hxxps://google[.]com

Analysis

user interaction
yes
max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://google.com
Sample260705-e39m3ahv7v

Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan upx

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 2 IoCs

flow	pid	Process
285	1584	msedge.exe
371	1584	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4632	Service64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Acer NitroSense Update = "C:\\Service64\\Service64.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
283	raw.githubusercontent.com
284	raw.githubusercontent.com
285	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "c:\\Service64\\blood.bmp"	reg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000244d2-1036.dat	upx
behavioral1/memory/5508-2161-0x0000000000400000-0x000000000132F000-memory.dmp	upx
behavioral1/files/0x001200000001b6e5-2193.dat	upx
behavioral1/memory/4632-2198-0x0000000000400000-0x00000000012E3000-memory.dmp	upx
behavioral1/memory/4632-2217-0x0000000000400000-0x00000000012E3000-memory.dmp	upx
behavioral1/memory/5508-2218-0x0000000000400000-0x000000000132F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HorrorBob2 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276993557257198"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "213"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7FB3AAD1-2233-4440-8894-ECA974BF6445}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{EB79F6D7-BEFA-44BA-80E9-CC4AA86B844A}	msedge.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5856	reg.exe
5972	reg.exe
3048	reg.exe

Runs net.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5536	shutdown.exe
Token: SeRemoteShutdownPrivilege	5536	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5824	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3552	4556	msedge.exe	85
PID 4556 wrote to memory of 2348	4556	msedge.exe	86
PID 4556 wrote to memory of 1584	4556	msedge.exe	87
PID 4556 wrote to memory of 2348	4556	msedge.exe	86
PID 4556 wrote to memory of 2348	4556	msedge.exe	86
PID 4556 wrote to memory of 4732	4556	msedge.exe	89
PID 4556 wrote to memory of 4732	4556	msedge.exe	89
PID 4556 wrote to memory of 3340	4556	msedge.exe	90
PID 4556 wrote to memory of 3340	4556	msedge.exe	90
PID 4556 wrote to memory of 3340	4556	msedge.exe	90
PID 4556 wrote to memory of 4352	4556	msedge.exe	91
PID 4556 wrote to memory of 4352	4556	msedge.exe	91
PID 4556 wrote to memory of 4352	4556	msedge.exe	91
PID 4556 wrote to memory of 2780	4556	msedge.exe	92
PID 4556 wrote to memory of 2780	4556	msedge.exe	92
PID 4556 wrote to memory of 2780	4556	msedge.exe	92
PID 4556 wrote to memory of 1728	4556	msedge.exe	93
PID 4556 wrote to memory of 1728	4556	msedge.exe	93
PID 4556 wrote to memory of 1728	4556	msedge.exe	93
PID 4556 wrote to memory of 3880	4556	msedge.exe	97
PID 4556 wrote to memory of 3880	4556	msedge.exe	97
PID 4556 wrote to memory of 3880	4556	msedge.exe	97
PID 4556 wrote to memory of 4400	4556	msedge.exe	98
PID 4556 wrote to memory of 4400	4556	msedge.exe	98
PID 4556 wrote to memory of 3404	4556	msedge.exe	99
PID 4556 wrote to memory of 3404	4556	msedge.exe	99
PID 4556 wrote to memory of 3252	4556	msedge.exe	101
PID 4556 wrote to memory of 4832	4556	msedge.exe	110
PID 4556 wrote to memory of 4832	4556	msedge.exe	110
PID 4556 wrote to memory of 4832	4556	msedge.exe	110
PID 4556 wrote to memory of 692	4556	msedge.exe	111
PID 4556 wrote to memory of 692	4556	msedge.exe	111
PID 4556 wrote to memory of 692	4556	msedge.exe	111
PID 4556 wrote to memory of 2720	4556	msedge.exe	112
PID 4556 wrote to memory of 2720	4556	msedge.exe	112
PID 4556 wrote to memory of 2720	4556	msedge.exe	112
PID 4556 wrote to memory of 1836	4556	msedge.exe	114
PID 4556 wrote to memory of 3388	4556	msedge.exe	115
PID 4556 wrote to memory of 696	4556	msedge.exe	116
PID 4556 wrote to memory of 3024	4556	msedge.exe	117
PID 4556 wrote to memory of 3024	4556	msedge.exe	117
PID 4556 wrote to memory of 3024	4556	msedge.exe	117
PID 4556 wrote to memory of 1504	4556	msedge.exe	119
PID 4556 wrote to memory of 1504	4556	msedge.exe	119
PID 4556 wrote to memory of 1504	4556	msedge.exe	119
PID 4556 wrote to memory of 4572	4556	msedge.exe	120
PID 4556 wrote to memory of 4572	4556	msedge.exe	120
PID 4556 wrote to memory of 4572	4556	msedge.exe	120
PID 4556 wrote to memory of 1212	4556	msedge.exe	121
PID 4556 wrote to memory of 4856	4556	msedge.exe	122
PID 4556 wrote to memory of 1212	4556	msedge.exe	121
PID 4556 wrote to memory of 212	4556	msedge.exe	123
PID 4556 wrote to memory of 212	4556	msedge.exe	123
PID 4556 wrote to memory of 212	4556	msedge.exe	123
PID 4556 wrote to memory of 2688	4556	msedge.exe	124
PID 4556 wrote to memory of 2688	4556	msedge.exe	124
PID 4556 wrote to memory of 4296	4556	msedge.exe	125
PID 4556 wrote to memory of 4296	4556	msedge.exe	125
PID 4556 wrote to memory of 4296	4556	msedge.exe	125
PID 4556 wrote to memory of 5424	4556	msedge.exe	126
PID 4556 wrote to memory of 5424	4556	msedge.exe	126
PID 4556 wrote to memory of 5860	4556	msedge.exe	127
PID 4556 wrote to memory of 5860	4556	msedge.exe	127
