873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260511-1d2f2sew3j
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
301	4880	msedge.exe
239	6112	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.7-win-x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.7-win-x86.exe

Executes dropped EXE 7 IoCs

pid	Process
2356	windowsdesktop-runtime-10.0.7-win-x86.exe
2528	wixstdba.exe
2696	windowsdesktop-runtime-10.0.7-win-x86.exe
116	windowsdesktop-runtime-10.0.7-win-x86.exe
2836	windowsdesktop-runtime-10.0.7-win-x86.exe
4196	wixstdba.exe
4840	windowsdesktop-runtime-10.0.7-win-x86.exe

Loads dropped DLL 5 IoCs

pid	Process
1888	MsiExec.exe
2608	MsiExec.exe
5492	MsiExec.exe
2556	MsiExec.exe
2444	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\et\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\th\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\clretwrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationUI.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1727971660\_locales\da\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Numerics.Vectors.dll	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59942c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9775.tmp	msiexec.exe
File created	C:\Windows\Installer\e599431.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A55.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59942d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0CE.tmp	msiexec.exe
File created	C:\Windows\Installer\e599436.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBCD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e59943b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI995A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File opened for modification	C:\Windows\Installer\e599437.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4C7.tmp	msiexec.exe
File created	C:\Windows\Installer\e599428.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI962B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\e599432.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599428.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA803.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABFC.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59942d.msi	msiexec.exe
File created	C:\Windows\Installer\e599432.msi	msiexec.exe
File created	C:\Windows\Installer\e599437.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 8 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe
4684	msedge.exe
4684	msedge.exe
1136	msedge.exe
892	msedge.exe
6112	msedge.exe
3952	chrome.exe
2292	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230088174648371"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\ProductName = "Microsoft Windows Desktop Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\PackageName = "dotnet-runtime-10.0.7-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{66D58D20-49E5-4583-9C9E-1BA73BD52921}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Version = "1344064284"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\ProductName = "Microsoft .NET Host FX Resolver - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\PackageCode = "145EF10EFC3685A4188A83437E504485"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Version = "1344064284"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\PackageCode = "DBC5B90379055E24587405C416B60F2F"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\PackageName = "dotnet-hostfxr-10.0.7-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe
4988	chrome.exe
4988	chrome.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe
4596	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
5904	msedge.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
2724	taskmgr.exe
2724	taskmgr.exe
5904	msedge.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
5904	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe
2724	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1136	4932	Velocity.exe	90
PID 1136 wrote to memory of 1312	1136	msedge.exe	91
PID 1136 wrote to memory of 892	1136	msedge.exe	92
PID 1136 wrote to memory of 5772	1136	msedge.exe	95
PID 1136 wrote to memory of 5772	1136	msedge.exe	95
PID 1136 wrote to memory of 5216	1136	msedge.exe	93
PID 1136 wrote to memory of 5216	1136	msedge.exe	93
PID 1136 wrote to memory of 5216	1136	msedge.exe	93
PID 1136 wrote to memory of 1564	1136	msedge.exe	96
PID 1136 wrote to memory of 5748	1136	msedge.exe	97
PID 1136 wrote to memory of 1564	1136	msedge.exe	96
PID 1136 wrote to memory of 1564	1136	msedge.exe	96
PID 1136 wrote to memory of 5748	1136	msedge.exe	97
PID 1136 wrote to memory of 5748	1136	msedge.exe	97
PID 1136 wrote to memory of 3340	1136	msedge.exe	101
PID 1136 wrote to memory of 3340	1136	msedge.exe	101
PID 1136 wrote to memory of 3340	1136	msedge.exe	101
PID 1136 wrote to memory of 3960	1136	msedge.exe	104
PID 1136 wrote to memory of 3960	1136	msedge.exe	104
PID 1136 wrote to memory of 5904	1136	msedge.exe	106
PID 5904 wrote to memory of 4616	5904	msedge.exe	108
PID 5904 wrote to memory of 6112	5904	msedge.exe	111
PID 5904 wrote to memory of 3700	5904	msedge.exe	112
PID 5904 wrote to memory of 3700	5904	msedge.exe	112
PID 5904 wrote to memory of 3700	5904	msedge.exe	112
PID 5904 wrote to memory of 5896	5904	msedge.exe	113
PID 5904 wrote to memory of 5896	5904	msedge.exe	113
PID 5904 wrote to memory of 3472	5904	msedge.exe	115
PID 4988 wrote to memory of 5524	4988	chrome.exe	118
PID 4988 wrote to memory of 2964	4988	chrome.exe	119
PID 4988 wrote to memory of 2964	4988	chrome.exe	119
PID 4988 wrote to memory of 3952	4988	chrome.exe	120
PID 4988 wrote to memory of 1412	4988	chrome.exe	121
PID 4988 wrote to memory of 1412	4988	chrome.exe	121
PID 4988 wrote to memory of 700	4988	chrome.exe	123
PID 4988 wrote to memory of 700	4988	chrome.exe	123
PID 4988 wrote to memory of 5776	4988	chrome.exe	124
PID 4988 wrote to memory of 5776	4988	chrome.exe	124
PID 4988 wrote to memory of 1084	4988	chrome.exe	125
PID 4988 wrote to memory of 1084	4988	chrome.exe	125
PID 4988 wrote to memory of 4468	4988	chrome.exe	126
PID 4988 wrote to memory of 4468	4988	chrome.exe	126
PID 4988 wrote to memory of 6100	4988	chrome.exe	128
PID 4988 wrote to memory of 3848	4988	chrome.exe	130
PID 4988 wrote to memory of 3848	4988	chrome.exe	130
PID 4988 wrote to memory of 2052	4988	chrome.exe	131
PID 4988 wrote to memory of 2052	4988	chrome.exe	131
PID 4988 wrote to memory of 4784	4988	chrome.exe	132
PID 4988 wrote to memory of 4784	4988	chrome.exe	132
PID 5904 wrote to memory of 5964	5904	msedge.exe	133
PID 5904 wrote to memory of 3752	5904	msedge.exe	134
PID 5904 wrote to memory of 560	5904	msedge.exe	135
PID 5904 wrote to memory of 3796	5904	msedge.exe	136
PID 5904 wrote to memory of 3796	5904	msedge.exe	136
PID 5904 wrote to memory of 4360	5904	msedge.exe	137
PID 5904 wrote to memory of 4360	5904	msedge.exe	137
PID 4932 wrote to memory of 2292	4932	Velocity.exe	138
PID 5904 wrote to memory of 460	5904	msedge.exe	139
PID 5904 wrote to memory of 460	5904	msedge.exe	139
PID 5904 wrote to memory of 460	5904	msedge.exe	139
PID 5904 wrote to memory of 3564	5904	msedge.exe	140
PID 5904 wrote to memory of 3564	5904	msedge.exe	140
PID 5904 wrote to memory of 3564	5904	msedge.exe	140
PID 5904 wrote to memory of 2852	5904	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbd96fc188,0x7ffbd96fc194,0x7ffbd96fc1a0
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,71141048958584015,6677978374975911639,524288 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7595362027510801141,17558562916270302178,262144 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,2389682259577089932,18122988947958176770,524288 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,1672186298277584465,11439940468974840679,2097152 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,11808876972265835150,5954737289379376898,2097152 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,6218974838707536761,8993643848755743282,2097152 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,2686776012587344861,15117746467411194502,524288 --field-trial-handle=2272,i,4299337708568333653,9782921563267002930,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbd96fc188,0x7ffbd96fc194,0x7ffbd96fc1a0
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1213629025067031554,4991136001036113762,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,18126655894488594342,15630892299477311768,262144 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,10756238734803514970,11360885234116337,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,16700403099852673663,3030197611648096946,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,16700403099852673663,3030197611648096946,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,16835108845842285230,3333812643165255974,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,5639856646150494929,1415650666508365502,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,3791123207631234139,3607918972843219005,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,13663556433760068609,14311375108007822455,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,10154978677879197908,10760897895770777376,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4940,i,18114521418011620616,14799613439615117175,2097152 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4944,i,5157486179089717110,3996282448017975329,2097152 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17475539830569449504,8066018217647432366,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9892299357906766438,3821616794888539327,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5988,i,8062784150963652730,16013614081192981781,2097152 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,2390202780798015655,16172524604390366412,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5440,i,15663958896170419992,17943419747666060654,2097152 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,15285699510957544014,5527003349270379718,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,15285699510957544014,5527003349270379718,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,15461971280444821609,12195155759525864730,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
      4⤵
      PID:3752
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2356
    - - C:\Windows\TEMP\{169E9D03-436E-4F56-AF42-03F9BA3B4484}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{169E9D03-436E-4F56-AF42-03F9BA3B4484}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{AF7E0106-96A3-41C7-8F06-E94B69011F3F} {9B974B16-9017-4487-A2BA-2BAB0D5E4DB0}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2528
    - - C:\Windows\TEMP\{169E9D03-436E-4F56-AF42-03F9BA3B4484}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
        
