hxxps://www[.]google[.]gg/url?q=amp/adservice[.]google[.]com[.]ph%252Fddm%252Fclk%252F424929466%253B226923624%253Br%253Bu%253Dds%2526amp%253Bsv1%253D64195420186%2526amp%253Bsv2%253D3261659123742877%2526amp%253Bsv3%253D6702577448695742699%2526amp%253Bgclid%253DEAIaIQobChMIurHiwbHn8gIVBZ53Ch2TZAIsEAQYASABEgKAL_D_BwE%253B%253F%252F%252Ffast-static-cloud-static-panel-secure-edge[.]s3[.]dualstack[.]us-east-1[.]amazonaws[.]com/b11b728f596c0ce5e6e6035769c304f8f80c3cf94d3fdcfb368939747978b4d7/d4004947511d2d9c66c57eef4573306fdd7d78bfb25facdd77a44fb0c92ea121/9ba2088b3de1a2f42e247300b5c1c6eddb1a7cf2a0249e1c6feb98babf9a80e0/go

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.gg/url?q=amp/adservice.google.com.ph%252Fddm%252Fclk%252F424929466%253B226923624%253Br%253Bu%253Dds%2526amp%253Bsv1%253D64195420186%2526amp%253Bsv2%253D3261659123742877%2526amp%253Bsv3%253D6702577448695742699%2526amp%253Bgclid%253DEAIaIQobChMIurHiwbHn8gIVBZ53Ch2TZAIsEAQYASABEgKAL_D_BwE%253B%253F%252F%252Ffast-static-cloud-static-panel-secure-edge.s3.dualstack.us-east-1.amazonaws.com/b11b728f596c0ce5e6e6035769c304f8f80c3cf94d3fdcfb368939747978b4d7/d4004947511d2d9c66c57eef4573306fdd7d78bfb25facdd77a44fb0c92ea121/9ba2088b3de1a2f42e247300b5c1c6eddb1a7cf2a0249e1c6feb98babf9a80e0/go
Sample260624-pdrq3aby21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	msedge.exe
2892	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267768019222728"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{98E078F5-C65C-4AD1-938D-E1783DD6DEA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5716	msedge.exe
5716	msedge.exe
3800	chrome.exe
3800	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
1896	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe
Token: SeShutdownPrivilege	5324	chrome.exe
Token: SeCreatePagefilePrivilege	5324	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 6072	1896	msedge.exe	87
PID 1896 wrote to memory of 2040	1896	msedge.exe	88
PID 1896 wrote to memory of 3932	1896	msedge.exe	89
PID 1896 wrote to memory of 3932	1896	msedge.exe	89
PID 1896 wrote to memory of 5540	1896	msedge.exe	90
PID 1896 wrote to memory of 5540	1896	msedge.exe	90
PID 1896 wrote to memory of 5540	1896	msedge.exe	90
PID 1896 wrote to memory of 1396	1896	msedge.exe	91
PID 1896 wrote to memory of 5832	1896	msedge.exe	92
PID 1896 wrote to memory of 1396	1896	msedge.exe	91
PID 1896 wrote to memory of 1396	1896	msedge.exe	91
PID 1896 wrote to memory of 5832	1896	msedge.exe	92
PID 1896 wrote to memory of 5832	1896	msedge.exe	92
PID 1896 wrote to memory of 1388	1896	msedge.exe	94
PID 1896 wrote to memory of 1388	1896	msedge.exe	94
PID 1896 wrote to memory of 1388	1896	msedge.exe	94
PID 1896 wrote to memory of 5920	1896	msedge.exe	95
PID 1896 wrote to memory of 5920	1896	msedge.exe	95
PID 1896 wrote to memory of 5920	1896	msedge.exe	95
PID 1896 wrote to memory of 2816	1896	msedge.exe	97
PID 1896 wrote to memory of 2816	1896	msedge.exe	97
PID 1896 wrote to memory of 2816	1896	msedge.exe	97
PID 1896 wrote to memory of 1068	1896	msedge.exe	98
PID 1896 wrote to memory of 1068	1896	msedge.exe	98
PID 1896 wrote to memory of 1068	1896	msedge.exe	98
PID 1896 wrote to memory of 5660	1896	msedge.exe	100
PID 1896 wrote to memory of 1560	1896	msedge.exe	99