PID 4556 wrote to memory of 5860	4556	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11482573357499844989,10866575183025368009,262144 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,9644928570302654126,6863294250339410435,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,16545187696855634752,13389400838614232203,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14234298948275943506,3108417897264234451,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2904509384016727276,7623918680157166765,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4060,i,10092161862893324964,14098393245743499367,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4072,i,9253569921394435250,11060508305263070151,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4940,i,1968336623654762447,5753197399445823305,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6546342293578389346,4731033125220605060,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,11608882636849225743,14893688607297950502,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8305725983431254008,12787757700521518365,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8305725983431254008,12787757700521518365,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6240,i,16682262893494207754,5416459569314877532,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4724,i,16417342101451297223,1024766873102248543,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6344,i,10731138933928600507,14079043295319201162,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,4762892179238830540,17372843732764130710,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,15483778912316997343,14948920902494051089,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,5370896260291507707,17914678192019824030,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6288,i,16634068881143063666,14758500020075197620,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6396,i,6078658652866199939,16679214817613587348,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5204,i,17862565752876907228,14568403696049860486,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,15689411307513767212,15182704180681096770,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,415962703657898310,3605533573441128458,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6468,i,15782177358589421793,153374856486952457,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,16573745853207391701,4574208458692050564,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5088,i,12452443889989167851,9062513539398546991,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,3602968422333211557,13720994274642782048,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7224,i,12138777082442197456,6680149668591570049,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,13021506226778077355,8673052082401997828,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,6351335555602168440,10865567762609706151,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4756,i,13213622729274849004,18023795165566502103,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,3753267091126914885,10925930457120991891,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,15177066100994629706,708721452105213269,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=2812,i,10059314428382120029,10135705078845324456,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,17816488814271845042,857961679042902683,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,17816488814271845042,857961679042902683,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7348,i,13084630693233597581,6096400143547577827,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=772,i,15659075342317548266,3669333704443495438,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7336,i,18004889782200974272,13483542371970876893,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8100,i,10417675348795118832,3641790273787372626,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8320,i,7258862452269479468,7802604527825351258,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8464,i,17049767991727618132,13067591282561128050,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,17704418447855864099,11223795675338937334,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,17704418447855864099,11223795675338937334,524288 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7348,i,4651306653123360452,3976872847179783155,2097152 --field-trial-handle=2192,i,5272097971739849055,13445190411453503394,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Users\Admin\Desktop\HorrorBob2 (1).exe
"C:\Users\Admin\Desktop\HorrorBob2 (1).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BA6D.tmp\HorrorBob2.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316
- - C:\Windows\SysWOW64\cscript.exe
    cscript prompt.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3184
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5856
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\Service64\blood.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:6064
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5936
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5972
- - C:\Windows\SysWOW64\reg.exe
    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - System Location Discovery: System Language Discovery
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3048
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Acer NitroSense Update" /t REG_SZ /F /D "C:\Service64\Service64.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5700
- - C:\Windows\SysWOW64\net.exe
    net user Admin /fullname:"SPONGEBOB IS WATCHING YOU!"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin /fullname:"SPONGEBOB IS WATCHING YOU!"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 00
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536

