 116 PID 3412 wrote to memory of 1372 3412 msedge.exe 117 PID 3412 wrote to memory of 4300 3412 msedge.exe 116 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffcbcc2c188,0x7ffcbcc2c194,0x7ffcbcc2c1a02⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17766819226390733275,14692623170949182456,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:112⤵
- System Time Discovery
PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,4628447062744399661,14317001706420617610,262144 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,14655013567034293716,7181379976943878253,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:132⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2742693969884558428,1928573106632952795,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7560786847465678981,16439186460144626776,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,7763796886627833921,4235920446510385955,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,6604650974125116969,1857560680452394288,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:92⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,13337938829212142519,3142741692567236143,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4420,i,3008027622800994785,10795380090879166037,2097152 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:92⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,17038038595775923298,7775227047262821806,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:142⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,6374569044823776848,14251335653297818104,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:142⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,14724835632973172649,10768062893202023064,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:142⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5757708130885462148,6021285120634051396,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:142⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,17269266194735478295,5316139584491758541,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵PID:2616
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5757708130885462148,6021285120634051396,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:142⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,2868463247016729913,10344054138352868328,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:142⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10425901961667630294,13063491669163344773,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:142⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,12754679300267402477,1405339943281238051,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:142⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,1629342772739483697,11116374342095615628,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:142⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14059309887911891356,5030239810368127282,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:142⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,2433877489636052847,14174857393158055065,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:142⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,3708341185877013864,5260378960356064760,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:142⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11692424334078967879,11292970418611998877,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:142⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13535529272185289378,579575646342443489,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:142⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,17968882388323248141,18331511392123159690,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:142⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15954710807785789529,15499837032840935688,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:142⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,14335756208046407125,7353149335999088161,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:142⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4812,i,17210544546409891267,11092445048089699740,262144 