        "C:\Windows\TEMP\{169E9D03-436E-4F56-AF42-03F9BA3B4484}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{9935A97A-FF19-444C-81DA-329071E74909} {1F27D862-43AB-48BC-BD6D-86D2A29EC1F8} 2356
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,16584925135778580216,17492365874982030374,524288 --field-trial-handle=2388,i,7030927878781773872,15324785236139441366,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbd96fc188,0x7ffbd96fc194,0x7ffbd96fc1a0
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1378662059229938756,16207802046177647704,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,14158500404793604992,5343125692870203512,262144 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,3749946316780639441,11275118049335252672,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13639597238167042397,3495769279998392912,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13639597238167042397,3495769279998392912,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,7668216870962555043,13915598643372967482,2097152 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
        5⤵
        
        PID:3060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4964,i,12037243013943468701,899807922309903266,2097152 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
        5⤵
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8241983215144474711,15737900231174514102,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        5⤵
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,16185047080580695133,14897701366553924861,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
        5⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,2868785378060062371,15702332133257181368,2097152 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
        5⤵
        
        PID:2556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6579519233040400022,15316344794862423578,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
        5⤵
        
        PID:5364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5404,i,9985249356214545890,5919534814361082361,2097152 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
        5⤵
        
        PID:540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,4039373241384706763,8915586689174401933,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
        5⤵
        
        PID:2524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10467520454408643776,9883979495485053973,524288 --field-trial-handle=2180,i,6182126837791556960,15748752968975274754,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:4256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbd96fc188,0x7ffbd96fc194,0x7ffbd96fc1a0
        6⤵
        
        PID:1200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,15834996185751006244,4764473609534222729,524288 --field-trial-handle=2328,i,1642406408133034959,6279265322211907233,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,14184640762343991788,1523169603603043419,262144 --field-trial-handle=2328,i,1642406408133034959,6279265322211907233,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
        6⤵
        
        PID:5184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,1160425899708599119,8033409494708524188,524288 --field-trial-handle=2328,i,1642406408133034959,6279265322211907233,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
        6⤵
        
        PID:5172
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,4671238549406874247,9070592706480325459,524288 --field-trial-handle=2328,i,1642406408133034959,6279265322211907233,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        6⤵
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,4671238549406874247,9070592706480325459,524288 --field-trial-handle=2328,i,1642406408133034959,6279265322211907233,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        6⤵
        
        PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbd774c728,0x7ffbd774c734,0x7ffbd774c740
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,5963822488460627154,896957006226647532,262144 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2711560449678128898,12472042575948891093,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,1910422922869320691,13053920248933815229,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,14621378007771656971,2032889803911074341,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,14161962527343874530,14611638275026077148,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,11069692673259749262,16279557548154749808,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,3033915329310808682,11051415898573311750,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,12279791070585577129,3896782767233113914,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5564,i,309777108376960839,619197092668832996,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3580,i,4217296360932989427,2483701788339669190,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5552,i,2035011010894106954,4019312326986712937,2097152 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,16298839989343611883,930996619447594254,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,1122243738115181919,12467766437682295567,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,13421933652165965121,16577814730851002692,524288 --field-trial-handle=1924,i,15374446038631383310,14918391457027804087,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2724

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:116
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260511223433.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2836
- - C:\Windows\TEMP\{41A718E0-62F3-4F88-91CF-E4638E8B37C6}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{41A718E0-62F3-4F88-91CF-E4638E8B37C6}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{600C53CD-B165-4E6E-A0C0-F5E37D889334} {BACC6839-13D2-4D6E-9987-80D2B9D78E8A}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{8B49C13B-B2B6-46F7-A368-39372A5901D2} {EE6B6922-4079-4DAD-A160-35036AB59957} 2836
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9D6693AB18A1864F4278CDEF9596601A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 54AEE1B7649F949832A7675DBDA4032C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E8B454A72F26F45A0A9818F27301A4C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CCB44B182D6B1D132928C152F7EE4E9E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4A06EB2D20D52DCB05FD581A049E6015
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59942b.rbs

Path C:\Config.Msi\e59942b.rbs
Size 10KB
SHA256 026c88277086d94836fab0148fa8b964d366e8db5eb829ac72000999915f7ac9
MD5 1c3ef8a044a64368d328862233d5b56d
SHA1 1d175ad0919bd914ab1dc29730edd678f53fe80e
SHA512 660ff56ad14aacbc9a1141e88cd9a1e9c0f5451da61b3e6cfb3540b11399e40483108afc707577777dcd7cf5317d1adab34fb36399ada00d7a52570a0a07f232
SSDEEP 96:+IvJMAQxubtD4tn81RceyTfq6EQUzeD2QPuCsThqJUzeD2QPuC6jlF3MeThqVH5U:+KUstU5xeyTCbv8NIb8N6GEc46kdpb
TLSH
T1FD223F01B640C2D3E89B0778EB131B153BBBC6EA571082DF05DD95B84F6A7885FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599430.rbs

Path C:\Config.Msi\e599430.rbs
Size 8KB
SHA256 2a961f099e2c5401b30f86a77994e251f929ee9dd7496921878c4a66f76418a5
MD5 e51dc955e77916730b79c81cf139bdac
SHA1 aff24a69f6f24abc78f8769b24d4470d4541f7a9
SHA512 2a90bcbfd21e806105e7ce6a3caad4f8209065576f37f7641c1ffab5ea93ac96207bbbbe3cc7922830efc9043e811a84295e840d415c153ab7176d3c2f46158a
SSDEEP 96:+FeI07BOC1rZkaeqKWQUA2eD26sPuCsThq9UA2eD26sPuC6jkzdYeThqRH1wUE5C:+F90QSXe4vtNIntN5AEKHV9dpH
TLSH
T141121081310186E2ED9B5B34C3872B24BFEBE3D79611125F25CD52605F8A7C93F642AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599435.rbs

Path C:\Config.Msi\e599435.rbs
Size 49KB
SHA256 55bec4b00f3f3ca3391f94a2bb2f500ead34f5fe611318329358d49cc515e622
MD5 cf69af5e3d92345d3c61a8e594d637a0
SHA1 11ca916441121e502742fd060c54380cc2abe6d4
SHA512 5542c4a9d16485764c90fa22a3a66cc5abbd5c0094da9db69931deab83d5f3ec5dbd667a224df39bca08192514dc2c70965a7212dc3aa689965c897985a463ac
SSDEEP 384:sV7rNK0DLsrmMwoXlhkOI5RBMgu8gKtaz0XHpZtcMq5UGRWBHNfrL/VZih/07f7/:spPilnAThu7hR0jAfxArH
TLSH
T107335320AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE8857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59943a.rbs

Path C:\Config.Msi\e59943a.rbs
Size 72KB
SHA256 d75085ff487567177abd90661f3ac9234f4731f6879c62f3c78f6997174776d6
MD5 13f2981e227aad5330126939acd8225a
SHA1 9644b4a6bbd5c80839a0b309ef21ca43c7dba2f2
SHA512 5593291ce5880ffd0573282f2550b5a10eec3048d10d499f1e3a6f493ba7e341ace9e643a25595eb6a7c11924f8ebf30d6061b4350d79bc52fccb0ed44a8bbee
SSDEEP 768:1ONOqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0Kwnah:UN3NCnoLZ+PTlUN7umeGKymciu0Kwi
TLSH
T1B7731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59943e.rbs