C:\Service64\Service64.exe
C:\Service64\Service64.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390a055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 21KB
SHA256 13753756eab1db0b2faee0c9e28a8c714420894e44f84e5aaa3add52038e1558
MD5 4325f31b2686a18064a87fc67d92419e
SHA1 03806612e3ae66081550a53b15898c828f8a8123
SHA512 e649db13657d5f890ab079b2cab1bf2401cb6453695ae3406959942fec4d1ccb1d1a182f5a74d9b04593dfd2760842d71925b45ca6e31f82d610f503ba4a420a
SSDEEP 384:MOj2yWOv/5p+u0oISA+49i8yVS7y186STDMrnWjw8E6UXsWo5U6yYgKA83VaI:MSWOv/5pn0/Soo8yVS7yuzDMrT8ptWo/
TLSH
T1EEA2F1A33B4250F2C2E970911955B22A7B07DD16DCEB7A4BE3CA3D7A0E47101B46717B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000136

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000136
Size 131KB
SHA256 1ab7375550516d7445c47fd9b551ed864f227401a14ff3f1ff0d70caca3bd997
MD5 bd65d387482def1fe00b50406f731763
SHA1 d06a2ba2e29228f443f97d1dd3a8da5dd7df5903
SHA512 351ecd109c4d49bc822e8ade73a9516c4a531ebcda63546c155e677dcff19708068dc588b2fcf30cad086238e8b206fc5f349d37dda02d3c3a8d9b570d92e4d9
SSDEEP 3072:yC1uNIhRRMavV44UAh1fwNoDiAG7BNS0O6WBHMz/:UehRRtv24UAh8oDvMg0ORBH2/
TLSH
T16BD37C00B0C1C4B2D5B5193118B5FAA64E3DFE740B249EFF77D81A6A4EB41C129B396B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 61545b5362c2557975befe818b129e63002710866c206a97c8708f7fe2c0390f
MD5 464b890a8ee4008e4596e8062df20212
SHA1 e789fd7ece7d7f5af5e54eea6e4d58fe2e34c93d
SHA512 01e98e62604a078f44d83f55f611407d66ed7a90b29b05f875584b0d12b883b7d4fd852cd0f26b4944e452e6607d84359a90e083a2ae6bcbec41b4cb39379a1c
SSDEEP 96:cGnt972o1RpvVlHR4A/M+fkMYibYb96XuoKtnBmxoOW+sUL9PNXtCNDf:P972o1RpNX4AVkMuMStnBmx9sS91of
TLSH
T17F12B4480F8190DACFA68531C0FA976131B46782867BEE1A8B08C47DD63EFAF4D9530C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59290a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59290a.TMP
Size 3KB
SHA256 c46d7f896596665170ea5488257814f3921db6373168f58c401fe3237423ef19
MD5 6bb83794e966cd1fb44a5a34f1bc8565
SHA1 7335f61554604046757683fcd1a62b8af52e94f8
SHA512 c015f5db77abd9a35e43be4193c66d50d6a312c9b9bab9374e37808a7ba20911c04894708ae5cf4d81c9617989c940fc9782754d954f93691e556ce974269594
TLSH
T19E61F9190E05549DEFD31631E5D123B83AB4B3978A8FBE5A421CC8BD6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