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,14459659770189310293,469655366116522387,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:142⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,9580597099211403385,4012658197233008038,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:142⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2054059121654339914,15474507569046830253,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:142⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17086115245938469551,15529931895363906165,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:142⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,13106977683190204326,12664570628462283636,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:142⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,7376180451467823837,10628315867864045326,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:142⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,10200904976697566255,16513002387394864943,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:142⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,17149932968078322699,10691638583408594311,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:142⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11599206856917733013,15250396584997699402,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:142⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7934584865250096290,14964789301750462661,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:142⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,10347754897492032150,16703839436284563708,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:142⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,273379710048189494,15477522579347994208,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:142⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,12640198004655709452,3653529163121001934,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:142⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,8938372345789579450,17863655165202702597,524288 --field-trial-handle=2024,i,9787554062725082414,3013302159100465391,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:142⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4888
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:4800 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
PID:424
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3676
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:4720
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
- MD5 3c974a700ca35a09f8c2b49b1532d825
- SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
- SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
- TLSH T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
- Size 3KB
- SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
- MD5 1de85fec2dfcc28011a7c2aaab95eb5f
- SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
- SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
- TLSH T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
- Size 161B
- SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
- MD5 4b1a79b1996f03fb926a97912835c881
- SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
- SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
- TLSH T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
- Size 6KB
- SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
- MD5 5d4464dabc1289c3a010e14c05b92c57
- SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
- SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
- SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
- TLSH T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
- Size 509KB
- SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
- MD5 b1c140ef49f01eea089d3957da1a529f
- SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
- SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
- SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
- TLSH T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
- Size 22KB
- SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
- MD5 d01869348d5a783f61f90cbb27b82a78
- SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
- SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
- SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