Path C:\Config.Msi\e59943e.rbs
Size 3KB
SHA256 47da1a7de2ef9bdcd24dc06345982c538c34cf4ddc724b59d18048f254aec3ef
MD5 ef56ac84d91afb13507a558344cf0738
SHA1 c1554b8066d37d0956df8651394d80f564eba1b2
SHA512 e8aa3cf0192702dc1166cfbb65f586da58eeec6d00a1afdf370921eb347b4627ef0178cae4df54d67e00c122de971ac42c353aa64b3f438dc122e3b7649eda86
TLSH
T13A81CE03EA40E682ECA32F30DD5717593777DAEA8352434B10CCD1754E4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d465da5da83be074cfcbed029814cacdfeed6d91227e8111e4c9273b762e880
MD5 a767d406f3f59990c30fed5703423ad7
SHA1 f0658212007c4886489e0865fabfb96e2ab5defb
SHA512 0924c4805c84269aa7ad6f803fd482db3b92341951474922f63809a492e83dc448f8b2ae0dd8e4301c38901b42f25e5685ddbaec55f8113b0ab0b0bbd13d97a5
TLSH
T150E0ABEACC20DC3708F80328114C8302D75513173B80984B363D810CCFB1636828693C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0f0f2ddc534cd325e8f1211720e4a4494446b7aec6a54166d3de2b6138339fc5
MD5 d4528a3238683289f0d8cfcec66609ae
SHA1 02f925ea0a7c80ca941ea2d9c4965feabe6c5521
SHA512 a0c0c2c8bf14af9b79da4d8ba8c5c40ad96972583d170318f9e6fa07b0fa3ec705198df4224c75f3bff3f955eab4f7be723d1b67430bc10375d754e168282146
TLSH
T16031A80AA4E3B99FDFD081B251850D5E24B9246631422F1F8D70E1ADE773EE342B3496
MD5 SHA1 SHA512 TLSH