63f4c575-e06b-44da-ba6c-51b9a0dab680.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63f4c575-e06b-44da-ba6c-51b9a0dab680.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 b074697584feb44f367563ef6443e95a4d9c9d331835267554426d5b2d548970
MD5 2b186b832c155adde90d37015769d50b
SHA1 0d2b1533bc712d542b812b4201f0a727f1e41ba7
SHA512 302c8beb6f43bad7a0fcf1e3184a76501ca5a2922c3fd20feab61be38aa2a72fc6203c9126159a20ddfe37b85104ddba15e2988f6ab56e4fc04ba8debc144de6
SSDEEP 384:DrlU60Wg6LMJQWJfMcmAPJebsmYIW1ZA3YoISqPqVa5d1nPhIcIMrDDr/Y3n7aN1:ANsY+xn2JrspGqQ8/iH
TLSH
T193529BF7C3D8812DC91256F8AB15AF1FCE191928431C3C6A84D8BE5BD3E2871E21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ee581954c8c8b7b081dddff0100f31ec3bdb73348c0b2fdbfe8752332dd73140
MD5 e81c8356d44e37b6ded34d3a0de5f303
SHA1 6ee5387c39bd900b8c4a0e12997ac3043d944388
SHA512 a28da01d616cd361743d1e34caefa7a011c0e13efdef7d91eead3038287a20cd0d87691d5c9f0bb0ab982be6436e5654306caa49f36d0983ca016bc529ee491e
TLSH
T192D022A3328030B6AA6E3EAD646AFC8FCB3720244843EDD810D0A99C193986C4E1B542
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59a84c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59a84c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6646e0bdf25629fd5b6ebdca5d38421c2bbf5f0bf07da0d9981b137903636027
MD5 0a36a81c4101f0e50cd3073d5617c37a
SHA1 574ac9554d6b3dfefc8c9de89885c7d1507af790
SHA512 9f04428e070ba9be89ef52bfafcefa18aa40b5958270e96ed8ac307d6bc33ae573b84a9a6ec114b91602c8f8224394289e180b6b41f3471a68a788a1a7928ada
SSDEEP 192:sxZaRVyM/jK1Ml8Mk//f1saTEAYIdpqD3HW6+WNrYX/YHRrjRIgrJ:sxZa7M//f1saPp6HbU/W9
TLSH
T16B52E9126A3499B7CCCBD609F955BF53D6F51572A2900E48A9FCCE0C05E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 93948f593c34bcefc729d2be0aa14f85f5d875d9c7710caa19d2f925dc1df880
MD5 2c36ce995b206a1d214a7b2762ac2803
SHA1 50dabfa569575586582e6e341eb46edc8d34bb56
SHA512 1eefa60403ca2ba6533dc7926738b23e43906da42e9ec11689c0d2dbf2fef869c4db3f890c1c4f869aebfe0fa734666ba99f959a981c5d73fd1ee5e6272a65ba
SSDEEP 192:sxZrDUkVRVyMojK1Ml8M0cB4//f1s2TE/4/VkbLZpddpvuxS1qWy5HW6+WN1XBiY:sxZskVOsm4//f1s2kCYRAHblJZXt+vd8
TLSH
T1A392F853652449B7CDDBC619FD11BF57D6F81462EA914E88A9FCCA0C01EBAED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e032a498e0824fcfdc52f15a27271c0a80040ba3cd875ba6fc768210042e1dbf
MD5 018b2d0056f262fc2d75cf40248308a6
SHA1 3100ce0948cc31a2738235e5464045c06c5e08f7
SHA512 15783c636bc6360310151f0f3a01e8a0d3ada3a0fbf414c2389fded7ee307ede93ab42b4052a938e2626e2939efcc8c3b3e5b4976557bd970120688a4feef4ac
SSDEEP 192:sxZrQUnSRVyM/jK1Ml8MWP//f1s2TE/rXbLZXdpvu84Wy5HW6+WN1XHCC7+nqyQ+:sxZ/nS7uP//f1s2kzhUHbIoBXuf
TLSH
T1E082D613653449BBDDDBD219F942BB57E6F41462E6904E88A9FC8E0C05E7BED230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 80505fab2ee32cc6134db4747c8da5f0380abe7b7941ac6dcf8c1262f9ffa45b
MD5 737a7f4c709e870a81b466c37bfacb1f
SHA1 e87e6fa3ef90fd1b705b022eaaf12e602afba93e
SHA512 23456c60876ef51d303a2070f3c2085f769214b8bc8419f45f0cc21ca27e14978791d3605860ebf0f1d264451269dcdf948dfdcf2ed3ebe73ca562761cde79e1
SSDEEP 192:sxZaRVyM/jK1Ml8M9//f1s2TE/eIdpq4Wy5HW6+WN1XHNh2XYHKrjRIg5RJ:sxZa71//f1s2kP3Hb0XNJ
TLSH
T1B562D7126A3459B7CCDBD609F941BF53D6F55562A2900E84AAFCCE0C06E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19ae7f21d89e94c50fd99de0b9914b8314c63c87675413211b615761729a7b79
MD5 53e81c457077ef0ae29d97f8cdb2774a
SHA1 da9594b77115abf2ea8eaa48969b4b180fe95bc3
SHA512 5e679fee764bbdfdcf0c57a9cf26a02c64858c1eca5f444be0f929eb63628c727068f479eb5968259538b45516aebd5b4fd002c124054cdb42fffdd86ac47b2b
SSDEEP 192:sxZrRVyM/jK1Ml8M9//f1s2TE/JIdpvi4Wy5HW6+WN1XHNh2XYHKsmRIg5RJ:sxZr71//f1s2kCHHb0XtJ
TLSH
T13062E713663459B7CCDBD609F945BB53D6F51962A2900E84AAFCCE0C02E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 67a511b149f5aefd3475300df2f5fa029ac12fd8a77c97583026bc095b6baf59
MD5 67896aa1d075263c23b8021e4164a024
SHA1 7daa91e2e289061a28544df84fe5f1d4bd6fc4df
SHA512 b962806f8261ea12d6359f8b60da98082d10e18a9e7451f6d1d5e3a25a1a7126d1be943f3c46a5f73d9ab843e9b691aa66871292b75d8dced74bb02f32baedd2
SSDEEP 768:/yUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R0roVI0b:/yUZYTMWvg0Pou1ja7eLZmRfVb
TLSH
T16CD20B2F280CCB7E4F844E5DEC2A6F863ED801CB5A584D5447EA894C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 fb99de34cbe8835c3a9b6a27bcd3ba12181b4a7ad989bc3bac1bcc29d606f0c3
MD5 da4199f1f83a0c960ce91380a7660fda
SHA1 b33810c3590bc1960fb347aabb37d5245e5b3e9e
SHA512 3b186e86d872409935a6ac823076ad76ccaef330681305ef1876e60761541f3f38783ce8799ab517dddfb8677336b9639dfad56493a3b597f453f5f1a1571d53
TLSH