- TLSH T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
- MD5 35b0754e7f5b0bef0f59e6474c3c9e30
- SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
- SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
- TLSH T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
- MD5 9093390d9e798f9a4ccc25251c10fea5
- SHA1 96837bd82509feb4ca69a53466162950148f0394
- SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
- TLSH T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b0a6ace-9291-465f-9efe-45a66002a3a3.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\343bfb91-1d03-4425-84b4-002e2122ad23.tmp
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 7KB
- SHA256 2d008dc57f015fa4da19c1a3c2d47a59423e9f02a6a63af9f5e3bfeb974ef41b
- MD5 f5e81a4d11fa6b8aae2320f39f0c254e
- SHA1 796aba58a602dcf80525c223d752ae9f88af9222
- SHA512 f6ff790e4487377f3e6e40aa3d7ec79704dc59449963b685426c90b8de492f7fd1dc1c53e7351538afb3e1a961f31b27ee410dad69a58da140bce7f1e541c983
- SSDEEP 192:Yjc/1333333333333333333333333333333Uh:Yjc/133333333333333333333333333A
- TLSH T15AE1028682D4C6AA8B0911C7CE94735D90F17709FBDCDA08135CCDE9304F4DAE9AEBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 7KB
- SHA256 bb0865deca78924be420a67052af17f899f7a09c311dde0ac3ce0f265b2b0045
- MD5 3d5240a22e5f2ee838e4d51bb3052480
- SHA1 7dae4f000486b899842a9fc8adfc8af3f5b1986c
- SHA512 8163ff4cf2ffb731353f963b570993f12e61092997059094b74b3cdf8059d38ea3e6aeb5fd380d283f9b2bb7bb5002a3c1389216ef71c996af07f65212dc8034
- SSDEEP 192:GjEkyUUUUUUUUeeeeeeeeeeeeeeIIIIIwwwkLO:GjEkyUUUUUUUUeeeeeeeeeeeeeeIIIIZ
- TLSH T11BE1508642D5C69EDB0A10CBCA68635D41F03709EBDCD648535CCFD9308F5EAF4AA7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 448024b75b52bb457714a1f2bf735b1495b73aa2e86a19132d51048af7626b4e
- MD5 667070a2e89339bb91562faf90c1e1ef
- SHA1 151c7270311ae0340eee1bceab50b9005940d132
- SHA512 1a90a8ec0bc41feaf29f11ecba80b7f59b9eb6891c272c47efafcd330087ee90e8a41122eaf355121514cb5c9f1a9a66737aa0c8bb9cf44eda7c489d093a6367
- TLSH T18361E541E0BDC40BE3F0E4B832A6300A71347A6F24861E96639E583EFA0F7578C8061F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bafe.TMP
- Size 3KB
- SHA256 fc7e15190512f358494b920d2891b265aa389ec95ca527f2a27ae305e7127355
- MD5 4d88a5c98e1ff92bcb2254918d91e6ac
- SHA1 2356a76bd42cf59680bc61990146567a3bf9e8dc
- SHA512 3696451a01eed9560febf112f1f4ffe9e405df8d545df2788a4f59d6486ef0b2a23cb31ffc0adcab85fffcd6212b8c1f3da7e9f7d4c0937198d9f3b421cdb63d
- TLSH T14361E541E0BDC40BE3F0E4B432A6300A71347A6F24861E96639E583EFA0F7578C8061F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 4cd14cead04a5b304c608d786c6b2062677d1633e1b39cf4b67164cd9b041ed0
- MD5 ec0f0facf711540826b5b7a74bff311a
- SHA1 a6d02ac56993069a1ccc2011c5d3ac95530bb51b
- SHA512 0f21aa4268ae294c4ab7a6052f8f4cca4d1e0348cde60835579b80458765ea8f5599bf2a9a1b0e7a161adf46a5ca0383a05da354d59df36fb23aab0bfb890496
- TLSH T1FC41DEF7C3E8856E8A1196F0BA187E2BCE2D0954432C3D5AC5E4EF5B93E2470E14195F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 b3ae62cdabebf63f88773e4eb3c2ff0271a21374f0807d4dd27ff77b6c33d0dd
- MD5 19010273dca6afa871f525b4ecb20b0b
- SHA1 36cf28261ee82e0dd01c6e986eb42162bdc346b3
- SHA512 a50e5c88cb6907c3ab30ebaf1dad0413381d6a67e3906f33fe6f36ab358d429191184d2277de080a03de4023da5223280a72e5eed64d749aed421d8d89652cea
- TLSH T13041B1F783E4856EC91195F0AA18BE2FCE2D0554432C3D9A85E4EF1B93E2471E141A5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 f235ec11a593097a47a1887a9d021d18213bd710da0877672129df430129eaa8
- MD5 efcc382fa00122250bf2ab79021b0701
- SHA1 b23947ca8707219387248dc8496c346ef85466ab
- SHA512 b63200ebe8dd469ad2d2d634007e166211cf58275db0a3ea3a5f3f486b7ff02c23fe10262a964e1829cbd57f2f36bc6e3ed8a5444de961dcafa00767bc98d723
- SSDEEP 192:sxZJREyM//K1Ml8MFn/f4sGgqx1Idpyb/W6+WNGY0X2/0+wNEIg4J:sxZJGdn/f4sGgWGo/bG5PzNoc
- TLSH T14152F9056A34A977CCDBD31DFA45BF53D6F9106292940D44AAFCCA1C05E6AED2203C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 b247d38545c7daef76363b4e2ee4658d76cdfeb9c46e3a41e3492fffc26172df
- MD5 93e32941339c10b24876144624c75d26
- SHA1 b76e4084b051a1086038c731b1ea5d1842900bee
- SHA512 b314dcd299aa50827cd7143308c675e9c3858e8281b8daf56810feccfcea9312351ec9a3b21ca886ff776d87a29aad92dfe02715524496bcb394c9189c142af8