Submit Download

81d7921b-a25e-4698-9864-30ff179adf83.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\81d7921b-a25e-4698-9864-30ff179adf83.tmp
Size 6KB
SHA256 f32f71bc71c0c85ea7c3e05dd8cce38f048587025c6254931a6587f0d046d7f0
MD5 4669e778f15b6aef53e9feed122a0417
SHA1 c83a8c5dcd690470191e7af400f2291e924f419e
SHA512 24ab6d7ce6cc735c163d6a8f5ea403b8a297f42ce8756b911a501cf438e85f7f7bb6799b75e2b2530f9689c9e2b7338c1f1e6ad26fab228139d492b86897d70b
SSDEEP 192:DVXnREvgaIa6VmO79xm1RyOPNeb5Po95oj:DVXnREvgaIa6VmO79xm1RyOPNeb5Po9a
TLSH
T17DD19CF7C3E4856DC90156F4A715AF1FCE2E0A25431C3D66C8D4EE1BA3E2872E10169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f283de3a8f8d9f7d949e7fa4240c6fd308b211c0883d82b27b1134d4ef34db3
MD5 4a99f8ce56c09d558d38ae9b2bcc01d8
SHA1 1fe84326b6d4e2885a1288f05505904ed0c0a794
SHA512 faecbab6b77a511de0bf6fef9634005b80e88b603cba8c87436041b60fcb2d2b6faa37142c5854ac694c7135c03df443a833ee03a00f97c8e26665a20fd1a99f
SSDEEP 192:uRQQhaf5oUQv73pAPRp20z9YHsb+WNnnVUPV2TknL7askmVyIsnAUgtaJ:uRQQWMTUXdCwVO2Qn/ao8
TLSH
T1BB42E72EB918753B5CCBD329FD62771BD7F6102165942E84EAFC8A2C19D75CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5912a8865f2e268b379c844dea75a5d8b7c89d93acd4bff7a65d34ce35e57cff
MD5 36b34eae79ae934092f08397e2573566
SHA1 f325c4e99162dee485ab0621994029dce363a674
SHA512 3ec150494c6dc4c9cdb7317629d417f4579119d1a093e69054eb97695f7dba3d6f4c5e86c65e4d4face836cb062863952730b1a891d8bfe58d048d5e1feea01d
SSDEEP 192:uR4cBzQhaf5oUQv73pAPRp2Wiyi9YHsb+WNmzWnVUPV+1j2RknL7askmVyIsnAU/:uR4mzQWMTUX8CwvOA2Gn/ao8
TLSH
T1A252F72AB924697B5CD7C329F961771FD3F6202265D42E84EAFC8A2C18D76CC7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 846a49ff0a99ff29f969cc4d4a32a877675fa7ebdaef71455aee410eb8389c5c
MD5 d8e9e6cfd6d4a3898ac6021926a0dc85
SHA1 d00c48461c234ce67a52e2465026fc6090b01eae
SHA512 a272d3a3a6cdcf6980a4c19ff23029d61617a39fd4f11f9edf6c373c44238d8eafd024363defc4c28b7cc68eecd8e1363a096161bd3cc4d9c2acc31819750ca9
TLSH
T1AFB012508001A551C00302F4218204983514DF11C705270253F0E9B5983B59040242D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590517.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590517.TMP
Size 96B
SHA256 b14eaf58b568ccc1d4c91ca26ed58cb6ed5f8cd7726d48fca2d2f5d231e60012
MD5 005869998a64b656358a83dc94371162
SHA1 8348649d0dbe9085757b32a768a596cbc40219e5
SHA512 9f28ceeeafc59912a04457b7fdca20dbb0703a8f34b172c23ce7c7b6a8189b3e305ff9bacc33cb3376819cfe13fa05cdbb8fa74b8de2457f89210d98baec5cf1
TLSH
T16EB00295C1026223C84207F43DA5A5E87274EF69CB97522692F12E67DC26B604527560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 84930f82621599a8aba75f68a4d0f39fd45414e4e5706ff00aa9ec3eae25cdba
MD5 7c40756ee9e981b10b184ac70959755e
SHA1 30a5300f3d8d9bbae1056ea607328bbd62f59a3b
SHA512 49d1c4a265addbec63977230405ffef838394b97fafa1cfbb9e4e8ad71b6c7e34aca997fa8fd299d06857eec8b0724666dd992ddb681785e651bbfdd41f133c4
TLSH
T188A0023532D87C92CD1557F3159181543294785412168303A6E101489ED25A09581540
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 24f0712e7e5ef34eb81b97194b3323b556bd3eb06519a6da564dacd99bdd4fbe
MD5 410b562806136c5602842daa39eeb3c8
SHA1 8bdce41f3ce0bb0c77daf04c1b3b129a556883eb
SHA512 0ce06f790288308f00b23516efb15497e7474f331e17208de8e2c00af87578be152d20110ccedb5e0a836e91d07536498aa04deab9d5b239392c0ce2117927f8
SSDEEP 3072:/ckNWWWbCGr3o3ssveOsjYiVNmhfS3Qw/xLANk0mUW5GmRntSFCjEENz:UFWXbssWOsPKh6rOk0HOGm/SFyEEB
TLSH
T1E91412240B1A1F5F92FE469E280ABA4DCC229709B30BF4DC3578C7482AD63C91755EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 78cc0030b2ad2591b6e9ba593050a7d9abbff71b3ef2c2bf312126e2cc50b174
MD5 7e5c31d2c8e7577f505b85ab20221757
SHA1 b86dd0d74437447e124bfbdc7f4995ae2304100d
SHA512 e8471781c7c3eb1344d1a6183a21159837efa1d33e9cb946bf9a302e06a776b529b6fd21f3e816b93eb81a0b2cef2b83655ee2fc17968ddd3450116f07b0b0b3
SSDEEP 3072:4ckNWWWbCGr3o3ssveOsjYiVNmhfS3Qw/xLANk0mUW5GmRntSFCjEENz:TFWXbssWOsPKh6rOk0HOGm/SFyEEB
TLSH
T1761412240B1A1F5F92FE469E284ABB4DCD229709B30BF4DC3568C7482AD63C91755EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 267eb983d64e40dc3d540efdc096401476491f9a6e9dcab24c8ee50cdd24dba0
MD5 375056d0511027921c4feea7103b1b0b
SHA1 fc07fb0cbc21dda3d405501305e43b205f9838c2
SHA512 6bc9d5f06ba5b3c89e76c8bc8356d73a1a6ce36ba59842bc5f9030dc474c57c1a1a76a9f22be9af7661c10d55e8ba3287cbb136eac4f294c06f0ab141b5a73b5
SSDEEP 1536:5B6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:a3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1649312B94E1A46F7957D468176AE7809CE12230D709FA9CC316CA39C21D81C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 3a560b80b99374bd1d63214c9ad189614cc9ecc5ef5226afa12f03ad9d872b96
MD5 a0ede632ff3e4cdb65ffe26d98d35188
SHA1 13035bd8a607a20fac194aec31b74a565366f079
SHA512 24f8d3904a8ce59ea442920a42e734dc7c26e86f993e5cfa2605623c97e7b11149d23f5d15ec40102e8d674ef7043d6db575782fac88c25dd92641b8cd7a11d4
SSDEEP 3072:oqNWWWbCGr3o3ssveOsjYiVNmhfS3Qw/xLANk0mUW5GmRntSFCjEENz:wWXbssWOsPKh6rOk0HOGm/SFyEEB
TLSH
T1BB1412341B1A5F5B91BE465E244ABB48CD32970BF30AF8DC3568CB442AD53C82B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c137758d9903ad6bc7c8a5bccd25bb6797d355e5b41ac929ef84a9714a1d185
MD5 6f5c876a60400cbef69fd7ee8d0eb035
SHA1 9fec753fd293afdb788548e9129090d9612a60c5
SHA512 00eb862c97e5ee2f83bdd597335e7221b95cdac6e3616f225534c2c7333822709e6fb2adf7da127f91c3e3f0531372c388e4b16a005ceaed9aa350c500d37e21
TLSH
T1FBD0237437E6B417C1190071481167597A1FC5913CD7D726F02515BC9CA90DC7BD05C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 26e61bf04c79cce8e1693957afe6705ccb0b5f295eb816b008ac89380634fe41
MD5 ee1e3b94c7894f6170159ecf1d6c58fa
SHA1 9e2199c60a11be5c73c95b5cea7a60c61b8e9e2c
SHA512 fb3628b5b6a5c2e5866be9cff80c7747e59afb62940ccd466cd4a9956c94cb584e82a8426210f63542f4a65ee8f3036782fd6c0d2185ef218969ff88a839ef90
TLSH
T179D0A7733B45700AD71D51715523C759261B805028878715F218859C98F80DD67D15C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bde6cca9d1684f6fd6ab568719848cfd40753a708934151702085363cb2a4458
MD5 5cbd0bbaa34557d186cdf5520381c8c3
SHA1 aa86192b4cb23b4af03eabe6225d508d46a27117
SHA512 c3dd3462b496c718d67b2450b16cce48a6d192c555222355673ff1b2ab9bc130d726b272c137df0405975e7d1c9688af0da401316cc23731ab1913178bfb6690
TLSH
T113D0A7723B45700AD71D51715153C749261B805124878715F218859CA8F80ED67D15C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60b833ae2d7d671566bea7030b5cef9a10b21255ea83f702f53adc0cf5b9b5dd
MD5 0abd9367e409b42ee5db5493ade5bdc9
SHA1 bf15b83d511f12667910b22e9de28de2b808c64e
SHA512 5d12047217b99c395df7da238eb4d982e07edce599e0fe6649ee86222786736e008ef9799d08727efa9b36e763a52f7df9d535218467cbe438b043e4b2db4020
TLSH
T13DE02BAAC8219C2B08F9071920524A46EB52136F5B51890F7B3DD1088FB46374566C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 96033d601d2d49162275f01ff31d899c0ca096dff36fa1feb273eb70c5d8f8c7
MD5 be08d5fc1e2778ed9f3affd272319a98
SHA1 c9cf2786f637cc0aead9efc188267a57a15e1940
SHA512 9a4d997d8eb3848fc3a4b3ee33fc34947d2f447bc83f6e4d7ebd2c68608d34dbae21145f0a545c8d9fa8a62f95fb9857d0d8c5e0b648902bc661b69765658d36
SSDEEP 384:w8BxQCxAl93aX/1dKyrWh8K7Qqf3OK6OzTDhJcbQ2yPBLr:w8BxQCxAn3K1BJKUqfOKhzTDhJc8JLr
TLSH
T132132C7E326C4C86D2C2253D2D6B9B756F74FB25D0C0562733B230658BE9B42388E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4690a05c21918a7cae232cfcbe2f47a4b8eae8131ed83617028ef43ba2ed4a36
MD5 388f76f60bfbdf185d763e6bd05f129d
SHA1 8a493a2084e24f642748c49d25ce62f505a8ac2e
SHA512 b03ac5c800733f7ddcb18f5b5db414cb46d6728be4e7fa5735eb808af3da8e80826e165347f296fd6d967da577298f42da4609fbb3f96284e7848db6a6b9a228
SSDEEP 1536:krak94I/38oOfpqNBDG49RCUx9jnHKsC+1mg/gVfWObxwleIHu:8msNsgWDWObxs
TLSH
T1794470F74951A01BCFA802F5D2033A3DE57B411E6CD1E8E9E63C0C952865B32B6BDB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7c5dfccaf0ea473a3de246631a2099682b4d7f56f65b90852cf6b046b2062f38
MD5 fbd870f1dba3fdf67f9301c6304dc7e2
SHA1 d5c4003e35526d39ce0c07d9da000760c2ac6fe6
SHA512 8b37e921f8e25ca4f969c004d9e6e36b514c1ec08f4054788d3a3b7276e4a94f7dbf8beab859b1ac592a55bb00001ca182869ed602fe8f97f25acdb755f5fd6c