PID 1896 wrote to memory of 5660	1896	msedge.exe	100
PID 1896 wrote to memory of 1560	1896	msedge.exe	99
PID 1896 wrote to memory of 1936	1896	msedge.exe	102
PID 5324 wrote to memory of 3324	5324	chrome.exe	106
PID 5324 wrote to memory of 2236	5324	chrome.exe	107
PID 5324 wrote to memory of 2892	5324	chrome.exe	108
PID 5324 wrote to memory of 2236	5324	chrome.exe	107
PID 5324 wrote to memory of 704	5324	chrome.exe	110
PID 5324 wrote to memory of 704	5324	chrome.exe	110
PID 5324 wrote to memory of 4956	5324	chrome.exe	111
PID 5324 wrote to memory of 5100	5324	chrome.exe	112
PID 5324 wrote to memory of 4956	5324	chrome.exe	111
PID 5324 wrote to memory of 5100	5324	chrome.exe	112
PID 5324 wrote to memory of 5824	5324	chrome.exe	113
PID 5324 wrote to memory of 5824	5324	chrome.exe	113
PID 5324 wrote to memory of 3472	5324	chrome.exe	114
PID 5324 wrote to memory of 3472	5324	chrome.exe	114
PID 5324 wrote to memory of 3836	5324	chrome.exe	115
PID 5324 wrote to memory of 3836	5324	chrome.exe	115
PID 5324 wrote to memory of 4292	5324	chrome.exe	116
PID 5324 wrote to memory of 4292	5324	chrome.exe	116
PID 5324 wrote to memory of 800	5324	chrome.exe	117
PID 5324 wrote to memory of 800	5324	chrome.exe	117
PID 5324 wrote to memory of 1040	5324	chrome.exe	118
PID 5324 wrote to memory of 1092	5324	chrome.exe	119
PID 5324 wrote to memory of 2768	5324	chrome.exe	120
PID 5324 wrote to memory of 1092	5324	chrome.exe	119
PID 5324 wrote to memory of 2768	5324	chrome.exe	120
PID 5324 wrote to memory of 6008	5324	chrome.exe	121
PID 5324 wrote to memory of 6008	5324	chrome.exe	121
PID 5324 wrote to memory of 4852	5324	chrome.exe	123
PID 5324 wrote to memory of 4852	5324	chrome.exe	123
PID 5324 wrote to memory of 1604	5324	chrome.exe	124
PID 5324 wrote to memory of 1604	5324	chrome.exe	124
PID 5324 wrote to memory of 1384	5324	chrome.exe	125
PID 5324 wrote to memory of 1384	5324	chrome.exe	125
PID 5324 wrote to memory of 3868	5324	chrome.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.gg/url?q=amp/adservice.google.com.ph%252Fddm%252Fclk%252F424929466%253B226923624%253Br%253Bu%253Dds%2526amp%253Bsv1%253D64195420186%2526amp%253Bsv2%253D3261659123742877%2526amp%253Bsv3%253D6702577448695742699%2526amp%253Bgclid%253DEAIaIQobChMIurHiwbHn8gIVBZ53Ch2TZAIsEAQYASABEgKAL_D_BwE%253B%253F%252F%252Ffast-static-cloud-static-panel-secure-edge.s3.dualstack.us-east-1.amazonaws.com/b11b728f596c0ce5e6e6035769c304f8f80c3cf94d3fdcfb368939747978b4d7/d4004947511d2d9c66c57eef4573306fdd7d78bfb25facdd77a44fb0c92ea121/9ba2088b3de1a2f42e247300b5c1c6eddb1a7cf2a0249e1c6feb98babf9a80e0/go
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7fff36e0c188,0x7fff36e0c194,0x7fff36e0c1a0
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,11791144634320035928,9782965015457556694,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,4413326150016352998,13088053825741679133,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,14089762830803387795,6475001968360337083,262144 