- SSDEEP 192:sxZJREyM//K1Ml8UQ8Fn/f4sZzgqx1IdpEb/W6+WNGY0XuV++wNEIg5cJ:sxZJGqKn/f4sZ0WGG/bG53zNoS
- TLSH T16D62D816A634A977CCDBD21DBA45BF53D6F5106292540E44AAFCCB1C05E6AED2203C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 7c6ecf6b4d793bd37f22f40a426c16ea6e280da937c62f562938ecb4ed626b23
- MD5 fd1546c8acbf337a330ad4e6111e978f
- SHA1 6052d5fe68b70a02ec5c15c725e20b21804bdfb6
- SHA512 494e655d82f9960ce89f8a5d5c60f762be27c6576166bc9771ec426c72b9ccdf6275c6015d75f1452b9401733a92b6fad7495f6570ffc7db2e09aece6744e5d1
- SSDEEP 192:sxZJREyMqZ/K1Ml8UQ8Fn/f4sZzgqx1IdpEb/W6+WNGY0XuV++xNEIg5cJ:sxZJNqKn/f4sZ0WGG/bG53uNoS
- TLSH T1BB62D8166A34AD77CCDBD21DBA45BF53D6F9106292540E44AAFCCB1C05E6AED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 d9daa0a62e9bd8e833336789a3579307a4a5aa5a76866557e09d79f6c8eec7bb
- MD5 b2ad89f4df6cfd92a3d5b21fe7eec11e
- SHA1 9e4b74f6bb285e4bd45d8b0ae5e3edc14c4b1069
- SHA512 6c60fcf317efcd96e8970e065562f619638b296d46a5780bbf3a447a4d64236c5a940cc2deb047d8c0efa2048e82881272996be4c881bad779f0130215539b52
- SSDEEP 768:bCTTF8J520V7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3SPmsxtu:bCTTF8J520jEnYwWRmY4QPUu1jaKSPmx
- TLSH T1DA030C3B2C0CCB7E4F804E9CED26BF8A6DE8018B9698C99447F9844C03C66EB55175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
- Size 2KB
- SHA256 cac4578c6549f8767cd9c34217d0fd4ae6daad6241944f1d8ea72fe1553c9bf6
- MD5 4c79d1a019a69fcba01d6803e0f2ecc3
- SHA1 6618a3f274d3b333630084491600d6438715853e
- SHA512 fd26e9b3efa4c2739fc2f8394fefe3a04cba08837d1a011b07e95124806217baeec5b9c33f146016cfd93f0ba2324a0fd5c9c2ab5467bed698499db422090472
- TLSH T1FB51F68C8C8D8B13CD7951B195F41128337449EE2E9C4B0B6CEC4A7AADC77AA1CD320C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe5d0ae0.TMP
- Size 2KB
- SHA256 e9420c6ac29a295714b8e6cb26b503ce2808ccd39d7adef5c31aedf669ed24bb
- MD5 5cfaadc61ff32d3677e22162839ba871
- SHA1 30374068cdc3593e7a3ea613506edfa1b2915c2f
- SHA512 2d0de8422fe63bcc40748e1d6d512c9b3fd62f2b57f52188d86b62d1d710eab9d8d374d07a7734d5b37d80de9caf27bbad556b66c62bf285b7b1cd5459d0cdfb
- TLSH T1A951956E5C814A22CD6080B349C96429333EA89559849F0B34FCC633ACC76AD3DA2394
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 8918143e5deb88e2ca94230207db5749b82b470ec081d84c09e8bb94d1314b9d
- MD5 d841121a3ad98d4f246faff01d09a8d1
- SHA1 d47f745353542440b2d796590ef45012f5dc81d7
- SHA512 05a9a3a30fdaa9f5e908a7583e8755c6b851f80883a215ff7b8f7edca735b40f8f28767136327b32c42947c147882dfe37eed406046ce2dea554cf961c023107
- TLSH T16DE0D8B72DFA1824DCAED3D2143094E50585BE6DD511FD5E1059638310B1351345AC6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 6KB
- SHA256 fda145c8fbd86e042c82f81581513668e3d2464446b618323c1b232dee0b9dba
- MD5 4d4b839277ce7678355c43134633be7a
- SHA1 3983d22d2bace707702b49df4765423bc41a7562
- SHA512 76b5eebdd6ed792919eec9d90e50c4530fcff4b90a8c06cb03100f1d1a2430971520d92d4700de1bc4bd3214341ff53a4698ce713b95be448719eabb0360eefb
- SSDEEP 96:KwzeKc4motiR9r3TkD3wPxFkKpBxzkVd9Qrd5dcXIs+yOgSKRzkkgKs1kmg40kBi:YFXzdcXIs+yO9KRIkA1kml0kBGMXfs
- TLSH T1A5E1F211703B17C13ABD6A8A9594B4AB56C1B0633428B47B7BF810AE0B66F14DCFE5CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
- Size 83KB
- SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
- MD5 956f610121cd5827fd5549097b79cd9f
- SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
- SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
- SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
- TLSH T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\93656477-109c-46ff-bac1-d3fcb489d927.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
- Size 3KB
- SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
- MD5 94406cdd51b55c0f006cfea05745effb
- SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
- SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
- TLSH T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 c1f560a6ab3667158180ed8754a55e1da6c272d5e4507dd537971ba21ea7a1ff
- MD5 63f3ac41b2a804d4bd09924618609547
- SHA1 529e2dc0b690d8b03dc003360a1b6608fda90d4c
- SHA512 05e2dd0119f1626ff6b4e4021775d85dfc9de8af5e85431d38be07264562bc7370c86efa5f03601edd5b8e421fc935cc9a1a84cdfa7eef5bc6304be3b37d00f0
- SSDEEP 384:nDcXqnW8NmZ8sgltaRLkc/Tw+CqUoqFvvO:7WlgXGwc/ckUoqVO