SSDEEP 3072:Kb5mjmiHAUGbEvl88FGwcGnHA+3xy2+uyrZ0Lfz:Q5SmWGbG884fGHA+302CZ07z
TLSH
T1E2257CEE9B342C87DD6B4D70B4E0EC22BCB412937619E1D34C18C990879A3C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 9d0a395b464cae8c6ea6456d08a7790682021d9f801088e4ceb891ee91e037fe
MD5 724507e37961d9c7c1f8a13a93b24a6e
SHA1 9cf9a2e3967b425aa1a22929f93becb267cce7bc
SHA512 b4f75bcbaeb4d50ceb9b477c88011daf6f27c4f372673dc14c242aecc7d2c39ec4ef72b4042f29ef57c34a163d9987863ff3c8a7ef28f890f902c960fd47a18d
SSDEEP 49152:UmCV2tLFREljQv2i7A+WB6JeZqC4rCuIifq:SVgmjQvdUDVW
TLSH
T159867DEEC6685C83CE678A30B4E0EC577C7412C3B555C1D3895CC59812AB7C1BBEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 85KB
SHA256 c07eb63db6dbc1d18a48f4cf704099bb9f47a6296632aeb553687832e90818de
MD5 f891068ffd8604365eeabc36268aea0e
SHA1 ad62291529f4b35a04ce5be9231f0afb3a21a648
SHA512 fd0a938c8bb49c93be40ae77eba431d3af8edfd6a3c5fab6c9091d97072ead968364f0e3f71c28934a8d6c4fcc1f51912b37b5a1ae8e4d149ee906bdd58445f1
SSDEEP 1536:R7H/s8c2Jb/Wz552TNToY4RtBKAFKo2J6+yD2ospV4zqv4pvgKtf:tHJh/I2TNUhtM2KN8+yD2oFqaYKtf
TLSH
T12B831257D5C08CA0239266F885A339FFB00934471D3F5619AB64EAA7B3605EFC73602B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 34f9a5f932eae0b5360f2c734c356979becff35219979ba774f69f439b11d43e
MD5 36b2a3445ff2b448bf18d8103746a1c1
SHA1 8c8c5777e8283f367592886f83ca88a39a105875
SHA512 7026f2a4144ea132853ad0c49283d7855c928ada4ac35648d7958ff7c5b6b8465a926c0bb13fe4c2ba563bda324eba3da482a099e173829b73510a87a7205a48
TLSH
T15C71E886809984A9EBE453B15BD2D0B5373673584E0F0E1536F2307FA996B118E1FF0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4196a7d6ee1c3d26df7242dad341003b406a91cc00e2e8b1c36de39d46aaecaf
MD5 bed66a21a54b67156ccc87c09149cb7f
SHA1 5c0f8134e6a637a32c7951294d2db58d08e4fa43
SHA512 1b081a462e7890066c6e665f4408743440b106fdc0c47e815a27f697110c270efb44fe901594edc7967a48c230183b30688af86bae5a1466543159ef31d8d686
TLSH
T104614E558166806DEBE043B15BD6E0B6363AB3690E4F0E2936F2317FA9567128D4FF0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d28b6dc1cf4130bee4006a22ecaa7ab8f84cae9324bcac6c50fc05ae45e4e9ad
MD5 11d819f7fc5d25ac8c214258dd2b80c2
SHA1 383ace48f6ff2f304ece2ec3541cf79a164670b2
SHA512 b66ce12457afe5be670e47ad58c2446f5d993b619ba23fe3e549d3c414034e10504e9ab8d5823822e8dbbb31d049e172f895e8075e3be1d59362da31fd2b1a19
TLSH
T143711A5680998469EBE453F15BD2D0B13A3973580D0F2E1936F231BFA9567158D4FF0C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 398d15c537b3f082c124282bdd18f9cc5b2a6e4fc56310db2dd07370b9c0e138
MD5 f4e72eff509f7782686d0d5675062d3b
SHA1 82505240321b878486f9cee769d42b11945450d9
SHA512 f8334b8342fe94935d6106510da6869904d89b6d41874e05ba89d0ab182173b7074db1c82975539059ba98b9c4b2df90fd5867409cf6f63638885839a94cd525
TLSH
T140E0D89455C6C26D95913EDBC2B46F1CC1C43843E695BE032715C8C07703441F2895EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 fb405adfb223eb7ae5e2c8340463b471c5b658aef8839af8621adf233f9b3f64
MD5 7500f6a1d207b175cb071310f9aa4fa1
SHA1 fe19cafe716cf63737f79434b57a21aca31468f8
SHA512 68d940413f3167b4b7b953c7a7f185d6594e7984fd0b46c60fb6bd3c619012de7326419027cd97a18aeb9779a342569f7d47ae5554ba827dfed52b42f7d26517
TLSH
T11FE0D80445CCC369A095A9EB83B95F08C7D43806F2A43D411B49DC887301542738D1D9
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1cb6ef1a0b6b11bfa80eb502ea581aaf2a2e4defa5e90564c8b255975f96e3cf
MD5 8769507a05007903440042bbf480c665
SHA1 a331f90b2f1810c06e6597aa70e045ff3ee51a38
SHA512 6a4545d19e5624eecbe5b7a34a95741a12ac6d0ee3607896483e1e4b0a76d20a083744f77209ef030b66f9903571cfbaf0d7bc55a900fb76a3fb5504a2359414
SSDEEP 96:tIOzqFgI4zqFFIgTav+e7IU+bGz83uy3+u4tgp4DLjGQLBze9z3L04zqFIOzqCIR:n7f+G83uy3Ct7XBBKsH7DXspU3iZ
TLSH
T10C14235F5F342312CD7C51766AFB44A39D6DF03B8B53A6C96CA11460CEE3642A02C4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 051d4f154a4e4209466e60316286977398dbea7883d5fd3315b6af3c4eec0503
MD5 c1b274350fc72c881f7c0740d44fff55
SHA1 dbf814a6881c2432b37b590d311ea676421861dc
SHA512 4dbcac6ec279b3288167a4e2f314c0010872c563009436c418c13d6c93f4daedb989e53d8f92d9c9c9a5cc346f5251a6e15dc0780b269b78a06d44cbf974031a
TLSH
T178E0D8A095CDC66D998825CFC36A7B0CD7E03C16E6A86E012B08EC80B141614E28A1D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 cf92174dba76a241d55b7711ef8e2dbc3123766a22546aefb7162c18619c21ba
MD5 eabe0972ca75fca31ca50916d6c03581
SHA1 4b0fc62ca900e48ee41e476257c82336945b9cef
SHA512 c4fea3b31545fe79e0415405dd76ff51d45b90a7f01aa8890190a8baaaf1cea4b2574b92ea6feb733876eacd4fd0e379f6c3c699bcf6266f70707011276a3ed7
SSDEEP 48:T2SLopFMatSaw/auUOt8BMokwcqQL9iPAwH:iSeMatUaAKKBqAIPAA
TLSH
T159921F4D1F306222D0E05B7AEDD185672E7C201DC3772A99AE0460F2CD925ABF5061AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd8d473ecc45f24b00ea641c65f343b7c5e805c5d5a0c41f7c162d54f84b54df
MD5 35143beda2886387d079569e50e746e7
SHA1 2d4d5b0ff194a758e37488b04bd535948495bac3
SHA512 8949d801f6198a73114650fac9e3eeac9dbb0d27c808c4348cf9d8decf15ec30e500e7c99d8e6d96023352af6f80475dc2b260a4492ac6ba3277761b73234800
TLSH
T11A319DF743B0956E9B1196F0EA18AF2FCF6D0111435C7CA985E4AE27D3F3461E006A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 df243acb857968663aa30eeff801b32538a811d72f4a998ee51a8be48ba5659f
MD5 0b1cc99ee82d8b76aa15f5cc4f907093
SHA1 9fcfd17e2f25d4b7905801d5698ce1edc2b7f9fd
SHA512 ceedba0737983b02ec93d5919a3a6a110387f137ca1bca40b2dc7d1113ac01f8ed01ba843b8dc1fd4f3b7ed1a7c48df4325bea5c23e80fe22277a75fb26d3e2e
TLSH
T10B51DEF783B4856E8A1195F0AA18AF2FCF6D0511435C7C6A89E4EE27D3E3471E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b7c439c39dc655ef949a5ae98b99d7cb658733276256efdb2cb3c5ea587918fa
MD5 57f0394adba55016db3d6383757bb49b
SHA1 b8e93b5ca43fc368a72eb4caf84072f41abbe660
SHA512 d7381a78d1615ab6f0655a295069072a4f1034e9cb37f4204aacae0c77f635040d4c3565c340d6a8726fe11b16b9a498ab2761995840de87898cc79d63d16515
TLSH
T1D851CCF783B4856E8A1195F0AA18AF2FCF6D0611435C7C6A89E4EE27D3E3461E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9806de6ccc14a8f992713d7fd1f92f9f2fddb02ceb84d5cd4424eb77f77b330a
MD5 2a864962051c1b62190aea8f38b54af2
SHA1 27e9b41217708d78282c63da850696ded5e0bdd7
SHA512 7352caa723a89cec3410b4b297911f567a4c79e285d29df4072defd41ba2df4e657d83106f52ab2c13bcccedb346535e8f071eca756b87208d01ebc44d9476a3
TLSH
T10051DEF783B4856E8A1195F0AA18AF2FCF6D0511435C7C6A89E4EE27D3E3471E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 a2b3e6a849f12f68cd87401e635d601aace113d28a70687b6f0df102620ae011
MD5 9894b6f9a09b015663facddd558e6a0c
SHA1 67cbccba198a945c915d518ad964fa62d39d5d42
SHA512 1cac7b636136a0fd122c1030eb92b87a92765b80bcea5add27b5c87e4818410af64e499b01e416d9c2af2fb63b453e44031914b4882d7d5d459b1db208b0cda0
SSDEEP 96:eIEumQv8m1ccnvSnlDutmfEnFB/APFd4g:eIEumQv8m1ccnvS+YZ
TLSH
T10BF2CEFA07276106D98444B0E4009F8FAF16404B47B6F6EC76D447E3F3A25E2B5BA786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 aef0640d4b81e16e73621c6784d290edffb15a5beea946a16a3408b4f2b0d104
MD5 a567b1a3f81b49b2867dbbcfecf6eb91
SHA1 8a027bd64a777c3a266319d3b4786a0d17f8c810
SHA512 734c5b2bfc66c3a209f391f8f10f68ae5fc9f5890c36d4c4e4d2b3f170e2f2f5722a1219e3a0a927ff5d0a89c0a7fc1a189fc67619ff44bbfbd14dc5c77cf6a2
TLSH
T132112F5385BFB56A1238096F4D48BC267D76F5711A9364F4DE6E467CB0808F31705056
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 3eae8b16756bbf40ed93d39b6f476256255e2a1127b480c221f68a0375a1d4dd
MD5 72c2a84d8da4b3f8a80bf8b931591052
SHA1 d35b69dd39ed6e04e6f011b2e1b53fa177495410
SHA512 80f230d842e420fe950a9ea6c932fcca13fe36561e63b942dcfce4f1b201f740ba2f235ece446448c386766306ee653a18c114cc505d646a70f9b5f34d1c2497
TLSH
T1B2F02B62817FE4675174053FCD5478496E75F631455264B8DA6B873CA0814E30602025
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 1b17fbf947d5f1c83a8c7eb162ae8cf8159da4ac04bf79796722d26db566c737
MD5 f4315a755f865674fc97066182383a76
SHA1 904247f92b19d5873cc9801cdf3ab6b29aa072fb
SHA512 17ff6eec375726226d532724c61e9eee51fee26041f723614601e921a0e4dc0338818fb7794994c22648b4a818875b8dc2fed480ae0f37f6768345921e84fbb5