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,17556485462990665276,17522886965106602608,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,10839221045994196899,13007234648469951389,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2286127015931091714,15808846738632921384,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,17989498989873877541,16291289935304624169,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5332,i,6097291232582332725,9274025661866817157,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5484,i,1024052359685720556,1185065156448218237,2097152 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,7962968025286164371,8848721624564821878,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,1280523238743323883,11670713070759596400,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,9297661141806408621,11688622960307000321,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,9297661141806408621,11688622960307000321,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,7373327760705844056,217638195657442016,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,3916211904134169928,8924612794858446805,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,2470618556202218667,3497213471124018043,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,706402526817362741,16898201214726159814,524288 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,5063471064057803314,12453518138244248941,262144 --field-trial-handle=1884,i,751288896656912247,3328548632679994242,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff3409c728,0x7fff3409c734,0x7fff3409c740
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,14519862513738340830,11973193329061436635,262144 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,10209646080638064251,8763506664802448499,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,13002160327750203151,14226316849199559380,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,13014755326277442651,12328827753399537886,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,15072394747668318611,2809617243450180450,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,11997874533253952757,14500229779171531686,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,12341560398058727332,1728270187867709665,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,4488171215626104964,8924897502874507607,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,11240448349066101193,7873575629874869513,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5332,i,12966448754044259959,1495498891568734152,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,18351532784502176729,9124119828578602131,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5668,i,7848914059011469576,9733471436070253139,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5700,i,13197241984498388266,2973449543680074643,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6020,i,12437202548499230159,10951881071356568058,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6088,i,16700856031894520565,8301119854990588819,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,18254249856141816376,3011033779487266844,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6236,i,15125161565538880277,9020611466798024929,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6512,i,15008629163513678115,3618604812124997252,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3536,i,8062671444365333046,4277018247734845406,