- TLSH T165827D71A8386C7A4EA79F45F10B76235FA460B79AD51E94CAD85B1C0ACBADC1303C37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 23KB
- SHA256 5d2ae8a791a1f10d31e25083b8d7ea8f167db2cc37f42f171558891e26a06ebc
- MD5 cad1fbe904647c72285e91be61a93bd1
- SHA1 2b7f822fe1e3ca070939aa520533f4479193ad16
- SHA512 2f86207464f1106d71c694f5d6f508bd99c9a7d1a7d503c3b254b5e018c125d860389d4582c6bacad3c0bbc63e4527a157ce01addab4966a1870f6f242887d86
- SSDEEP 384:nXiF1cXqnj8Nm8TUNTUlIl88sgltaRLjDfYac/Tw+C7UoqFvvO:SFJjjwgcgXGsac/chUoqVO
- TLSH T19BB22772D8A4DD7BADE78BC1B60BB6539FE011A38A991DD4CAC81E4C05C76ED0307C26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 a43186f0f0e260725a79da746586bd3475d4111f5260e009f553ce8004cdf346
- MD5 882918a6654b3020d745d10624829315
- SHA1 cae74a6e06f86eaaa8df9b7870960855fd5a2271
- SHA512 69e81900b1da7ed09a909232bd4fdf795a4c4c4974982ba2e58d6ed5394b3cbcb07b8635796dc1908b1219d1ad86e1ac25d9dcba53297052af4a3f49a07e18c3
- SSDEEP 384:ntcXqnW8Nm98sgltaRLkc/Tw+CqUoqFvvO:RWlgXGwc/ckUoqVO
- TLSH T1F9827D71A8386C7A4EA79E45F10B76235FA460B79AD51E94CAD85B1C0ACBADC1303C37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 8222a34f6326963143599b284159cc5a2b1577025ec9954f112eee3d0e14175a
- MD5 5692b025d1fd802b4d95b45546a87922
- SHA1 59b15136f099107ea61e87ca5c64971fabdd8db9
- SHA512 1dd2ad9adb2dafb4b37af80c78b4e3d8230dd8d7a15a56bc16f743c4234a01874dfbed77553eb401c8b5e08bfc9497c49f4e114af8b413f21cdf1771b2500e91
- SSDEEP 384:nNcXqnW8Nm88sgltaRLkc/Tw+CqUoqFvvO:xWwgXGwc/ckUoqVO
- TLSH T1D0827D71A8386C764EA79F45F10B76235FA460B79AD51EA4CAD85B1C0ACBADC1303C37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 940930d189be2495a1d424254b585f7af5f064d495fc2bb5f508d7cf80603f30
- MD5 9bcbf3cb682904d0dcb67e1eb1bef239
- SHA1 f94798a6e1a62e15c36111fcde974746a84812b2
- SHA512 a772674a1ce1a333e45a34ffd3b5f878d078eaacbd51b4b1561c1a10d6846d4a7b2a68c7dd5f1a58790bd0de0558f1f562eb1bc83f89dcde47b37d9ec7f92a20
- SSDEEP 192:lGNbF6IMGEQmiUyKT96xc/Tw+uSepUBmxPU6:lGNbF6GUBh6xc/Tw+eU49U6
- TLSH T1D302F83178787CBB9EE36E55B14737339F94206BEA951F98CAE81B1D05DB69C1303822
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 1aeecf7238a6272671795f051c4758ee9bb710a73ba103e1cb20a81ebd34d0fc
- MD5 a8efbdfc0d97d04cb59719cc45525546
- SHA1 67e1719cea46e8c8f01506f61ab37f779bc8a3b8
- SHA512 68994b253a60e6861964715c8419271124fb8187bba30ca8e767fe39a26bb0623f9ced695310964aedc8858e34ba78c67b19f03e1070a0f2ac629cad4b3f1680
- SSDEEP 384:nXiFfcXqn18NS8TUNTUlIR8zsgl5vLjFfC3ac/Tw+CjUoqFvvO:SFn1bwgLgLgac/cNUoqVO
- TLSH T15BB22832E868DD7BADE74FC5B20BB6539EE011A38A985DD4CAC85E4C05C76DD1307C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 9896bd8f014bf4678c56758ff812e0731642a619dfa338bfa1532c6d58bb44af
- MD5 71fa0d3dfb156c6fc8fe802f8b2bbeec
- SHA1 f6321f693d0ad354b8336b223125f0f71361a1b0
- SHA512 06089d03b96e017e66b6334010f9edf110400631569b7db5ea4eca939af6e1a5dbf3f2bec79e19bdf9b4f2b09d89ba74ee7d125da78705b444de5c480b08cca7
- SSDEEP 192:KGN/6IMGrQmiUy29Jxc/Tw+CtkS66UirqlyU6:KGN/6Gd7Jxc/Tw+CRUoU6
- TLSH T15912F83078787CB75EF3AE56F14776239F94216BAA951F98C9D41B2C05CBAAC1307832
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
- Size 163KB
- SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
- MD5 bd6846ffa7f4cf897b5323e4a5dcd551
- SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
- SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
- SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
- TLSH T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
- Size 3KB
- SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
- MD5 17c10dbe88d84b9309e6d151923ce116
- SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
- SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
- TLSH T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
- Size 8KB
- SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
- MD5 d3ebc1cb4b692c6e2d29a4625420fe73
- SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
- SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
- SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
- TLSH T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
- Size 2KB
- SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
- MD5 499d9e568b96e759959dc69635470211
- SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
- SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
- TLSH T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 612B
- SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
- MD5 a15cd0a1e68c6b9c3945d3192091dc4a
- SHA1 5162188f19a245162594501e5febb31a7626aeb4
- SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
- TLSH T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 732B
- SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
- MD5 0ad641099b286eebf58a290b5bde86c0
- SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
- SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
- TLSH T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 372B
- SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
- MD5 2a1939fc3b2926cf2b82fae71c5f6bee
- SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
- SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
- TLSH T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
- MD5 551baa462724351873ccd655a8b64ea3
- SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
- SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
- TLSH T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
- MD5 91c80c5508982eaf5438e9211fb2a52a
- SHA1 78c965a36a9f74d71dd94601ae92afdbc93f5f95
- SHA512 7bc90c935ea510bef580cd0117ca240de86a2985549ab9e15e6f5b819635d81825fd42e6e9a251214ac4b6e9ec2411d9c4cdedde28bc5552970d614f0053e74f
- TLSH T1251112D25D6D2AC2D1BE0F6FD08779FD40D8C216F2A8707A1854ED54423890E144187F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 852B
- SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
- MD5 96814d4ed361ec8de1547566e582b0de
- SHA1 f9588e0a74d9790991b254bfb0650af55810f778
- SHA512 bebc0e98c4485bde4609e0a92f0a27ac1e621a63e154f220c2b8c3b11bfb2d4cc2443d6274f6046d42e28b28478f719f28917112090b3cb14fb6adab24770b93
- TLSH T12401C2D25D7D36C2D57E0FAED04B75EC54C4C11AF29C71BA0C58E994523890E244283F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 492B
- SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
- MD5 bf165c172af1f75083dd4c7e8915ad0e
- SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
- SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
- TLSH T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 33b54581b3cd7004077c0a607bf56966799274b2c161a1665f98c099812af2dd
- MD5 453d2d54f662fe69369f3218b6a4bbd4
- SHA1 84cf6c3186ea8a253c25645b37c95e691fe92785
- SHA512 792dad3f1799878688bff182f210f8e65747d611194a3920ff17d26eabe099c6e2155774fd8371a476ba05c5c04b33d13deacc32ef05e1a70812e03e6f03706f
- TLSH T1442111E26D6E2AC2D0BE0EAFE08739ED50D8C21AF1E8707A1858FD94523D51E154187F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 972B
- SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
- MD5 2a769156fb0cdd33783892c7340dd22e
- SHA1 4b7d27850b335fc293c0ac5f52ed9cf1604cb52f
- SHA512 3bb6cd746bada6a1370fd3186f3c8ded4319de162f80beb35ac87e73d46ede19407f4cb1d05ec658f6072f3e42a5681f64d8b69a136afadbc7534d3074670bac
- TLSH T1801114D25C6E26C2D57E0F6F904B75ED54C8C216F258707A0C58ED94413840E144287F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 45a6b06e48cb3eedac93a0d53aa71f535bd43cbf956b7e1b9214bb14d119b498
- MD5 56cf56e9cc67243d663cfd4ecf04540b
- SHA1 935011aae5347baf139e54939b63eb6948fbff75
- SHA512 235e014ae905502afabb9947e1acdccf7d3b547474339930e156b494a4c3adb07cc0f2aa1f66d3a6fc8ba08f59ed38d32f4bc4183a723f8f01ae1f1fddac0617
- TLSH T11B3122E2596D2AC1D07E0DEFA48B39EC90E8C215F59870392858FD94563D51D258087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 5c220d43256d7b7c14b900fd4eebfd1eca6e209cfec86546e89032558d063e17
- MD5 135e5db547c660f2f19466f8970ec0cc
- SHA1 1de05a1783641320480abf7c4adf2270ec65353e
- SHA512 3b630c74722d06764d15ffb884ed6144aa997a650c9d0fd76b12da2b3a1c24aae619e27fb79efe4f7ae547181b4b870258c3695224611790c9d20c066e7ad77c
- TLSH T1203120E1597D2AC1D07E0DAFA04B39FC84E8C216F5A8703A2858ED98563951E254087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 9067b28ebe20c02c9953fff5b0594ef49080bdf69debedc37cf9eb19498d7c06
- MD5 cf0a01f870cbb9aac9d73b85b1857124
- SHA1 d77260d2898bad8d24895644cc9efee0a6ff8d6f
- SHA512 92b9a08b2d05ada857c63e5430a884cf64273a4ebd9ec22a18c088810d22f01eb33c5b8c961a636133117b4b7c6779f5d96e8f65288a6da6f6140efedeca66a0
