cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
Size 3.4MB
Sample260627-jt4snshw21
SHA256 cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351
MD5 193177af43f8f24851b76d2866a11e1f
SHA1 688f4b4ecfd26d2529d2c1b21a9d8be2f3245cc8
SHA512 3cd1a5e85228daabc4cfda12c15618662d6f8aa1a9ac8a23f6fe9a14a8a90481ec5d30fd865be5665a35b46c648adb4dec2cb83294b005fafc4691900c2f09c0
SSDEEP 49152:22iJZwXnx3m3T493uZrZcwcJ8JJyBmg+psJmMrqfFqj8EA2Y9dhu4/fg:26G5sBcsJHqYA2cg
TLSH
T1E0F58C07BDE048E9C09A933189B791A97B75BC090F3623DB2E90A7B82E773D05D35B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 5588 created 4268	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	89
PID 5588 created 3176	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	90
PID 5588 created 1532	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	91
PID 5588 created 2260	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	92
PID 5588 created 5832	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	93
PID 5588 created 4404	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	94
PID 5588 created 2376	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	95
PID 5588 created 4268	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	89
PID 5588 created 4268	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	89
PID 5588 created 2260	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	92
PID 5588 created 2260	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	92

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_836318325\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_836318325\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1878264570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1878264570\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_944958745\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	chrome.exe
2360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270207447629201"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{3ED884C6-DF76-4A1E-AF6F-0F51E8555C0B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
4268	chrome.exe
4268	chrome.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe
Token: SeShutdownPrivilege	4268	chrome.exe
Token: SeCreatePagefilePrivilege	4268	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4268	chrome.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 4268	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	89
PID 4268 wrote to memory of 3176	4268	chrome.exe	90
PID 4268 wrote to memory of 1532	4268	chrome.exe	91
PID 4268 wrote to memory of 2260	4268	chrome.exe	92
PID 4268 wrote to memory of 1532	4268	chrome.exe	91
PID 4268 wrote to memory of 5832	4268	chrome.exe	93
PID 4268 wrote to memory of 5832	4268	chrome.exe	93
PID 4268 wrote to memory of 4404	4268	chrome.exe	94
PID 4268 wrote to memory of 4404	4268	chrome.exe	94
PID 4268 wrote to memory of 2376	4268	chrome.exe	95
PID 4268 wrote to memory of 2376	4268	chrome.exe	95
PID 4268 wrote to memory of 3724	4268	chrome.exe	97
PID 4268 wrote to memory of 3724	4268	chrome.exe	97
PID 4268 wrote to memory of 3300	4268	chrome.exe	98
PID 4268 wrote to memory of 1884	4268	chrome.exe	99
PID 4268 wrote to memory of 3644	4268	chrome.exe	100
PID 4268 wrote to memory of 1884	4268	chrome.exe	99
PID 4268 wrote to memory of 3644	4268	chrome.exe	100
PID 4268 wrote to memory of 552	4268	chrome.exe	105
PID 4268 wrote to memory of 2116	4268	chrome.exe	104
PID 4268 wrote to memory of 552	4268	chrome.exe	105
PID 4268 wrote to memory of 2576	4268	chrome.exe	106
PID 4268 wrote to memory of 2116	4268	chrome.exe	104
PID 4268 wrote to memory of 2576	4268	chrome.exe	106
PID 4268 wrote to memory of 6040	4268	chrome.exe	107
PID 4268 wrote to memory of 4504	4268	chrome.exe	108
PID 4268 wrote to memory of 6040	4268	chrome.exe	107
PID 4268 wrote to memory of 4504	4268	chrome.exe	108
PID 4268 wrote to memory of 1084	4268	chrome.exe	109
PID 4268 wrote to memory of 1084	4268	chrome.exe	109
PID 4268 wrote to memory of 1736	4268	chrome.exe	110
PID 4268 wrote to memory of 3064	4268	chrome.exe	111
PID 4268 wrote to memory of 1736	4268	chrome.exe	110
PID 4268 wrote to memory of 3784	4268	chrome.exe	112
PID 4268 wrote to memory of 3064	4268	chrome.exe	111
PID 4268 wrote to memory of 3784	4268	chrome.exe	112