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6664,i,5797354755190064583,3288250652085505028,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,9725255123549792189,5198132103694931582,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,16370886405544319312,10647407841363041646,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3556,i,18104930279803068673,6124754148432865580,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3536,i,11688719769456937006,16387856980716775409,2097152 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:9
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,13708058916076782888,2163399450247019323,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,13094086731159500561,9578711784543002008,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,5428845316963631264,11422970005319963270,524288 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6628,i,10753936024782747715,14243227590705391171,262144 --field-trial-handle=1784,i,17237032134750758944,6239026230967886712,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3481fd4c39b9c2add423ad30bf530cc9ba6baa815954a7275be61bd470f23869
MD5 a40549b1a4f9f84837a7aaee2e8161d8
SHA1 b04b07b09f336ed27b1fc4ceadcffca8e33de11d
SHA512 54377460c6259ad7f7340005772aee3a8842d8facfb4762940b01789de34cc618fbd71c9765f5fcb1a55c64ce704cf5f7ef8e6027e709d284cd6eaaec9fded75
TLSH
T1C281BBF7C7D48A2DC81152F0AB216E2FDD2D0A6843283C5689D9EF4F93E24B2D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 38f7d4f94d910b06ec06d483bc15cfa1a6e28075147a29c8874fbea61b8486fe
MD5 e7f56c0b2835aa24252d5400df3f72d7
SHA1 1dd76425ea7342ce02f0e7a624fac973b86848c5
SHA512 4a98374a30c0758fd3c242dd3e067957aecdeaa85715195b11f5ba9a29a7c77dbcf2ab8539e553a20b4a86122cafe508112e79c9d8b60028d3d9524417bc4558
SSDEEP 192:+RRcZK6yxv7jIk4PRpS7i9PHsb+WNnohfnv42/ueHBlVyIsnAUgE:kRcZKrhglXHBw8fg2zBTE
TLSH
T1CB42B56BAD14657B9CCBD22AF9657B53E2F9103131D12E88E7FC8A2C14E7ACC2213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8c67a4ea3f876674839e42e9f981ce3b4d6a92e3d6360a66ed2711859ce06d88
MD5 de1be77b0d9321013e9b1fd2e4df823e
SHA1 9629debd9d53a769f20afd3702c73f5df75bf178
SHA512 21bd811fbfb8e00c695afa89462319d1fc94dd6e82c141f4b8cf2a84cb7b1167c33424ac47c69f8bd8e92502d5f18e470cc862b8fa5543baf646452733b28941
SSDEEP 192:+RRcZK6y2v7jIkAPRp27i9PHsb+WNnohfnv42fuejBlVyIsnAUge:kRcZKrCg1XDBw8fg2PBTe
TLSH
T1D132A46EAE14657B9CCBC22AFD657B53E6F9103171D12E84E6FC9A2C14E7ACC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e1cb32d398f84cd258ee185f01d66a815fcc5ce74f3898cb0e2759d6a9d7652d
MD5 44b5335cda61216974f17ee4136710f3
SHA1 9cfbc5b4ab837b44c75098ea2642a336d170eaca
SHA512 01494b325d4f7940d3d5582cd05de972984131e9a8bcf4b5976118202fc43c5e666f03bb512a9521cb4af5c38572ce05f86e4c3de7e71d3886f6a6a73d43e1af
SSDEEP 192:+RRcZK6yxv7jIkAPRp27i9PHsb+WNnohfnv42Nue1BlVyIsnAUgE:kRcZKrhg1XDBw8fg2HBTE
TLSH
T1C632B46EAE14657B9CCBD22AF9657B53E2F9103171D12E84E6FC8A2C14E7ACC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a76a5427ee3e4789e64d8d5383e21c549d27c3f2bb8d0498f02733155a4d8337
MD5 f575a29b3337fd18d0a077c9b8505d3d
SHA1 feaa4a400b253dcbf65848a5693e647c5132ef58
SHA512 8d76f944f6b065be4bbaf2a2aa9a588ded75b26863b300d396d310200c2c4786340ecc1c66e31dc83fde617bd5694c00e4030bba085aa30beb2cada67ecafa13