- TLSH T1932112E1697D2AC1D07E0EAFE08B39EC50D8C216F598747A2C58FD94923D51E154187F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7f6a5462-4439-4d32-825c-8b374c4f02ba.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7587c76d-6df6-40a4-8b6f-b4e18bef5880.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\a34f94b3-cd4e-416a-bf1d-6f8855831753.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ef01457e-4aab-4a70-b2d5-cfc87b08191d.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3412_2091222945\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_105003256\manifest.json
- Size 160B
- SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
- MD5 c3911ceb35539db42e5654bdd60ac956
- SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
- SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
- TLSH T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1165832820\manifest.json
- Size 72B
- SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
- MD5 a30b19bb414d78fff00fc7855d6ed5fd
- SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
- SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
- TLSH T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1299652848\manifest.json
- Size 165B
- SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
- MD5 8ff4c35081337b1ba6731cc36163c2a8
- SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
- SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
- TLSH T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1419492520\manifest.json
- Size 119B
- SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
- MD5 7382260298fc06c135b7c7399e9acff9
- SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
- SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
- TLSH T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1495983167\manifest.json
- Size 135B
- SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
- MD5 fbebd68ecaa98928909421f66909c054
- SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
- SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
- TLSH T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1604720841\manifest.json
- Size 177B
- SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
- MD5 2714a51ed8c2a891ad73b7488ab655b9
- SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
- SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
- TLSH T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_1848835270\manifest.json
- Size 85B
- SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
- MD5 8ce95626b39ebc2401eee0b34c24fc7c
- SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
- SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
- TLSH T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\LICENSE
- Size 1KB
- SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- MD5 ee002cb9e51bb8dfa89640a406a1090a
- SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
- TLSH T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_2111155383\manifest.json
- Size 79B
- SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
- MD5 817fea104100763cd1bf4f15a51bfe94
- SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
- SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
- TLSH T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_36262756\manifest.json
- Size 135B
- SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
- MD5 4055ba4ebd5546fb6306d6a3151a236a
- SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
- SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
- TLSH T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_632546941\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_702130595\manifest.json
- Size 238B
- SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
- MD5 15b69964f6f79654cbf54953aad0513f
- SHA1 013fb9737790b034195cdeddaa620049484c53a7
- SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
- TLSH T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_718407177\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3412_766795742\manifest.json
- Size 160B
- SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
- MD5 a24a1941bbb8d90784f5ef76712002f5
- SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
- SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
- TLSH T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
- MD5 SHA1 SHA512 TLSH