PID 5588 wrote to memory of 4932	5588	cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe	113
PID 4932 wrote to memory of 4648	4932	msedge.exe	114
PID 4932 wrote to memory of 2360	4932	msedge.exe	115
PID 4932 wrote to memory of 1088	4932	msedge.exe	117
PID 4932 wrote to memory of 1088	4932	msedge.exe	117
PID 4932 wrote to memory of 4744	4932	msedge.exe	116
PID 4932 wrote to memory of 4744	4932	msedge.exe	116
PID 4932 wrote to memory of 4744	4932	msedge.exe	116
PID 4932 wrote to memory of 2920	4932	msedge.exe	119
PID 4932 wrote to memory of 2796	4932	msedge.exe	120
PID 4932 wrote to memory of 2920	4932	msedge.exe	119
PID 4932 wrote to memory of 2920	4932	msedge.exe	119
PID 4932 wrote to memory of 2796	4932	msedge.exe	120
PID 4932 wrote to memory of 2796	4932	msedge.exe	120
PID 4932 wrote to memory of 4444	4932	msedge.exe	121
PID 4932 wrote to memory of 4444	4932	msedge.exe	121
PID 4932 wrote to memory of 4444	4932	msedge.exe	121
PID 4932 wrote to memory of 4272	4932	msedge.exe	122
PID 4932 wrote to memory of 4272	4932	msedge.exe	122
PID 4932 wrote to memory of 4272	4932	msedge.exe	122
PID 4932 wrote to memory of 2660	4932	msedge.exe	124
PID 4932 wrote to memory of 2660	4932	msedge.exe	124
PID 4932 wrote to memory of 5340	4932	msedge.exe	125
PID 4932 wrote to memory of 6116	4932	msedge.exe	126
PID 4932 wrote to memory of 5340	4932	msedge.exe	125
PID 4932 wrote to memory of 6116	4932	msedge.exe	126
PID 4932 wrote to memory of 3176	4932	msedge.exe	128
PID 4932 wrote to memory of 4460	4932	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe
"C:\Users\Admin\AppData\Local\Temp\cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ff9e6cac728,0x7ff9e6cac734,0x7ff9e6cac740
    3⤵
    PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,11246196253348054475,11135103428373851281,262144 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:1532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,15204406103816944118,2221138857451669945,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,5328174221549716557,10813163194539549914,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
    3⤵
    PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3000,i,17934320605796592998,3336030739500387473,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,4914026064596140903,4774765108860337367,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,12464797966667531341,11591301215974802544,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,4724270236326323517,4817278577984177701,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,3658315200252973877,8182165834935154127,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,11189168269303752068,2877788906545159695,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5772,i,13316043716829069164,7943853411929122566,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,1043513981816623409,2036621744435442804,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=2964,i,15417539551457830105,15164709450334039137,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4732,i,14549275340080535742,5236365051187577454,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,15839161093601215457,7060874888706509177,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4788,i,4908936671844868748,3985065102255344095,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4724,i,18040968501752256785,12599302452871568175,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5484,i,3246893559088010255,16105759890838448275,2097152 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,8522488455928237398,17296828154718156143,524288 --field-trial-handle=1936,i,6530828086073007238,3179123062490650595,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff9d6fac188,0x7ff9d6fac194,0x7ff9d6fac1a0