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgsluUXODj6+ErU3ulHGfV1KfkOJCzbCa:x/j+7KxkXqKf/pUZNCgVLH2HfgsoGOXx
TLSH
T16F52E867684C9A7B0FD8D68DDC167F4FACB5015676A8092852FB9C0803A5BCF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 c39e756af6ca77cdaf24def674da7d9e45bad09dcddfef654c3a8b115036f2b0
MD5 6eca3a1960d09f634cc1d30bca63c0a0
SHA1 e7d3c4148da71813608123a999846f727d79d662
SHA512 e3d94e437ca93ad05b8bee5d9b8b5a75b9dd227c81fd963547f1f1604d455294d3337f4fd738559e37e2fa9c5dcd77bf1b202eb39614075681782aefb66e11af
TLSH
T10FA0025843C44462DD154E74E0A255527765992D1651834796934454DD5B1C45202610
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c809.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59c809.TMP
Size 48B
SHA256 642872c9bb280465c488ebe264196d073f73d1630442a865b9e1258be774b47e
MD5 f4794e0c7a79cb2977c3efe0f163ae4b
SHA1 1bf16867fbf5541ec871954abe1d8405930505af
SHA512 2cf0434b5f75334b79af360dd95d054bc3ad890d1b01d24c994de7e2a30b79b1b11ec0a1e4c8c9b1785098b8dcb3be06aeed55f0b0e7a2244ac0f95cb040df95
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9d3932f666b0e44b9f2d384e92233b5764200dfb40f1821c5dca75f3d43c1f8a
MD5 0d271179b3745ceab445b7fe2211c9b7
SHA1 477b46dc989e850277aada34db421b151830640d
SHA512 77cfcace06289c89284124f493c21646f0ad19c12937c95361d1af34de685f7fb064906917eefd65b56f9409aa5bc1b455435e6ff005008d17f1c173ca8ce2ab
SSDEEP 96:zC6kd+q/o6Oe4rRfPd6NdjRDotok5QpwDRB6EGyvsaKicT70b7v4a:zC7x/oj1QJDUDuGnoycT70bf
TLSH
T175A11A3364684C7788B6D585B5477F43CEB861BBE552AF84E8DD9E0C50BB8E81302627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 c57401bcba9bd28b87717fe49cecd727616e91097d4e294a4eafa60db64e2c1f
MD5 bc59c29a328091fdcbff19af32c414e2
SHA1 1d95bf3d3b79102c54d2f7ede35ea73da158d589
SHA512 9d1a452963dbf46cb480baff05be304dc1d7801f1a159208e6646aa3fd4f5752e822fd90f55a257bad86bd8e28f3a6494bc4a7a6f61046291d76718b4fdca7eb
SSDEEP 3072:dVVlIgAl8uOJ5emRrSbggIFY0OZtdqq9un6NRg:BGLlhO7emRrSbryFOZtdXw
TLSH
T161C312B37C602BAB25739A319C635B075C8D8CDF0A1ABB5E93DC0F26419E6C6491353A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 45edce470b7ddcf4a031de05e42244669148e7738d5f43d7dd5470a91e754a37
MD5 5097f51e2ff56b3b714d07e91df85bb2
SHA1 a2c054702f5ff0b46a79fe8fc501091ec7a04025
SHA512 e537edbe5721674cdf9319f21b26dc03a77fa2b88b5c1856e9ce4d4be257c55bd8f558068800264eba019138d5091998b8dc4c14ef7dfa2f1681d5310490e918
SSDEEP 3072:wbcVlIgAl8uOJ5emRrSbggIFY0OZtdqq9un6NRg:QyGLlhO7emRrSbryFOZtdXw
TLSH
T177C312B37C702BBB66639631AC735B076C594CDA0657BB6E83DC0F3641DE6C6092202E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 1c22670729e7671c509acaa3709926ad9be85c71ac1d83609a96dc90736f6f40
MD5 a79d58a296be0c50c1eb6bd90a3c1b57
SHA1 ec559381d0786efb379ddf7a499c114e106de818
SHA512 f96c778ce062178664c5dfedc2ec2fe7c6ce9881e44eb25e9ae413b028e98e4cabd436c7e9cb075a30f680a32cbf1ddf06730e2b9d26ada22e288ffc841dd8e2
SSDEEP 3072:dbcVlIgAl8uOJ5emRrSbggIFY0OZtdqq9un6NRg:xyGLlhO7emRrSbryFOZtdXw
TLSH
T17DC312B37C702B7B65639631AC735B076C594CDA065BBB6E83DC0F3641DE6C6092202E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6157248bb6f9dae96d5759da8678b2058a9a383f64199b6265363985f117cdb
MD5 d32f13d119638586ab4b7c3cc93d3a18
SHA1 3cf9f808af5d12e515f606acc090bcc509c6fe55