TLSH
T1C911486382BEF41B517909AF4D487D1AAA76F531056265F8DAAB873CB1815F30711016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 78104f75fba2339113ec4e89eb136f18e3e4186a619cf35080397b500a4af0fb
MD5 2eeb325287423457d3a3194132b8b7be
SHA1 41914c583b72af0ddcbe5275b8f10e1b221c55e4
SHA512 127d9a32a33d2a6c2e749574672fec274b7812109281d89f74bb9483f72567aa8710f254132cc279ea5f5ec164fbccf757abd524c8171614e2648057c23a9ed9
SSDEEP 192:sxZHRTyMqZ/K1Ml8yje/fAsJTWpVFVpZZELgvNzodp6dHW6+WN8n31/Yun7NenIS:sxZHs3e/fAsxWvFr3hvGeHbc//N2SC
TLSH
T17872D8156938697BCCD6D219FA457F63D7F9152396904E44AAFCCA0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 85d33503019329a5a2093f70b7d4ccbf4b9c24e3c5bf9adc2cd72495e08e7f4c
MD5 15d4fe7d185ba0d48d7eab8248f2cc4d
SHA1 d08eae57342b326e6045e57e5ad5c8fce0030736
SHA512 19d8cdab92b3601280619865c13c21ca4b271454b36cbf37fc356ae8eb2f33f2b912018e1d64c78895eb68da2e10c76c1058cf030a6a366e8e7d17677ff9d085
SSDEEP 192:sxZzRTyMqZ/K1hl8Pme/fAsJeWpVFKXUzrvzzodp6yHW6+WNffCWdYfGus+nNin2:sxZzBDe/fAs8WvFKorvoZHbrdINSSv
TLSH
T18F82E806A938597BCCD6D219FA457F63D7FA152396814E449AFC8F0C04E7AED220392F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3841402d235323c5ff41fe45061101ef3c0225b3690bcb1d06a3220b988a0984
MD5 aa9d6467c13d9aa912c7cc43dbaee1bf
SHA1 4766dff0fd44a2801d1fc1f0c5564266de64b340
SHA512 ddbd055cc11a461df6eca6778a2db2ffa344b05b25f4851ce727085bd6a7c0ab778a266b8fb3b12a8601632c3a63d0781111fc020c1de06dce07cf97a0c2561d
SSDEEP 192:sxZzRTyMqZ/K1hl8yme/fAsJeWpVFKXUzrvzzodp6yHW6+WN8nFSfYfGpTetNbV2:sxZzBqe/fAs8WvFKorvoZHbffXMNlSv
TLSH
T1DF82F816AA38597BCCD6D219FA457F63D7F9152396814E449AFCCB0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a2d226f1c15b04afec8fb98c195642e7c6ecb482d31dd5818f695923dfd0d885
MD5 5687166fed8b1e73e3e31693245db9f9
SHA1 cc13002792ceaa7e4815a74a0785fad83e12e07e
SHA512 d3660d5acbac4ead67f65ceb0c914f3ab4ec46527e5e6c4e60fcb0577115d1309dcc43159a6ebc0d9093fa4d6145bacf362dd462792a2431b4e0acbf4002ca47
SSDEEP 384:sxZz2fe/fAsUWvFhorvGrUHbW9YNQrjSv:s7+e/fgYFhaHbyYNQrK
TLSH
T11682E805A938997BCCD7D219FA457F63C7F9152396815E44AAFC8A0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5179a36dd49cc6a4fc06586d1deafa35f1f47229ba7d5de02389401a9d3becbc
MD5 6637cb88d9d6937f7ecbc25f88ccba55
SHA1 30c183f0230a67f71ef80a6e5aa3779fe1262b81
SHA512 c54c37d3d09c016e814fc0592fdbc7272969cc099c30c6853246a56334a0344edcb8b25f26653cb52022905d673ecb851481a73cbdb78eb31d3f9dcb5fe75845
SSDEEP 192:sxZzRTyMqZ/K1Wl8Pme/fAsJ2WpVFhXUzrvzzodp6yHW6+WNffCWdYfGus+nNQ+I:sxZz2De/fAsUWvFhorvoZHbrdINQwSv
TLSH
T1D382E706A938597BCCD6D219FA457F63D7F9152396814E449AFC8E0C04E7AED220393F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9b290f65c930b66acc550fcddf24e76fde0c186d8e3cebdf3d8195c697476aee
MD5 2377b83362621eac994fe33e16e27afb
SHA1 42955eab5a1b5cd6325a182b25cf1bd982bae191
SHA512 2a48f29d7bb0b929d91cb761d76b4f5e7c91b6fcfb989dcde844f41922b755f4b8a2c81d4443f58a011a521e52474223d3c6c00222a37f3accc38afc0f01a6b8
SSDEEP 192:sxZHRTyMqZ/K1Ml8Mie/fAs0VpZZELgvNzodp6dHW6+WNr31/YK27NNVIgj2J:sxZHsqe/fAs0r3hvGeHbx/YNfjC
TLSH
T13962D9156A38A97BCCD7D219FA457F53D7F5552396804E48AAFCCB0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6f559538bf5780d7cefcda77f3f85eee48b8ef5977a9f0ab646fd62c1eb1b8d4
MD5 09c6bc1457fa13a3016890d76a86b4df
SHA1 1ca18fe14444f3dc3dc43f8d258719ada8a05e05
SHA512 a9df415e52651a8f4e4ed7b51e100e852be58e1edbe53a586174272cc24dc69339f232859295d0ebc2013a3b19c60546ca31fffd5b2562bf96284241ae416877
SSDEEP 768:AasqZpt7pLuLnKlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzEx4Llhf51Yrob:AasqZpbEnKlWvBDeTu1jaWEx4LXB1j3r
TLSH
T1AEF20A3B6C0CCB7E4F804E9CDC2A7E8E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 85dfc9ab182a220ccb6590fd3db01f2d94bdd68333cf3720dbc098fc8b747d4e
MD5 d6133ec98efd6092d6a318c4a5bfc99d
SHA1 680e8e2abbb8562150ca690450da96cfa9c407bc
SHA512 1690d9b7760468be66f3000f11365b76ec5c467c6c269a4092cd8f22062b6159731315b6a7743ae530e2eb32d33c3ad34bb154d4f87e9167a570b1223751ed82
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFEx4Llhf51YroA:A9sqZl+E/BlWvBDeTu1jasEx4LXB1jyD
TLSH
T1CEF2FA3B2C0CCB7E4F804E9CDC2A7E9E6EE8018B96D8895447F9881C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 bffbe46804d70fad17ef82913d9e427a2718627fb893d825837b4c118ae4b789
MD5 7b2050e44beb459e30e0b5a00b7a3c68
SHA1 ef0e401db24d7953f1c7ce30f85fd2dcc386849b
SHA512 4ef55d9590cb7132f72e86973ec9ce25b8440600ded56f12950409f43bc7d5024725258af7313ffd0b2a8eca84b85ab10942e7862b4baa750006199064410696
TLSH
T1A1E020584AC8C2BDA06529C747759709C7D87807D6D83D021F44DC806283F04715F1D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 d770a02a53aa64ce3245bad3bf2f0c09d6e2b89d318727b69c363bf7b1a1f695
MD5 f1e93468ce94c5dc969b7dcb87c714cc
SHA1 60e631833b35e0ec2a4924a8016fa0683f7c5745
SHA512 7cadc714bdef0e01afa602ca2dc77ff74250a9ee218ebdbb25b8b31f92118ef487ce5dad6e1fea2d9ec35a454c3370bd612bc2c53309998de6a063243247b480
TLSH
T15DE0D83466C9C76AA289B5DF9375F70DC1F7B907D6E86D112B48EC806346640724F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 532a2a25a9bdc6ab17e752f6defbedeb65a6c061a92f3e3aecb4b8d6b923ac1b
MD5 578a4d20fa66ce5c472a825429218437
SHA1 8846d0f21eadadafb996778d350cdc27fe07968e
SHA512 f7b107ec7daef6f043983471e18f9d1f8b02b243f5d24448c0b92e5b61cfecae5eb6d8df4f77652261f5112a5888eec7b964a2e48eafc2e0e92b983b110ed886
TLSH
T17BE0207486C4CB7990446AC783F5BB0DC2F47C0693D43D415708D8847201A00766D5D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 a12af18e07cc1e145cc37be00c91ca1486ef623a73275a6d4313d8b2513c77d2
MD5 6787bd8f62ad413ab00773ecb6da56ef
SHA1 2ca8be3219ed4b786fbd5e5e9c9b76287e3288a3
SHA512 2bc6a689e26c0d84825adc06eb84388f6953ac2bff085adcb3bb501d8a7ac378fd9c308c30abfb010a59517e798e3182847e27765df0700ab18ba5df479ed458
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qn6:+BOVglYXrbtZqRvJ91GHl
TLSH
T145C24C11763A0380397E254A8194B56F66C270A37098B83B7BBD44A64F6BF21DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 4d540e5744bf4143103d06380736888987ede916dd7ad60dc15b77760afa4a98
MD5 1d5f84e1cbb267ea0e5211a57359dd97
SHA1 bc2d3681a7578313f8a55e1368a15dc3e0b0de2d
SHA512 c3cc929cfbb1af5b9c290d3d11aee779fdb83e3e98f02ffa9f7d97b49059c35992ca82862b77d774f86d157bbfab8aa87eec2abe94b65d2ae1d44e318c6204e3
SSDEEP 192:P+xWf6brKEfcfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxxn3fcfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T11D24630A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 fb299b2fb99326e058f2af14307cc7d78791d77a87411e76eb7f93e33ac302f8
MD5 da034d1f1f2ffbb48f8def7b5018bed9
SHA1 42fde21220e5ff6bfab71be782c2a6e6e055badf
SHA512 443a72f88d0ca492a19caf526f8e67e17835ff03d7e1eeb0f2cd46fa1f0d5324bd0a29335e4c0dafd5a534d1dd47f56ca9f227b98fa1a157cad90a78815feb04
SSDEEP 192:v8OHKmAs2tlrHMrs2GFf+vllQvIIIebOMIMUbZYcY1:jHwsSsshCQvIIIebOMIMeBi
TLSH
T1B45272192A051F33E15F5F76035ACB925BCAC8814572226E35211C1F8DF2F578BD92F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c3a43498c0c81ad05a8eb2eb13dd95e4ba1f846d505aebd89a5a70f3c97c0a7e
MD5 913ac96cedda0be2c6aeddbe0ce179fa
SHA1 5729014786a1d4b970c92d3f5fd2a273e6e350ba
SHA512 8b7628637259bd4b5384ba5cc6eb55e0a8deadbee709344857fc36cb487d1f6b47f46c9651ac9c9aebab5318bea48839ad59b1e8562d8e8ee01b20f543f84d51
TLSH
T132E02010D5C4C2FEE19626CB427A5B08D3C83C23FAA42D475F00C4847302500774D1D5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8fc9b9f38b2a9679560603c303948ec347db17f775d55c93b71a0ab944bb5d4d
MD5 a9822898b824265a21356351bd0f8b44
SHA1 f3ad9a1812cb64ec22f6fdc8bfd18d5c0c788be3
SHA512 39db4e06b11105bc9acc2deabb9e5cefd4d9ee464b31aa60c3f6a828b7180c443b8db9ab5edffe96ddfc17fdbc2b0ace757be172216a4eb05be7684b5074a8e5
TLSH
T18721B251F324C148D18A967E902BDB351738E8069FFCEC1F807924752E75F151E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a2749f2f9799fca7d40bb9f550cb9c7346f154ab76b457961ac88824218d77ee
MD5 cea72d74785dad1ba230c49c3154e37c
SHA1 864f0cdd74419ad081d7927fa014086b8fbbbca4