T1C4A0027C12C54402C40312B83793C39563758E10420B964545E1026DC861E42C24D00F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index~RFe598553.TMP
Size 72B
SHA256 14c62d6d798ba05053f6a91c65c0cd8e60c870704725220b3e13a0f45693f622
MD5 346de768f7310df9aeb72195f64e0d86
SHA1 07cefd8645102f6e9776a73ed9595e2cb48d0bf3
SHA512 04fcb40842101c84f1905ed00b8d906d9ab3ca922684848f56039c279724d7f8870a739927fe7b428872660f3afcc02b20a400df928ea1894960b247295a7de2
TLSH
T178A0021007804047D03E13B916DA4A953340C81026001B4790922088DD554518ED100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f770944-0ff9-447f-8581-9db599c37d87\index-dir\the-real-index
Size 72B
SHA256 5baf6325c598f154e778d606cad1d2d389a44d7fdd4eb8e94299599c15b4efb8
MD5 daa108d8df63ec2a1f3c768764372023
SHA1 4eccd00e875bcf10028f5cdd0d613ccde3a5246c
SHA512 d2942ca9f9521f2520e8f7e86a2a95f10eb81e0f2a63fdc44ccc4333074460f1b1461aa0515b30de1fb6aaee52a1b8df2b3e3198e906db74963e1e49df048d95
TLSH
T12DA0021DC1865313C43857B055A60D5122115F2636814FF756A08B699895285C393049
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5982b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f770944-0ff9-447f-8581-9db599c37d87\index-dir\the-real-index~RFe5982b3.TMP
Size 48B
SHA256 397d98265645406127a276825f1fd892314ee915faa64e9d15b3bd59582bb598
MD5 2650df164b79b09a5c139b06495f5eff
SHA1 d2cfcf43c24902034350f6d75cd55a1743656894
SHA512 9d70e82be2d3530e5fddc275c781e6e304442e41f9734b2540700d8e748ab5908895d1c1a71f1398d2732a306aa5a8c24752a6abfcdadfdcb32fa476dc717713
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 5ec48fbb4db87baaa23e5ac2dfc2e83e98e12fac53aabf645646417c0dfdb8ba
MD5 aabe34dc1ab831cf731eeb9acd7a5a38
SHA1 e08deffdd01332b15f030b52098b9dbf037e7498
SHA512 33a7a41c61d04b03583828106095209c1737400feb40a744dd7b5ca1987f575169c1794d5e5723ae0e26ef678686e401bb5660caef5616ee75a6da3b1c43feb4
TLSH
T1C151B51DCD851B5BEC6C22B364FA04C9337964DD1B848B131CAC653CBC8722C546526A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a128.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe59a128.TMP
Size 2KB
SHA256 a66e9b45683a42c507093f6b9a84632b96c57ca390f701cb54a85c92817cdcfe
MD5 7f25ca5f1daf995d40ef73de4d638037
SHA1 431bcd36fad1090e613d439e4cbfa51f7ffc7cc4
SHA512 8403aa13f46b97f39685f58a1e507b3422bb96c719395deaaaeefe8185a9abd9605261cd574218ec064842973fd49ea4f68bf2a31d9267c851f107006096d4a1
TLSH
T17B51865A4D824639E894417709E3A8B477391900C715BB5374FC9636ACD37AE3E0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\index-dir\the-real-index
Size 72B
SHA256 e3368795a591df37437e7f28d5253589ee7475c4ec2dff32a53b50a60b8cb25a
MD5 88361cd3bf0c6634e559a410894c1b32
SHA1 2936ef2ba7b8906b83af64afb7a846af6d977267
SHA512 17dd1f05c9f2b278ca0a7662b6e4bf5ee4a1f7ffaeb46d0ffe61bb49e9af55c30eafed6bb75dc102d8556557eee42842824da9eb5116151fff0ada9e2ed0c1ad
TLSH
T1C4A0023801684092C1551AB09247C3A027146F551143870A48B00B5E8E52A9B451D557
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 68694f784884ab5866ae8212a97bce0cc7da5b6bfcf077800ba03b2c2b88bbb6
MD5 818251191ebf2739f8f1e64f1305e2ac
SHA1 3bf643b454365d6a84f8c3e568a43c7ee6935e1c
SHA512 0d27ad3be11cd43650f9748e188bb6cbebbcf197cce0a726d636a187e62596cc394cfc0d1ddec7e7fcd6fdc75415735f1f63c58661c07668e150201f0e9febb3
TLSH
T187F027E37EFB1C10BDABC3D65472A1A40515BCA4C549ED8F015A726790B1B06255DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 770520f9330d74c5785bc492aa5c9687f0c305903c6910413e33b50f96bc504d
MD5 2b9ed7ead5759034c32f60531f9227f7
SHA1 2f6aa8fb6853459692b063556cef7052799a0ec0
SHA512 7f5bcdde81daca134a9d8cb50b2f958c63ca52ce014aa6af21bba79eaa52abd476f2a1484cbfdf165a1ffc102c8b836f1e3aae3a12d0f671a9e6ec242db32439
TLSH
T140F027E37FFB1814BCABC3D65472A1B40606FCA4C558EC4E015A726390F2709245AC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f692e92c575520d82752c6c9c92945e7256f3726c0693c94f240a09a3f9cd7e3
MD5 67fd89a91deda773c804c82e9aff8332
SHA1 acf0b1b2234e49b422eaddaee8eca369429da594
SHA512 657c5f28f58381cbf7e65cc85fc4e271ecdecf50c4b65b3c2bc3a72eaddf44b1b5099d26a1850b7a2bac8a513a090d0e55c9c158935bda08b8518321030a0122
TLSH
T1F4A002E1D1561846F808177CF4415684A250CE148717631362B4215CF8AA1509A63504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599cd3.TMP
Size 72B
SHA256 93ae536e2dfde6d88102bcb9da2fa01e3133fe4dfe3868196bd79e7803e49b4b
MD5 81d5c0a214bf9b0c93ee9310f0498c4b
SHA1 4fe2bfe9fdae937d446eb670510c7e0ce22b278d
SHA512 9e6dd9c4f939359057fce426094088dcb06cf4473cd9ad10e56c8f158550118854d8b479ba92e034b603ed0df519e16b3dfd4b67aa847d0867c7a596a52b24ca
TLSH
T197A002A7934A9509C42005B11047A2E013A0CC5D030412136490959CFDD10C056A250A
MD5 SHA1 SHA512 TLSH