SHA512 309684eac17b9c3e37dc7af81285357e6d3fb58ed7a7ae35c30ee105fc932049c9e9b24477a27546ec4e557c2517d2a80e3e2c5d17b0cbdb7fbe4111a7b47601
TLSH
T1B5614DE112590276EBA781B090D12897B364F85E0A8B6F134CDCEC38694174A3EC254F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8fc81919650d3c0a4a97ee3ba684e81565c1e1f5f3c1245003612b6f26d6e8d8
MD5 5f4388eb8e621594166e32132b15b8b9
SHA1 aa28f9eb2a2a403558f4bf1c947910430fc9f015
SHA512 83fa2aebaa49674bfc96019e8477a24c48f86e0da8499b33cd07c18e937330868af3c02979a4961f71c2542b4c4b807fefaa933bfcf1b46d5fa4aaa5d6c8f279
TLSH
T17071AEF7C6E8866EC81156F0AB157E1BCE1D095883283D5AC9E4EF4FA3E2470E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f407c02b8b6d86b481821b8a447722d162cc4a7a8e0428aa927c66dee9de6dca
MD5 3bb9b8aa8ef50e5538901bebff28ea02
SHA1 a98f5d09afa50250bd3d77be61ad3959f9696122
SHA512 24b265554b27fd2e49d1e358b8c1091ca118150eb7f18095e58df7789ed756203a3f0f79283a4ac5f12496e2929c397559c9ae3eabbf1df22eb6a8eed2d26920
SSDEEP 192:sxRXR4yM/jK1Ml8wFR/fXsndhkgNkUPazoA8pOX4/g6+WNF67H/YZ8DGyIgDoCJ:sxRXWbR/fXsdhkg7f1/5I/FR
TLSH
T1EE62DA1696349977CCDBD219FA517B53D6F81473F2950E48AAFCCA0C04E6BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06398a8f7847557a029ba97885730b5a5d03dd0f5ab662332f100d9af03615c9
MD5 96bbf9a87fe903f37a78b5c2a2b22f55
SHA1 43d3a82d4d6ba871ba3b0631ca63dfd81502d513
SHA512 03a7fee8b8bbfad11dfffbd584c6590f1e17dc9f5d6e5453c3838210a4292b9ae2e2f7d75887863e09a97a4330a3286042be0a3ecff906bef433abff84ea2d09
SSDEEP 192:sxRXR4yM/jK1Ml8UQPFR/fXsndhkKNkUPazoA8pQX4/g6+WNF67H/YZSDGyIgDoc:sxRXWqNR/fXsdhkK7fv/5I/p7
TLSH
T13F62E816A5388977DCDBD219B6517B63D6F80473F2950E48AAFCCE0C00E6AED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 880393530986173fc42ddd2809f5f395f587d3cc7160c617aa1b1a61cb650131
MD5 348750af652fca67618d638bb18c4171
SHA1 d0cd968159fadcb3f5614783a3138d7e7d62a3f9
SHA512 3e25c1c4b71ff909454876cadff283ac049dc793be83dac442b1c7c40295bfbf9d5447977ab7fd5690482ff59d852f3a6d608692c3b40a6c21ab61db65956f5a
SSDEEP 192:sxRgR4yM/jK1Ml8wFR/fXsXdhkgNkUPazoA8pOX4/g6+WNF67H/YZ8DGyIgIJ:sxRgWbR/fXsNhkg7f1/5I/Fs
TLSH
T1DA62E91656349977CCDBD219FA517B53D6F81573F2950E48AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1fdb0e4a44b8d82931fd7ae4c011add7e62c65a9345909a479253c2594d8dcb3
MD5 bb4714b40bda3d7144fd2c0d1bb85b4b
SHA1 861659ece237c6b52ffcd197057b16ad0ed37b44
SHA512 ad9a423bc81f885de96382ac4e18981e02780297e1686943e97e8c42606c13dd4f66774951f8f7c1164385ef831536d6a24d560c11ebbd94e3934f7eb6b3fe77
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQMro7ov8nDgzy:eOEt7IWgKgf16u1jaZ/QX884y
TLSH
T1AAC2FB2F240CC77E4F844E6DAC2A6E976DD801CB9B988D5447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d44499720cff1837dd8a62795996963e298208572b60f5468a3013899afd39ab
MD5 6c26b193b0c7303bb38a0cf1b49ec7bd
SHA1 cfbfaf718dacf870a13f74dcd66ee195b14486c9
SHA512 f403190b9ce40e4fb6c8cf6b5ac1a64c2f35d01198ee74e661e0096b48dfe9d353f6ea3c812fcbfbcd34e1a84581b8fbf7ad1732eeb74a8b716dee2c51a02b3a
SSDEEP 96:Kb626j666m6k6A6U6gg6o656zu6u6gKm61u686gK6e6u6J6c6W6t9gzgwgtgpgLY:Cvlf1i
TLSH
T135918841B0B6230069BD6609C1A0962E874234F7315AE53B7B6DA5D22F67E002FFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f94a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f94a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 300b9cc54fd6b16eda68d6dc6eb388f71d46a2475e55a2328f38d2531a263fd2