SHA512 e3e9aa59cef9d053decdb609c07c0902641898d1ba02bbf12485fef97e10a943528689fb73e0c7667bf7478dad877ae6e7c03eac4bedefd9c4070103a540f660
TLSH
T163E0D814A9C5C3AFE09165CB42B59F4CD3D93C4BFAA82E411F04CC945305542728E192
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7e99ff7815aa5b26e8caf0b8d379f4aa3528fe7b1c0587c6667fdc597e6cce68
MD5 88329d71ed7b85e0c8ee096c5e4c2ba5
SHA1 ec3860ef9f21c16c5459508587aef1055837daa9
SHA512 7477ba3b7b0c2e7238f34552142aac9626618f309bb01ee6e9128816566f9084d908e11f0ba378c72109c532dc760303fa89dffaa58569747e40b8dfbf34dc93
SSDEEP 3:MsEllllkEthXllkl2zEflk/l:/M/xT02zJ/
TLSH
T11F4404057FC50405C74050304151C37013F5F5100573574337F544375CD75401C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 63e81dfdff57c114ee55b1bd64193c7d5ed878ba06541494c547c5f0177a151a
MD5 4db9b2b05e8b346107cebb3858a0bb0b
SHA1 66d47bc4776d2333becfc1e3ed4b7673ad15ed88
SHA512 5a8ef32e056cfa1a4d0a4dd4b92ad99e2b2cdee370583a38af5be9646dc3e88759425f219e804658f88d93fba7231ed3066f1af0510d294b050b16de99bc3f05
SSDEEP 768:IFey4dwguAaiXZYoJliU0mt5rPIWraE9dpk/L:hy4aAasL0mvtraGpm
TLSH
T133E21871D894CDEBA8D6DBC9A749B502AEE40237C58C4A9CE6F87D2D209F0FD8307855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 0a9c27c4d5cf9871bc64983061cb3ce4e248285bc467614ca98411131b763359
MD5 3cfaa6eb2ec5fff1cb41b34129096aaf
SHA1 c13b1ae5796d23c387669aaec4ca929d0f479234
SHA512 09208aadd3fc5a39e6ada98aa84505d06705ba6f0b18a8c9cb226e6929eadc68c7ebf2894795bfe454af9a8dfdddd7e08b219a12c96e46b5e3ea069faa940280
SSDEEP 384:nXiF/CcmyWCCsNv8TUNTUlI41bCsRihsJGn84fDYjcJliUqZmLhpTctphQkbF7IL:SF6cpCQwg4m6ivZYoJliU0mt50QkV8
TLSH
T1B7D2B3F198D78977E89E4747A37D2D428ABCD163B5884A94F7D84D0CCC861BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 06ff3585e5e24d8bf06d86622b3e3847cc33c152f1b5092c78b1a6032ce72e65
MD5 acdbda9f606a8dda48c8c56e0aa5acf1
SHA1 d03f2e8fc29a39684fc8aa474c15285a266dd70a
SHA512 a8a2979f4d5cb96c98bdcf38176cb483186a2c69abf47ef2d7fd0367e5192522b49d4c190af6cefd480f3694b84081e39b36dcd3c80c33f4c35810654fa75886
SSDEEP 384:nhiF5CcmyWCNsNv8TUNTUlI4pbCsRihZeMn84fDYjcJliUqZmLhpTctFRQkbF7IL:IFAcpNQwgum6ijZYoJliU0mt5kQkV8
TLSH
T17DB23B31EC58CEBBECEA5B95F64A3243DEE41167898C4EE4DAD95D1C00DB1DD070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fce1991463b2ed40b6e8e301ff0022025b3545ef5ff288f4287ec788afef16c5
MD5 4553eaff9769e573a7ad75b8779b7442
SHA1 6fcfa47bca395277a731f9bb40889884c8633858
SHA512 2ac83b744d44642ac9715588324a34e97e5230d0b11bf2f16febdc3989d3f867b9def0a314e03243f0632ff847f3bf8fdfbd902b38ad726ca0b54d0c05169608
SSDEEP 768:uXFayv3EwgTiD1YoJliU0mteAmo1tiDXsG:uEyv3siL0mnmoXWr
TLSH
T142C25B31E898D9BBECE69FCAE7497A07DEE001A7D58C0AD4DAE81D0D10D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 29984543b27620d58e7b4d143c93482c21bd9212735c80ab2e639efe777b70ab
MD5 799bbe8e67b1fd0f6d81050c779bbf65
SHA1 e2ce8fb5d4d5e971e84d1f1b722e81595645ec29
SHA512 27af91d429f7f5d26523d7f9361bc6daad982324d068280f2288105ea4fccf6943aa4fd7c6e1d4ad76c8eb9180a3cff855a877a859ae6f1f67b61786369cd223
SSDEEP 384:nhiFavqMg3sNm8TUNTUlI4pAMRihZOkn84fDYjcJliUqZmLhpTctMnFkbrN1k+rR:IFayv3dwguAaibZYoJliU0mt5rFk/L
TLSH
T14CB23A31E854CEB7ECE79B85F7493643EEE011A3C98C4AD4DAD85D1D009B19E170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 68ec9acfb387626592c340c92cd9e37d8452d418162d36f1c3976d74f5cd97aa
MD5 0fab3afdc9871d74f0bd0df015aa1c0a
SHA1 11d09cadafac50a9aaab9d5f8f785acf77104794
SHA512 a33d1a0d9f920dffde27c00e8031626d1d8f79dd964459c76648756c05ed2f56593d02060a592ad3ceae03cda9a53a7a7736ca0c4e71ed5aaa7f300e0769c32d
SSDEEP 384:nriF5CcmyWCNsNv8TUNTUlI4pbCsRihZeMn84fDYjcJliUqZmLhpTctFRQkbF7IL:GFAcpNQwgum6ijZYoJliU0mt5kQkV8
TLSH
T1A7B24B31EC58CE7BECEA5B95F68A3243CEE41163898C4EE4DAD95D1C00DB1DD070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 887c786c6ae027e38f5e01a2cc5c12c5f7928a0fe0fa527d050022c9b5889c4b
MD5 1773a87227dd8698b71e2f9ac0947fda
SHA1 a64b7702bb0122f9bcd1c5606b66325c4480e9dc
SHA512 881ab4251aa538f8f22dd4af2b80a66de1fa7c372c34b8a66f1b3c2222e160e198ca2abbcaf3476ac0d65728c2fac4a4ef42b75d1f857a9fa55ff6f6d4170858
SSDEEP 384:nXiF0CcmyWCrsN98TUNTUlI4KbCsRihfJ7n84fDYjcJliUqZmLhpTctfnQnmkbFs:SF/cprqwgvm6ibZYoJliU0mt5UQnmkV8
TLSH
T128D2B3F198D78977E89E5B47A37D2D428ABCD063B5884A94F7D84D0CCC861BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5b57da0439d81a407f2bd49cbc65b3e35b97ae88cc94b511de9c1a841a9dea18
MD5 3b5b94e79715c548c4dfb2d16cc92857
SHA1 2c590c263f30c9a6ead27bfaf82275d7f48c2765
SHA512 33d3bd77cfc88132d7a7a7549d1921d8bb2ef73650c42ec76ff37a0935b02d9ea3533d3b5e963316102117aa5743b0dcfdcfd158a1a5dab0ebb8b34a7f65d77a
SSDEEP 384:nriFTCcmyWCjsNv8TUNTUlI41bCsRihNbGn84fDYjcJliUqZmLhpTctkRQkbF7IL:GFmcpjQwg4m6iGZYoJliU0mt5fQkV8
TLSH
T181B23B31E858CEBBEDEA5B95F64A3643DEE01163898C4EE4DAD95E1C00DB1DD070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 588e0203ff013ccc7457c9b65e85b829df0052af88d2584a0741ad3bbe62f9ad
MD5 677de2b02287bb4253ecd78824fdc1b8
SHA1 85805cd74ec4032b6b14209216c236eb3c5fd613
SHA512 50d68eac975ed055d71591f89b2450b5f27826557b7a7d0704105dc4a69ed4c4d633438c94edd994510698d8e1ebde0ada6b59c7035d50f082929347e250800d
SSDEEP 768:QFayv3twgTioSYoJliU0mt5wFmo1tiDXsG:7yv3H8L0mv2moXWr
TLSH
T17EC25B31E898DDBBACEA9F99F7497643DEE001A7C98C4AE4D9E84D0D00D71DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6424b220c308eeff1189ad13d292b725cea0d6c6329d10f5b1564743b9511155
MD5 58062845929e084bc4273c76b6c718ff
SHA1 22e87b814f542126bec0a6169bc2a3aaaf15a2e9
SHA512 c50fd64dc7c6f7760ed43ca61fcc82818918a677d8640e978daaa18c8d92628a2652009b2614e0c8435ff467fa9144ea2634dd270c7e4ab06f6bb6b1d79a49e8
SSDEEP 768:SFEcprQwg4m6iCZYoJliU0mt5UD7ASNYXKq46BkV8:YrFm67L0mvUxYXKd6BX
TLSH
T17BF27EF094D78DB6D49D8BC7A76DAD0259BCC127B5884998B7E92C2CEC8B0BFC306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 11eeb1b4b72dfd691e05d346119388831895f88e98f3c764f03102d09a808680
MD5 37ba0c94beb7b2eeae9b14d82a396e06
SHA1 d84250fc0ba19d96b6d53a00360b5bbe9efe36ab
SHA512 22c51bd69b4ce3e9b35d0c7f26f91d2f0764bfeda8ba410a8bc68420253b17310da503a61fc795e773fdd8735717b20beffeb27edd563c020e81e9cec3ce3e9d
SSDEEP 768:IFey4dwguAaiwZYoJliU0mt5rPIWraE9dpk/L:hy4aAapL0mvtraGpm
TLSH
T154E21871D894CDEBA8D6DBC9A749B502AEE40237C58C4A9CE6F87D2D209F0FD4307855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 17408659b0c79d10a37844895774236c47f403ea89865d82edc586d5823f686d
MD5 5511aec15520acdff46ec66fbe40f14d
SHA1 6322ad45944567ecf058d867c67b836575ed02a7
SHA512 5bead67dc799c343734fa29f61b97e5cafca8b8b33b61c19982b64a4104478e8415929c76e761f6f666eb44dc1da8b078230667c133eb5681c0aac6f4cd5bff4
SSDEEP 768:SFYcpJqwgvm6icZYoJliU0mt5UQYYSjS5p4e04kV8:MJwm6RL0mvUbG+z4X
TLSH
T11DF25CF194D78DB6D49D97C7636DAD0299BCC023B5484998B7E86D2CEC8B0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 81e39a8ca76e1f95060025176464a90e3ac41f921b1f292df26b7bd4783fafb3
MD5 4a65acd5627459e9917e4a8d0df488cd
SHA1 8cb99849c4100ec211b13d98d7f1d2c46e0085aa
SHA512 7cd87da6a0b9a0391ce5591c3d9aa23942579ca8ce0ad351758fff2e3382fe2664e07c5480e9217cd47f3bf330381f604e24dd4d549d3319cb24cea5bd5b30dc
SSDEEP 3:MsEllllkEthXllkl2zEfl10NK:/M/xT02z
TLSH
T1734404147FC40C05C7C010304151C3501371D5100D31F7C334F315375CC75441CC4400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d34c4de052dba1e7c50f04cb7e255c898b58305e5b1f02ef01250cb253d2e6a
MD5 849013e243a9280250636ae629117dde
SHA1 c6134cc9a294b93286ef58a97456c73c17e0d95a
SHA512 02a1e76f3affd34567c3ebf304872dbde90c3239a5fee52f1d59e8aceb61589420eeef2ced65dd727f6e6f5d9aef492bdb4ec08e50e13ba03bde14688f746a9b
TLSH
T11541485CB6FA1108B3B7AF169BF2686D587A78272F0AD06D10110E4F0A63A00DCB2737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 3d55b71cd3edb06354d5d2422d80fd3df718f54ed90fb9a32bc1df41f96d5e44
MD5 ebc1a9a2bb17f0760cde77649974da78
SHA1 ef4272abd8e1caacc3b0a447c802bd3400634492
SHA512 4ea5cbd0d61eeed917965a6eea6c016fd67efc0544d68e2d6ed0ba5eb7051c2b5009e4098f7618a54f6bd15dde56c3eb163ccba106c96a9420c1ebbf660aece4
TLSH
T161513F686AEA214873B37F569BF6B4AE487FBC372F4A945D10110E4F0523B40C861B3B
MD5 SHA1 SHA512 TLSH