Submit Download

a424add77114bf6a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\a424add77114bf6a_0
Size 194KB
SHA256 f4915639938df27a8ca513a5d3ceba96c998f7f3fa728921149b265d30c2c152
MD5 25ae3d9d06a6e1a9a3f1ef3ca8601c0e
SHA1 d961f263f6f83ddce8dd5a6be3a9c80cd1ed9402
SHA512 191e1d8c62b36ed57c61fb3bd6ab606676d748b325124cfc45cd3007f9c1e61be43c650d544ddcfd46a1463f05158bdd5a2c56a9d461da280cc9bb42d8a0b143
SSDEEP 3072:gegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:gegF1cc9zByRIZa8HlI93h
TLSH
T142146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c61ae6668c687f64a2232f9d2aeb25a972bfcc5c2563e6583b05d9a096a2a947
MD5 e6bbe8625d55cc8a00637b5e9e5569f1
SHA1 f597d276308b7d527c1036aed14570ac368912a3
SHA512 242ef6f2ce9da15a212b0469b1bf7e0e97d36204a0a0885d949c88165351fa5ea3bb9e0930fae3ac99bd23229eed3773d5b4638fea39de90a69067bb1cc82a09
TLSH
T143B0222A22C00EC2C800C3B223EE03E03E308C083BCECB2BA0C23000CC83B802C2E02C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 06f3b4e5b6bc7b81bdf8c39a8d30f9043c1081783d01c30753c281706adb683f
MD5 05ce1f96df876b7d2c1b36a5881853d4
SHA1 d003eacf3abf4eb9c15a50ef0d7113498b87d4d7
SHA512 26d7c7322347c040a1ab3f1468ef17c8d9dcc5209c885d2a4ffe84fff7a1b9c75bef7fac4f9c9b59da582c1753595d80c47bf89fae0fc2069fbbff2f30e65d9d
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0YgIg5gMgYgKgWgagAWg+g0:ES3D2rZbgIg5gMgYgKgWgagHg+g0
TLSH
T161E1130232BB02033C3D2918A2AA97774F85F1E33454E42B7BA854B64E66E745DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 197c83bd5e3c0a6f410775919d47f6fdddd28c79520a559409ca20c4b8df15bd
MD5 0edd5566e93e1643c27850171c8570c0
SHA1 7f7cf612e8856e5d9263a63eeaa845a6d640c863
SHA512 7f80ca01d60e896f639491e9ec86a5e629fb309eb6acf51c80dcf8931d3c93d584fa8332337a2d784eabc5716d736e8664ce924f366f7386f8fd05031edabd49
TLSH
T1ADC08CE31500458F4A70EBD82028721DC85B4248CCC8CCE89104000615B893388418BC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58f671.TMP
Size 157B
SHA256 4ab4921136a4c7e2cd89cf98575731e461ff18074f5679470d7b4458ab0bdeb5
MD5 c6e1334d2dac98a3ea2f5a39c5fc3437
SHA1 3b58c8386c711b2794017564695fcefcae9d4540
SHA512 b5ef265347e7223e53614c1a03678ac17a77a4b50f4e6492b9cdc82c0f2f8a9f448b30d25b800461e44b146497f9c7f67c1063fb727a0ebb3891594be18b900a
TLSH
T19CC08CE31610058F8B72E6D4203C720DC86B4D58CCC8CCE895043002247893388448BC
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\73080687-106c-453a-a864-fce1163eb74f\1
Size 6.9MB
SHA256 b0808c6413963babe9f4997cf6bd11eed6dd18aa2b3d7a39f1f56c6110e44fc6
MD5 961da783e0c197f2723a88f915192975
SHA1 4186e6b35626b738ee32acd45278a684c23b2ed6
SHA512 30b0388aaf22d2e1fe2cf0da082f1729d4b7e67ac9d171d9e62a304d9848801829868179e2cf83272b62ebda16f61567d207b9928f11b1eb2ec5cd4a11eb3b9a
SSDEEP 196608:QRTX7UYVlj0EcLnKXanF6eeBUsjD2ABShiFiJekRDymuBI+P02Bq:QRTXQYVlYEGnKKF6eeWg2AwhQ7hfiN2w
TLSH
T12376337627159020F17056B110AD9B2B353CECA884A5F4B9B2D8EDD7B423E89D7F0BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d22e5a8-29b9-4494-afe7-b863b3475aa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4d22e5a8-29b9-4494-afe7-b863b3475aa6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f19ae785beb3c1864994188907663045a624abf134aa3c619fbef1c7f3ad6cf3
MD5 58e2abc92cd20ff7b3d7f892dfd7c453
SHA1 bc68653c1d6a0dbfccff8d6cc59b92db24e63d52
SHA512 5de0b8b85deb0f54b203e82d5b6d36cce295940ae67b918108b55ce5fe2f04ffe0cd1800fb2dd52c8e7254655960ae612c8f83acd56c9778050675d65d850436
SSDEEP 384:mtNn/s3n9SfsN2pO18lftzX5od+2OU9tIOObjI9G6w7B:mj+9UzDFOTOUDI29MB
TLSH
T1DB928D326C299DB34AA3E599F447361B9FF850ABD6842FC4C1DCAF0C06DB6AC1316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 558ae3f9987797cc702bcdcecb26c8ec396c9cf5e324fbd14cc2032217ab1aa0
MD5 a47c4dd2ef8a0cbf74679d78383eede7
SHA1 4a198eb83e88522bd1a8a61728f4200d32a6a9cc
SHA512 e7eb4cb074a8cac52301bd1b8ed2761342975ae9839592819977c05c794999c7e34e5b9c173d3bf6f08d0ef9f6ff8d5e802e886fe10b36d2ff1f0d53e5858db5
SSDEEP 384:SiFgtNn/s3n9ScxsNJ8TUNTUlIlNVTc85wDhzX5od+2OU9KIOObjI9G6w7B:ZFgj+9Nuwgj4pOTOU4I29MB
TLSH
T123D22AF258D78976D99E9B47F77E2D164EBCC0A7B5402A80B3C85A0CCD861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 989a01d12f3396379d7a2750142194a5c9fafb1f31a1210a870b677441ca0a15
MD5 2d6165c554b404621e5d669f7ad80326
SHA1 1cdad093ba9def334220d073617e46d578da7fc7
SHA512 247dd17e1df696b0cd11c6de67e63b3e13458acead71a62557ff7886a58f9bd244df98acbdaf5cdc2aeebf4b3495d3cb37ea27ceb5af5cb3a72e91b45e95cb5a
SSDEEP 384:SiF1tNn/s3n9SczsN68TUNTUlIlpO18lw+tzX5od+2OU9RIOObjI9G6w7B:ZF1j+9/fwgTxFOTOU7I29MB
TLSH
T1D5C239F258D78976D9AE9B47F77E2D164EBCD0A7B5406A80B3C85A0CCD861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b109b563064ccf853f9f68eea5f0cb1f3393bc0369e1b22e1a1de26362cea2c