MD5 37d91b3eeb0c8899143e16ffd39975d4
SHA1 b1b8d29d9d5c07aeb43d2033be8a7d9dca7d1c44
SHA512 24e7d3dc7b801971ebac9b2e42ce1497ed66c4bcb7602c1347861a8fc3f389bc1eeb22ba864744921466cf7809efa4f8bb55ff871daca1d26d9d2b796217a677
SSDEEP 768:ijaeqD4MlshiLdMmD3NU0YPfcOAfmfWUV5R4HTytYYqgHvPwGTT6:iqcjhIdME3NUHfkfmfvWTwJXS
TLSH
T1A403CF76ECB86CAB4CB2D685761337976EF44263C3C52B64D9CC1A0D06DBADE130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 084ab265ba0bf02cad7bdf11a662d584d35daa8ad842337dc70d788dfafed9eb
MD5 6f034ec747e5724bbcc1ffb7ca7a59bc
SHA1 8248593741f6b425b54365405767f60ef9d01c6f
SHA512 7c8414fb9fdebf71c86dced005b87325ffb1bb6bbecff42d02a1695a71949f62a7b1f5726837c42ef37258a097089f90929b5026e051c34e5f9d468fbd64c6c3
SSDEEP 768:uj+9/3xUkYPfcOAfmfWUV5R4HTytYYqgHvPwGzn12bfWSvl:N9/3xU3fkfmfvWTwJXByWSvl
TLSH
T1ACF2AE31ECA89D671DE2C6C57616374B7EE8866393C42A54C9DC4F0D0ADBADE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 217bcffa74d13205d15ed22ae6ad8b8d0b5bc5f1809bcf27e8f45963e6be2e59
MD5 6068af83631ebf3e2c5a23eb0ac0a0b7
SHA1 cecb26baa97f2ec8427bfa9a9d26b2f39f5b2284
SHA512 a25eb8aae769b28b45dfa1b5f43c19b0b63fb003f1e1b6cafb4c65072d9a0b8e2fa9c1f49c6427d933dd8385f19318e5da0bea2ed7cc51384090de383a87067a
SSDEEP 768:SFmj+9G3gwgjUeYPfcOAfmfWxV5R4HTytYYqgHvPwGzn12bfWSvl:c9G3QURfkfmfSWTwJXByWSvl
TLSH
T14E134AF298DB8976DDAE8787673D2E466EBCC263B2841550B7C8490CCD975BFC306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e29e0b18e425a0bb03f5064624299beecc61c095abce21f29ebdacecd2a8b591
MD5 4b0d9666d7f775110b4541f0baf5303a
SHA1 635afb2147ae20871a0d59d984d66bb62ece57ff
SHA512 259262cbad612e71ca83ca19bf21a3c3a778669a2838fcd804b8e2e6149705b46b34b2f8e29f907aeb438f1f51b111072138e91f9b3f6402785c485c11d88dc0
SSDEEP 768:Nj+913NUPYPfcOAfmfWUV5R4HTytYYqgHvPwGzn12bfWSvl:o913NUUfkfmfvWTwJXByWSvl
TLSH
T11FF2AE31ECA89D671DE2C6C57616374B7EE8862393C52654C9DC8F0D0ADBADE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 71114adec9054b54063d7691bbd4c20fc90335c9d5ae3df8f6e7a22dbe24e228
MD5 365c81195fd8e7c27fe6e2ddc13bf408
SHA1 834111d9dbed8e1f6579cb7c5495faf137956e58
SHA512 66ca88445005403e23772c3960eb5a4a2c4b5110b2b9a95659c096f0cae84630e094e39f533d6a6763918a5d30101518938cad68ffda8ced6345b7be7fc4e32a
SSDEEP 768:EjaeqD4MlshiLdMma3HiPfcOAfzV5R4HTytYYqgHvPgKyjWtxjTo:EqcjhIdMh3Kfkf3WTwJDyj2y
TLSH
T1A103D07AECB85CBB5CB29685770277976EB442A3C3C12B64C9CC5A0D059B6DF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bf0ee859bd84afb86da92c73d00ffe069f015efe4c967b141975ab7f7c2d340b
MD5 192b4b30063d1f5000868a1dbafd85ad
SHA1 07ea4ef248d849020238cee59744dbb243e637d2
SHA512 c6ca9c50535440a92ec4b71f653c8a5ef82f0d914270f1dc86c8c31f421d8d537a5b8cdf88accac2d0dd19a5807ed038290383133300743d778ec86772e4dbbd
SSDEEP 768:8j+9/32UkYPfcOAfmfWUV5R4HTytYYqgHvPwGzn12bfWSvl:b9/32U3fkfmfvWTwJXByWSvl
TLSH
T116F2BE71ECA89D671DE2C6C57616334B7EE8862393C52A54C9DC4F0D0ADBADE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e1b5cf5-61d3-4cc8-8b12-4c4352ba8eed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e1b5cf5-61d3-4cc8-8b12-4c4352ba8eed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5324_552340254\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download