Submit Download

faee23c2-b63c-4c1c-aeb4-d5651c9fdb8d.tmp

Path C:\Users\Admin\AppData\Local\Temp\faee23c2-b63c-4c1c-aeb4-d5651c9fdb8d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MSIA803.tmp

Path C:\Windows\Installer\MSIA803.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599428.msi

Path C:\Windows\Installer\e599428.msi
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599432.msi

Path C:\Windows\Installer\e599432.msi
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{169E9D03-436E-4F56-AF42-03F9BA3B4484}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-1437-0x0000000002FE0000-0x00000000030DA000-memory.dmp

Download

memory/2356-1713-0x0000000002FE0000-0x00000000030DA000-memory.dmp

Download

memory/2696-1710-0x0000000000CC0000-0x0000000000D86000-memory.dmp

Download

memory/2696-1657-0x0000000003380000-0x000000000347A000-memory.dmp

Download

memory/2696-1711-0x0000000003380000-0x000000000347A000-memory.dmp

Download

memory/2724-918-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-937-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-916-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-917-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-931-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-932-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-933-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-934-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-935-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2724-936-0x000002B4A5080000-0x000002B4A5081000-memory.dmp

Download

memory/2836-1686-0x0000000003180000-0x000000000327A000-memory.dmp

Download

memory/2836-1676-0x0000000003180000-0x000000000327A000-memory.dmp

Download

memory/4596-1677-0x0000021D04130000-0x0000021D0413C000-memory.dmp

Download

memory/4840-1685-0x0000000003E60000-0x0000000003F5A000-memory.dmp

Download