MD5 a16c38f0cb9c0d173b261488e96e13ca
SHA1 48b173eb9f2d31feed6e7730b4a94916fcad1c0e
SHA512 68f31576d479247444abd41d6b6f661ae258713529068a07e10eec4efd150cc7083dcfc7fc337468fb5b151c162f22286249a6e90332ad4fdba59e8b63554318
SSDEEP 192:yON061VWQmiUypEgGX5Obd+jKOImm/aQ3GFU6:yON06WvgGX5od+2OTVFU6
TLSH
T11002E83568286CA79EF2BE49F58737135FA8207BEA546F84D6E81B1C01D769C2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47862156b6df1f933e743c1060452bc7a7ee62cacc3cf6d7178d37bce4819bc0
MD5 68d025841ce20997430705a3419c23e4
SHA1 5226babd99aa22985cdb7101ab5db6cbcd5699d6
SHA512 c498b7fbe6c0ad6a52b02a91a0ff4f119d8e85ba420836bf61d613538c12f0d6752ece5cf3f4dc090e02fdee4493808f6ad94bdf0bd8bfca840139feffd37ef3
SSDEEP 192:vONv61qWQmiUyyEvGX5Obd+jKOImy99jJEqiU6:vONv6X2vGX5od+2OU9vIU6
TLSH
T12112E9327968AC675EE2B585F48732175EA95167EB447FC0C1DC2B2C02DB6AC230AC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2e1d68eabae5939698e16c7b1e5830b97e37cb3f1f28d63ebe86c1280a20d000
MD5 6ad8eac2e3d9963e49fdb7d233526214
SHA1 ac248d585e19dada7b1df9d1958fcc131a42ea7a
SHA512 1a5c38c92a4a66c73efa00ab19c9b7fac2f46483fe673771a9eb96e78b9bf0f87f3384255ed4f9dda598924d113fdf182d250f948aa53374d844cf8710ce4246
SSDEEP 384:YtNn/s3n9SfsNipO18lftzX5od+2OU9tIOObjI9G6w7B:Yj+9UTDFOTOUDI29MB
TLSH
T1F2928C326C299DB34AE3E599F447361B9FF850ABD6842FC481DCAF0C06DB6AC1316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9765d60e5064c16aa7874753dc94ff4fdebc8c7f23a0875d2a0cf273b12cac9d
MD5 2dec14f67ced239a7e27f9578f3d6cff
SHA1 7a752cdef826755a5d8b05706b6362d9928d81e5
SHA512 2c22848147b5be399d1aec00d31d25cd752b430a46569f8767bbceee5d070b6f686eb899db55865de65693e184c72a5bb21036bb952bab38cf8f138bd45a5723
TLSH
T182E004029B4018AEC03C033016EB1B702EF6D4A002A246064A30417D6C273142B24AC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 555cbbdecd83bf54a04cbf104a65f8b98121ba34dbc72951aa2e2004b918541a
MD5 87cef1bfada529328dcd2d792bad4099
SHA1 be8b55125b36a8ad3ca95b8341d1d22f44287604
SHA512 4b377ec450aa0e8fb937b82dee97fed7aed657a77bdf3b1ca85d2f13457fc52e1dd975911076be1e245bb11deb66f279786a15c09129f150e948e5c783492b3d
TLSH
T152E00902974014AEC03C033015DB5F703FF6C42002A247074A30417D6C363042B24AC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f24f2aeeecff3d601753c35dc90bcdfca68ebb0bb8c9816fa4f3ef5c9f49c0fc
MD5 e3dce997dbb7db38c89a8d2cec034691
SHA1 a826dd4d4d450277745a8f994f6a3f2977e0a955
SHA512 4ed1261869533037b9d2c41655a0ff1e606def0d953a86eeda34c28fb989bff3c504737c32603c684bb1edc9ef198bbe445527eacfe9e31c5c03f3f26e1a5e90
TLSH
T18BE004169B8018AEC03C033015EB2B703EF6D4A403A747474A30427D7D773142F24AC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e8e8714a66e9ce00cfe2cc3e231b7b72cd0f11074aa67c53474d41873fef0e3
MD5 d407b95e517a02da7719b3132d5c614b
SHA1 951c907418c9913c636f1d548a5633f5ab78a555
SHA512 26ba3bf77572c21d03fe1bfa121ae82b93f2c1f630fe2ad69d750bb40ae4536e4483d4304f730f89270d199d8d66ec44dd2e8c5217a2320c9b92193dce3e7ab1
TLSH
T1B4E00102974014BEC03C023005D75B602AB5842002D246064920417D6C253001B34984
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3db017d9920435cd198a99e431056a4c49b2c8a16c369f21f7f5fba34ec21b2a
MD5 faca87f70e398510dc4b4282f0f49ad5
SHA1 4d41b0177d8e0d8c65c21475dbec1b4f011680cd
SHA512 11d339172455d1c9779d744c18fb1a8ed195ca3cd396df18f3b85897dfacae8ffa0b4e0b6dfb7851a64d92b0ac77cfd9dbd2e7da101760c8b7b99a8ea225d617
TLSH
T1FEE004179B8018BEC47C033105EB2B703AF7D4A953B787474A2142796D663182E38AC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3900440159114e451a1604960433e142f8c90d89bd0da7a0b599fa29f81d021c
MD5 3a4d24b3466b485b70f07dfaa35e16a4
SHA1 c6abd3b01a458933cba7c005b01e973e85896815
SHA512 a7a77981333cc8afde09d969478c1d9d938f72e02d46ac871cc9d88d9a21a6150ea0699483bb3983911c0cde493b845195f91998a8fe423b6003a23f794e202f
TLSH
T160E00102974014BFC03C033005DB5B603FF5C42003E347074A30517D6C263042F34A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 60e52f488ee1fa1fe4dfb9c4228377ab89bf2467d2caa549bee0bef2f3d0c280
MD5 51988abfa11d1c02a1661ff9212b4250
SHA1 280b43adca8901877676d113491a8b987b665394
SHA512 d5a8c52a3d6c52969ed1e816709881ac722281e3f7a03b51451ac19ff7652e1b1f484d6ae097c194988266a4a01413b4f4a84fc160a02b5df2ec5b60e6a6b839
TLSH
T1B5E002029740046EC0380330059316602AE5842002924605491041796C153001B249C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58898e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58898e.TMP
Size 392B
SHA256 a573f6913322ed8e38172fb92309eb7b8cfb3bbd19a45a4d2ac0a03296de9a84
MD5 e25edda641fda5a34b426b97f0a29ae6
SHA1 3deccbb9ef1d9248bd16e097dd41f81ddc228294
SHA512 68b565d0bb2712a6bcfe35c1c3b8684774022e7eaae1601d1ff93e74a46c20e9d730bf6892bf139528221889b14bdf3ed027582fa15cdc04872ecbcc1f611568
MD5 SHA1 SHA512