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,5899762334724227227,17508524224705203062,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1564,i,16159536531386099660,8461341982934994666,262144 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,13148773532123630532,7261392095136008420,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,7785050821070111082,8763629953576881930,2097152 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,2131582258384716417,17785847553418890459,2097152 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13047807023393093848,9397149431097688498,2097152 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,2458206719068675292,8054305967672465856,2097152 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,5515234130578104942,4502233643963693595,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,17943649523939992802,9020197898510782563,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8424902229392557429,14593362285415831086,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,641613551864424024,7554212362915038092,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,641613551864424024,7554212362915038092,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,3407402552464518410,18261694094882926602,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,14402117674346415605,17193431037459090503,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,3807580878538480267,2941686731959864748,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,280938647854794662,13034860448206100793,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,11521423729744136641,10757856909862622154,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,16046203813161124819,13974903384237241456,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,10798995626367924704,14840030679106042327,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,5089240225059529970,5295129457249103488,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2573834120069773865,6162755042992680165,524288 --field-trial-handle=2324,i,1491227145153868813,2254105036240802184,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:1340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 49a0b19ca610e96781df74591ac4ec113df7ed8d020bb9b9a5baf9fad51128ac
MD5 24bcbff8467fc6920d45905bbca6b49f
SHA1 c5174a960a86a1bd0f44e6cf8f34b567126fa4c7
SHA512 2194db66f8891b9a1d596d8eca28e2b7015e19e64093852bd02ba2d40a3aa1b720b0b31499d8a236e2c4952d19f335381f475d30403af38c4b58475065d9b064
SSDEEP 192:7RWaLL+v7+vAPRp2O9mHsb+WNnX/Pim2DewOVyIsnAUgR:7RWan666XFQwvP52eR
TLSH
T1A932852EAE24653B5CCBD71AF961B753D6F5102131D42E84E7FC8A2C15EB9CC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8fb05b0334d112d32df99ab9b5db92a425351aec7fcefb094fa946a894be03fc
MD5 05d426c049103690f573a136c41ff0aa
SHA1 fb52c5903cc8cb6edf92b4cd1cb9c6e3fd4e377d
SHA512 bbb229ef2c41a56b43be2e6c43d7e0f406317a6de1ed7a933fd3a90a06deaaec80c9c41264563504fe886aeaff1cbc7338ee28b83a65bf8f6aa27578211cde46
SSDEEP 192:e8z4K66Q7KxkXqK4I40pUZNCgVLHrKHfFKslEx0kSXzKD/tQ+ErUkKN9Zo8CUXQc:ZzjlQ7KxkXqKf/pUZNCgVLH2HfgslcP3
TLSH
T1C332E827A58D9A7F0FD8E90DCC526F8B6CB4019677680C2492FF9D0403A5BCA110E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0ded450cb1999c0163f723527211bd86fca183842a36770f1b673bb6cf7e91e7
MD5 f951798da0f6c952445c33dc6203764b
SHA1 1c2d4ac96ba51671a64dfdc8351b0de297c4e29b
SHA512 0632e3bf38db3eced1d53fd4fad68fc20760aedb19af0f941a6c691d59d5f6526304390816ea94e6c6f9630749d7080f19b7db978bc028da49b93d592a751563
SSDEEP 96:4C0d+kaO2Zqk3kfIbEOERDotok5PvDDB6iGyv0mEEshTmbx4+v4a:4C0PGZqk3fYNDUDjdWmErhTmbx4g
TLSH
T1FBA10B32646ECD779471E6C6B5822F03CE686167A5929F84E9EE4F0C21A70EC1386627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 80e4218e011feed46c7d8b4616afe8b6a6802ab9fa9d05f82eb1d96f0d1ab7b0
MD5 f05454948992d9737a012b4afcff7f8a
SHA1 86a5e3560c96b1b40a38796be6643e4cebb8cae2
SHA512 24c4d7c3cf596dad82956f901b085523a34c0485d7a021daee2198874878d31f3766c5231bc3c4a213fc67266a8acea585b6db13a35e22bc4aa3d8f4eb9535c7
SSDEEP 96:aC6Gd+kaO2Zqk3kfIsEOWSl8h4otop5P/DDB6rGyv0mEcAhMlQTE0j9IpqoT3ALF:aCpPGZqk3frPiU2TdXmEcA2lQTEUOqog
TLSH
T184C11C72A8ADDC7365B2E781B4432B43CEA4506BD5569F98E9EA0F0C11D70ED1387623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 819fa067757385877e5db59c5864c2bcefa2845bed62c2705ac424b1085e41f2
MD5 16d2bd97f5ba4b5ad418fe2c0d1a5471
SHA1 d35757e92c5d7e2d164a8c892f82487c2efea707
SHA512 78ebceda76ae130480842a78593ecd54afaf6cd0815a0c3a93b95473c1ecc773fc1bfc0ed0ef95b94d9569464ab29e28bff91b840d9e06dff1ff9bec9cca16a7
TLSH
T10F610BD69C5109A6EF261339CCE228DA3BB00A3FC90F2ED55598E138BB5AF12DCF1054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf6e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bf6e.TMP
Size 3KB
SHA256 36f049a083270883c6e2d5ce12688eb99aec3b3728192cd86d81979a42acd595
MD5 60cfb706b03f7ecb8f6e65e5b0b60359
SHA1 02190472efc678799c9af57f31fc68ec1308ac10
SHA512 1dfcfd5f96795ca05971c58142d65ec2a6de39c8ce1600bad8cc9e2a92d4c5a2c7aa06026b31ce9bebca97650d1c93bfe6fa64a67ee2610d9da2592a5c8b774d
TLSH
T1BA612DD59C5109A5EF261339CCE128DA3BB0093FC94F2ED55498A138BF5AF12DCF0054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f90bfc614f314da6b8025572604fc635a32cf62d02c80121ba11506508a8bf5
MD5 7f182be5b7ed7d266d6f6d66451e1452
SHA1 217a10eff753b2359032c9b683aa224e3a9a8d97
SHA512 6914b4c30f48247ec13650f9581e72fc2779d23b81801b97b8e2c365cdfd28eceae982ade835c81c50ffa6c8d1289d3ccf9f19cacc45d1d91bee491fb11cc62b
TLSH
T128417CF3C6E8856E890156F0BB146E2BCE2D0964832C3D5AC9E4AF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dfc5607402225225aac05ad53657123cb80c7e8cead93a9d4646af033ab395a9
MD5 02efab20599a3d26f49689c2ab720e1f
SHA1 ad4983a0eb782805aeaa3a5dfd1fe450ae04a806
SHA512 a379458a9a7abfa72fd0df2db754cfe70621555ab16f5c418b895b278940fe44637495124b6bb8d8ab73a6c04f5c755c5c056fd261aa34062004683f93066ec7
SSDEEP 192:sxR5ROGyM/jK1Ml8wcY/f5sXwC4ZHzoA8pi/g6+WNIY4pjcGvIgDXpJ:sxR5lCY/f5sXDGui/5Ilf
TLSH
T1B662DA16AA3459778CDBD20CFA517F53D6F81573A2901E44AAFC9A0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4a85f1fe6b83c24ec8cc31bece77df4b06597632c7ca3cbcdc238b436d7b9a36
MD5 a57eac1d100c60fb2325106482e33776
SHA1 71fed9983bfcceffcbff697cab0631db62248a90
SHA512 b1ab4d50f21b2cea9059b46f4c024e52ff04b977ade374168668e9019009bfe02e247556a6add8c63f7362d34e22b686e76b930e520e00a7dc577a714e1bf2c0
SSDEEP 192:sxRyROGyM/jK1Ml8wcY/f5spwC4ZHzoA8pi/g6+WNIY4pjcGvIgVpJ:sxRylCY/f5spDGui/5IlJ
TLSH
T1C252CA16AA3459778CDBD20DFA517F53D6F81533A2901E44AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 250608a8addcb720ce3a63e90a90028a94511922317ae46010344e34f1c60e7c
MD5 90dd4b71eb5021eb1bc07d5a393877fc
SHA1 77e15c1074aee188fe34576722ef640b4e119b2c
SHA512 ca7c2ce5ecea05ac0a667edb869a7d2fd540c86c2616da8852985af73020a2bf02e93af260b4b10533485ca96d6b692188fbe2b6d5da2ab54d3de3b725bfffb0
SSDEEP 768:Nmymu/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpcwLxgKroRLFwt:Nmymu5E7YpWgvHfSvu1ja6cwNghRLFv2
TLSH
T189E2EC3B680CCB7F4F844AADEC29BD9A6DD801CB5A98CD5447EA840C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 06e84b94c2f06fcd497b37315e79d287f88a5016ed2d3f4a5a36999952c43036
MD5 be91ce337a6d69dfea8de98b305bfd26
SHA1 f51f7e610bc44077af3e74dd263b8b4c3f50e8c2
SHA512 970f231a6153d809e7ea3c6b4b0885a90425eaa769a12ffa869bc2938a62104448c4d4d222ad51e9e7955ac1113aaebb2141223221b55016d67f77a53d725beb
SSDEEP 96:KIJ+KKcqon0LHBZJ2/ZG9JH2KRTJV2lPnOFtNSKe0i1:kNon0LHBZJSZGHHXTJV2PnOF0l1
TLSH
T189919441397A6300387E298C84B28D6F1A4570777517A47B7BBA29F11E2FE005EFD9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 99f3b388b2c572f4c905bd88f171910654a9bbaf834ebd8e6f5c91e5026e5f28
MD5 6b28f97189b2deb2baee656f32e6fe29
SHA1 fcd520cee2caf916c02bd41b82ca086da9c14742
SHA512 8045acc670303de31d47cd9a7fb8ae7511399db4d238e42719e9e6d38ab0de0211ea1e11c688b8335d29cf0000bd6ddb532d74d7c143503576939453756b0288
SSDEEP 768:xj+9h3DCDfyjf2M8fCRA7NpespIRM0UmkTziwjgzSnwn12bfI:s9h3DSfcfEfhQsZ0UmYHKyI
TLSH
T14DF2AF31D8205E738DF6DE8E6A07774BAFE0025391C42A84DCE99E4D45C369C271BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 20c1e9b0bf66e0d166fde1a9ae37fdf090c1079ce253945a37a9a68c7b0c4d87
MD5 02691f7430987812e4c2cb6c1d650e51
SHA1 31201fbc7b6937c8c5ea40ec59408deea56e985d
SHA512 6f52d5132e9356d217a74f14ba11bccef9db3088f3dee6b5d4f91170a8abadf23577e6f774e1d93dda31686938d3a1b428f15105a9b32d6bb46993b8db38cd62
SSDEEP 768:KF1j+9a3gwgkCXcfyjf2M8fCOA7NpespIRM0UmkTziwjgzSnwn12bfI:P9a3t/fcfEfsQsZ0UmYHKyI
TLSH
T142037C32D860DE67ADF7DFCA6A06774BAEE0026381D829D4DDD95E4940C32DC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 29343d61e11aee7ce31557a5945333fe71909a79e0b97fe46f4dbb85cb132afb
MD5 ff80153982e7545be44cc8385e7b04da
SHA1 237709efbea70beb1f74bc459933763d3427340b
SHA512 3bc6d0179a5cbb7afaa61eb6f2c583b42ea97dc00774a8200af191e329dde2c8bf8dfdc0691b45c004fb2be11686683043ba91617125794aba227ae17769ae13
SSDEEP 768:3jaeqD4MlshiLdMmf3+Nfyjf2MUA7NpespIRM0UmkTziwjgzG8nApXLPQTU:3qcjhIdMo3UfcfBQsZ0UmYEnKXD
TLSH
T18A03CF76D8205DB78CB7EA8A264376576FB00253D2C43AC8DCED6E0D42932DC670796B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3c5281b95c36c6ce04f047fbb7d55c8dd392200d3b7ab73d907905a6b7f2c5bf
MD5 5145de175c4306c712f9483f4accc305
SHA1 142afad616c57167b67e85fea96efceac1caeb68
SHA512 07a16de99081911b005acbb62f6406c65d6a388bd8d4f217233b8633ad871339b89a8738c63a1cf3d40ebe50b28e877ed1766b52e4c9e33003beb1377839e66c
SSDEEP 768:pj+9h3SCDfyjf2M8fCRA7NpespIRM0UmkTziwjgzSnwn12bfI:09h3SSfcfEfhQsZ0UmYHKyI
TLSH
T114F2AF31D8205EB34DF6DE8E6A07774BAFE0026391C42A84DCE99E4D45C369C271BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e565a27b-ccf2-4144-b1a5-31fe3585e42d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e565a27b-ccf2-4144-b1a5-31fe3585e42d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4268_1800987325\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4932_2145479645\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5588-140-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-181-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-138-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-136-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-135-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-134-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-133-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-132-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-120-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-119-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-118-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-117-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-109-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-107-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-106-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-105-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-104-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-103-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-102-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-90-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-89-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-87-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-80-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-79-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-77-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-76-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-59-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-58-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-64-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-45-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-180-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-172-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-139-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-147-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-150-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-151-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-158-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-159-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-164-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-165-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-166-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-167-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-1309-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-152-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-121-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-116-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-91-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-81-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-75-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-57-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-66-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-44-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-17-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-16-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-5-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5588-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download