Submit Download

0e4a1cd7-66a8-4573-9e83-bd79aa98ba4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0e4a1cd7-66a8-4573-9e83-bd79aa98ba4b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41461f9148ee802f86ca4113f93e8837de51467ba5b9effd54e804893ba4f05c
MD5 8b775935ca4e05f8519b1db3515534c4
SHA1 e3c0b7c7d1406e37f14912ed24a35c5dbc54e854
SHA512 0af6ce5e9dded38d715b70f74939dbb557111966d990352a2a08fb92831545e5f40ca3f740984448537c536d2231429572cd7e0ec5e55b3aef776ba28847e44f
TLSH
T139412758A6FD100CB3B76F59ABF769AE447EBC372A47D45E00110D4F0A72A40C962B33
MD5 SHA1 SHA512 TLSH

Submit Download

HorrorBob2.bat

Path C:\Users\Admin\AppData\Local\Temp\BA6D.tmp\HorrorBob2.bat
Size 5KB
SHA256 f73a510ebd7495f8432b489009aeed5ae7c945ccf68ec3baf88605aeefb2d073
MD5 b11c0b55dba339bbe3169584fa0eedd8
SHA1 8c201122fd73cea5d8d2aa2aa6f7c17d99b521d9
SHA512 8424ce9a6af67721c6df13edbfbe9e48ad1eb014e19c6952afd4158c16762cf65092e6ef459a98680673e30c86da9ba9aaf2aca309426b9237bfcf893ed40006
SSDEEP 48:y5NzKirX5AU2b+8OZzuT+P00000000000000000000000000000000000000000J:yfzLt8YzuaC
TLSH
T14CC173B3AB92421EB5E1AF0890DB9443E37B29553CC48FD53AB15889212DD46FBD81E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Service64.exe

Path C:\Users\Admin\AppData\Local\Temp\BA6D.tmp\Service64.exe
Size 11.4MB
SHA256 ae8cd9b5396770fa3c77140246365c3c501ece718b52fd6b7faed85c26b25d2a
MD5 b53852cb556ec28efc39b986caddb791
SHA1 5ce0819a7b1703f67272fa0f21546d0a8b2d7b0a
SHA512 7da30187b939c91d045dbe9cfe8daa209d539ca865d759bde4be1c8f4f96fac5f5747ec1be1937eb00034bf531391788586c5d6c3ee93c94d88201e3a1d52599
SSDEEP 196608:Cy57Rs/N5SlXBwgx+YAK3ed+O5/m3WLIgNGZfvb044BgdcuEmJl:CyLs1wXuQ+YAgedt/mGLIgk1v6gWup
TLSH
T1E4C63332956235A4DF4B223F070C870F7BA658B51EB1BEB1565080DE286672D2E06F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blood.bmp

Path C:\Users\Admin\AppData\Local\Temp\BA6D.tmp\blood.bmp
Size 3.8MB
SHA256 fe28980c6e213619a95e5991de2062a0187fc3054418e670e1c67d3c5b6b01de
MD5 040d29b801e3488f7aee3f9708128eea
SHA1 433591a971325f7529cbb7a1d16645ff65ee10c7
SHA512 79c64fce68a58fea469bb71dd1e10a3a2c1d4dc024635be2b8e29793bab8c34ba7afd402d47cce7826279512c7906f31fed9fe986024bc03a36dc094f7629826
SSDEEP 24576:2I8ILsUAEQpWshYVPL7hMQ+HfMSpx+ThNuaU2qqqX0skcr5Q3F+tmLPs/sxetP:2IurpWsIG/B1r5Q3HPsYetP
TLSH
T14F068444D7F07644DB292B1034AA986670F23F9E287CF58F4ACD7792AB72C92D74814E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prompt.vbs

Path C:\Users\Admin\AppData\Local\Temp\BA6D.tmp\prompt.vbs
Size 207B
SHA256 9bc399097468bb1f2f88250cb967b3db4d34d0a7836b73f262afe2b3ad393ba3
MD5 52ac951762c9b42fb4492dfdde2ba4ae
SHA1 0821a0dea46432fc4db10a2dc6312d42a872ab9f
SHA512 c91cf111b92f0f3218353e4e1700270730f2cbad54ab5d8fb368c6e87168be39f0b3e5a04d66b11bc5d93d6b4c4d03711b75e29a7af87d75c14dd296ad4ad530
TLSH
T102D02349EAC79510093053A3341D7C8EC6901773C310935EB02C4610FFF411C4E00006
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

HorrorBob2.exe.crdownload

Path C:\Users\Admin\Downloads\HorrorBob2.exe.crdownload
Size 11.9MB
SHA256 98a804d373c7e0e4f80155df20358436e066ecf31c522c31df2ba46923ac68c2
MD5 9331b20120075b2685d3888c196f2e34
SHA1 1af7d3dc4576ef8aaa06fa3199cf422b7657950b
SHA512 83636067d46b1362a6e0e5af56222d170d337fa7b0c4048b8f04c9df0ca35c3634a7254e6226886b00f9894e4353d6ac6b2e4e760bab320058cebe37c7c0cd7b
SSDEEP 196608:zHvwfYWqhZPHE5D7cdPNPi17S+IRTX7UYVlj0EcLnKXanF6eeBUsjD2ABShiFiJt:vZ8R7c5527SpRTXQYVlYEGnKKF6eeWgO
TLSH
T1A2C633FDB1845810E1209B7120E5866B297CECFC55EAD8BD72240F9F7A67FD992B0720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4632-2198-0x0000000000400000-0x00000000012E3000-memory.dmp

Download

memory/4632-2217-0x0000000000400000-0x00000000012E3000-memory.dmp

Download

memory/5508-2161-0x0000000000400000-0x000000000132F000-memory.dmp

Download

memory/5508-2218-0x0000000000400000-0x000000000132F000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads