00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
Size 1.5MB
Sample260706-jtk1kaft8m
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
6084	wsw.exe
5216	wsw.exe
5184	wsw.exe
6068	wsw.exe
1688	wsw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5764	chrome.exe
5584	msedge.exe
6140	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277982682874507"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{8D8BFCCA-399E-44F2-B0EC-F353F516A2B0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{1F42B59B-C4F2-4FD2-8777-2DA2157F0BB1}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000484a9424ae07dd01ef36e513b507dd011d79e513b507dd0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5184	wsw.exe
5892	chrome.exe
5892	chrome.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
6068	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
5216	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe
1688	wsw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5892	chrome.exe
5892	chrome.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
4664	msedge.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
4664	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe
Token: SeShutdownPrivilege	5892	chrome.exe
Token: SeCreatePagefilePrivilege	5892	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
4664	msedge.exe
4664	msedge.exe
5892	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5216	wsw.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5216	wsw.exe
5432	chrome.exe
5432	chrome.exe
5432	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5432	chrome.exe
5892	chrome.exe
5432	chrome.exe
5432	chrome.exe
5432	chrome.exe
5432	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5432	chrome.exe
5432	chrome.exe
5432	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5432	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe
5892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 6084	5800	00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe	88
PID 6084 wrote to memory of 5216	6084	wsw.exe	89
PID 5216 wrote to memory of 5892	5216	wsw.exe	90
PID 5892 wrote to memory of 2800	5892	chrome.exe	91
PID 6084 wrote to memory of 5184	6084	wsw.exe	92
PID 5892 wrote to memory of 5764	5892	chrome.exe	94
PID 5892 wrote to memory of 5432	5892	chrome.exe	95
PID 5892 wrote to memory of 5432	5892	chrome.exe	95
PID 5892 wrote to memory of 3456	5892	chrome.exe	96
PID 5892 wrote to memory of 3456	5892	chrome.exe	96
PID 5892 wrote to memory of 2992	5892	chrome.exe	98
PID 5892 wrote to memory of 5936	5892	chrome.exe	99
PID 5892 wrote to memory of 2992	5892	chrome.exe	98
PID 5892 wrote to memory of 5936	5892	chrome.exe	99
PID 6084 wrote to memory of 6068	6084	wsw.exe	101
PID 5892 wrote to memory of 3316	5892	chrome.exe	104
PID 5892 wrote to memory of 3316	5892	chrome.exe	104
PID 6084 wrote to memory of 1688	6084	wsw.exe	106
PID 1688 wrote to memory of 4664	1688	wsw.exe	107
PID 4664 wrote to memory of 988	4664	msedge.exe	108
PID 4664 wrote to memory of 2728	4664	msedge.exe	109
PID 4664 wrote to memory of 5584	4664	msedge.exe	110
PID 4664 wrote to memory of 2728	4664	msedge.exe	109
PID 4664 wrote to memory of 2728	4664	msedge.exe	109
PID 4664 wrote to memory of 2216	4664	msedge.exe	111
PID 4664 wrote to memory of 2216	4664	msedge.exe	111
PID 4664 wrote to memory of 6120	4664	msedge.exe	113
PID 4664 wrote to memory of 5960	4664	msedge.exe	114
PID 4664 wrote to memory of 6120	4664	msedge.exe	113
PID 4664 wrote to memory of 6120	4664	msedge.exe	113
PID 4664 wrote to memory of 5960	4664	msedge.exe	114
PID 4664 wrote to memory of 5960	4664	msedge.exe	114
PID 4664 wrote to memory of 3016	4664	msedge.exe	115
PID 4664 wrote to memory of 3016	4664	msedge.exe	115
PID 4664 wrote to memory of 3016	4664	msedge.exe	115
PID 4664 wrote to memory of 3912	4664	msedge.exe	116
PID 4664 wrote to memory of 3912	4664	msedge.exe	116
PID 4664 wrote to memory of 3912	4664	msedge.exe	116
PID 4664 wrote to memory of 1956	4664	msedge.exe	117
PID 4664 wrote to memory of 1956	4664	msedge.exe	117
PID 4664 wrote to memory of 5284	4664	msedge.exe	118
PID 4664 wrote to memory of 5284	4664	msedge.exe	118
PID 4664 wrote to memory of 2536	4664	msedge.exe	119
PID 4664 wrote to memory of 2536	4664	msedge.exe	119
PID 4664 wrote to memory of 1648	4664	msedge.exe	121
PID 5892 wrote to memory of 4504	5892	chrome.exe	122
PID 5892 wrote to memory of 1532	5892	chrome.exe	124
PID 5892 wrote to memory of 1532	5892	chrome.exe	124
PID 5892 wrote to memory of 1448	5892	chrome.exe	125
PID 5892 wrote to memory of 1448	5892	chrome.exe	125
PID 5892 wrote to memory of 5880	5892	chrome.exe	126
PID 5892 wrote to memory of 5880	5892	chrome.exe	126
PID 4664 wrote to memory of 5632	4664	msedge.exe	127
PID 4664 wrote to memory of 5632	4664	msedge.exe	127
PID 5892 wrote to memory of 5488	5892	chrome.exe	130
PID 5892 wrote to memory of 1804	5892	chrome.exe	131
PID 5892 wrote to memory of 5488	5892	chrome.exe	130
PID 5892 wrote to memory of 3720	5892	chrome.exe	132
PID 5892 wrote to memory of 1804	5892	chrome.exe	131
PID 5892 wrote to memory of 3720	5892	chrome.exe	132
PID 4664 wrote to memory of 5540	4664	msedge.exe	133
PID 4664 wrote to memory of 5540	4664	msedge.exe	133
PID 5892 wrote to memory of 4168	5892	chrome.exe	134
PID 5892 wrote to memory of 1048	5892	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
"C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\wsw\wsw.exe
  "C:\Users\Admin\AppData\Local\wsw\wsw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent chrome "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --lang=en --force-renderer-accessibility --no-first-run --no-default-browser-check --disable-default-browser-promo --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcbf25c728,0x7ffcbf25c734,0x7ffcbf25c740
        5⤵
        
        PID:2800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1108,i,8696386519315261158,5227945446775667097,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=1112 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,15494432522977311327,16904286875542954642,262144 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,11040632862522666249,2902998020691402828,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
        5⤵
        
        PID:3456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2552,i,16972024621420953989,2344466851583677725,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
        5⤵
        
        PID:2992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,16648517846493128732,3086666793317757383,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
        5⤵
        
        PID:5936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,17130834414164351622,12641288349679196300,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
        5⤵
        
        PID:3316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,13202563961047800805,16451108492082067782,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        5⤵
        
        PID:4504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5248,i,3933483686667951875,130354035888197796,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
        5⤵
        
        PID:1532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5268,i,3920552811741951338,15152255649265123158,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
        5⤵
        
        PID:1448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5548,i,14249625489913179561,15283136029425696250,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
        5⤵
        
        PID:5880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,12574508476903160301,11401532918270381373,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:14
        5⤵
        
        PID:5488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5240,i,12997637110256404021,12725527678637626224,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
        5⤵
        
        PID:1804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5820,i,6674206996258722306,4347619487862375925,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
        5⤵
        
        PID:3720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6040,i,13177362861450577542,10217260425808432931,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
        5⤵
        
        PID:4168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5752,i,1668011700588625375,24125779531167821,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
        5⤵
        
        PID:1048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,14752772571708676940,14597519528806923781,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
        5⤵
        
        PID:1632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,8391828464308237781,5907191148792476597,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:1356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5684,i,10858464753512904625,11337702253134010459,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:4252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3364,i,6344140074609653862,17187669058049853300,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
        5⤵
        
        PID:3304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5880,i,2141056582637994527,3201704486028158176,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
        5⤵
        
        PID:260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3068,i,4132542239405309358,7159171227869901517,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:9
        5⤵
        
        PID:828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,369182234903020680,4956233822164597627,524288 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:4148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5756,i,14779933594278154129,70963831063876514,2097152 --field-trial-handle=1924,i,87873904116593044,5356049440679589847,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:9
        5⤵
        
        PID:3732
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent opera "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5184
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent brave "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6068
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent edge "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --lang=en --force-renderer-accessibility=complete --no-first-run --no-default-browser-check --disable-default-browser-promo --disable-features=msEdgeFirstRunExperience --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x23c,0x274,0x7ffca6ddc188,0x7ffca6ddc194,0x7ffca6ddc1a0
        5⤵
        
        PID:988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15421539700655296843,1282230733529302974,262144 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:2728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8746167212130580122,8850653136648353122,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,6093418353429436070,17682055667260368492,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
        5⤵
        
        PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,1158700723647272211,6977488548642875231,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:6120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,5957929289074225280,17036704869628611828,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,17340733103573076370,10839700838715610449,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
        5⤵
        
        PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17065656711074637180,1231922226827283839,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
        5⤵
        
        PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15876655428375219724,13625773535568899697,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,4611970028350566678,17049817552601089052,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
        5⤵
        
        PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15887724440596155061,12911810614688478939,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
        5⤵
        
        PID:2536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4439772292454025877,12034100416336753716,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
        5⤵
        
        PID:3772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4439772292454025877,12034100416336753716,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
        5⤵
        
        PID:1648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3864765126132491182,9197930330062183668,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,11528222494106239043,6548140252656222243,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6896,i,13194489763209586794,8728259751266869867,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,6238809955209417129,6287789164773753554,524288 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3680,i,12266231975094773259,931328235814975239,2097152 --field-trial-handle=2120,i,8013483455069108995,14473056792308682672,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:9
        5⤵
        
        PID:1152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a4,0x7ffca6ddc188,0x7ffca6ddc194,0x7ffca6ddc1a0
        6⤵
        
        PID:4504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,15607333987724445389,12137152191549537795,262144 --field-trial-handle=2292,i,89305923976585642,8331681197743007750,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        6⤵
        
        PID:2128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,4368802860472386097,10136508979294871018,524288 --field-trial-handle=2292,i,89305923976585642,8331681197743007750,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:6140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,9285932453121458814,922648294986745752,524288 --field-trial-handle=2292,i,89305923976585642,8331681197743007750,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
        6⤵
        
        PID:2780
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,10745456061934939286,6845478156178885057,524288 --field-trial-handle=2292,i,89305923976585642,8331681197743007750,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
        6⤵
        
        PID:1152
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,10745456061934939286,6845478156178885057,524288 --field-trial-handle=2292,i,89305923976585642,8331681197743007750,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
        6⤵
        
        PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d7bda218ff2b2552abf51af5ea34ca23997d868e34afad07e2694fb488df2242
MD5 c0d4e0497a5323d2a85640198bd46787
SHA1 2ee0b3e6169518563a20983322707eb4bdaa0eb2
SHA512 074bcbbbcc1417df21c466614502e52ab7481c71f511a5a68a0a6f2547a918008a02af0c755cdb321cf870ceb215700e1a8eaac559cc5fb961502b7e45f40b03
TLSH
T19FB0120202C01302CB40A7301B221C3042584C0B404F437F93D703CC4D1A3D01B20D4B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4b501ac5c763e365544cfc70ca71ac2647a602842874d00c376d832d1059cb8f
MD5 597b2fa6615942fbf61f7c51ef288625
SHA1 27f1129ee656372278156c0479a91bb2f86bca0c
SHA512 b6b1a93d9ea82fff8f75594420bbd455d775d697858bdd36a62fb22c06c7a1d505a2fbec14499e2d716048967a12f1745014ddb6ee4ee5b6b60bdc6dad9c45d2
TLSH
T122418AFBC3E8867D890192E4EB156F1BCD6E0914532D3C57C8D8AF1B93E2872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 4537363856d495ae864acfce4b057e3a532a69d302e05216b1c4b4b233567d91
MD5 292db625d25ad665a6a35874a9067ab4
SHA1 e671b06336b8d80967a98aba62666b28d2126880
SHA512 3b3e46373b602d067a4d939fb33e7fb89cf829f8d5f5f7d3a230d676f472ee6d47bf232cb7d2ddd0c8fde0ab8d3f02f797f800fab82e92e384b662c6b7b175ff
TLSH
T129017057E539706B106855A75D00FC4664BDA430038164E1CDAA816DF0825FB4B57467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2d4e2349e5ef3f5328b17c4e55f1c9403a1884f3092472468ce9053a25e3ea32
MD5 06786174f349977af2836c20a3a8f608
SHA1 9d8c63b50e4db089c23bc4660a6330c4293940ed
SHA512 353f881c71fe632a81e37021ff9d07a88bccd49241c215d2ec5a1597b64d5008090eefb0c927c950f751e6fee08371531d465b77c0b25e624552cb571b39e251
SSDEEP 192:SRkQ/j2Bv71vAPRp2O9PHsb+WNNoum1JjP2Yef+VyIsnAUge:SRkQruh6Xh1wN4/Pm2e
TLSH
T18732B92EAD68657F5DCBC269F9257B63E7F5102221D42E80FAFC8A2C12D75CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 ef49849a29036176a998306e027cb34f7de7428603f391d3725631141f8e675a
MD5 d4f3844c0f2d28ef98193c8921fe7bb4
SHA1 001c00fcd31e22e627a92ba871a15bc266010abb
SHA512 be5a9a31147b254abac87b891ce930674720d9f59662580e4a18f2195fb191e859e4a06f470cdff6e1e96760b004066fb08efbd67e8aff46de858ba50eff9fe4
SSDEEP 384:HEJcj7EJ97KxkXqKf/pUZNCgVLH2HfgslrEJ1XOD7EJd+ErU3HuHGu7aalpUfAur:HEJw7EJ97KxkXqKf/pUZNCgVLH2HfgsJ
TLSH
T1EF521967648C9A7F4FC8D68CDC136F8FACB6025B6668082456FB5C0803A57CF124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 859c1dfd2e901cff2d63e3ba473706898553fce8a7d0a9c68f983e16d6aa5d94
MD5 05200fa6a8b4b6f9d4f62c70fd699f7f
SHA1 c981600c983b5ceddf65e3f5548ae9c1227e3339
SHA512 00f7e058c26df02463c11617bc3775e0f899fae2871d51e28cd4a5ccabfb82a2557c262b83129f51c29b6699def29bca791957016325a3d5118a23d7b1f10c94
TLSH
T132C09B52C416D4C0C4D040745DB5548D1359DD6D85053715A2B45665CCEA061455A561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 994f1107303d164a4eb5cded90e5cc04d861de0847d4097b71fea851c7783c00
MD5 eb26fde6234ffa2e01e0b242810c5248
SHA1 d4b171e0f1b5fb41661814c5f11b518a7728d0c9
SHA512 2a06da533f3c694048a61033ea0608b771c5dfaa2386f7b85536a986ac22425067926fa84fff8195d962edeea925e38a8961ebd18666aa4fb4363a26c9eaf966
TLSH
T156A0021285C62920DD258170A5220551665E5D189450835346D507CCA99B0C14905612
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59930f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59930f.TMP
Size 48B
SHA256 8ccae16cdb58eba046d3e23ba026eece3682cbc1999050928117a436dc47587b
MD5 b2bfaeadd3a15157f2a67c0461c4815b
SHA1 e8b47b2223b26229a804f08183c6b7d655d124a5
SHA512 fc9b6a7de89f2d71c22c5470393ea36579b4c1b7d54c93b0b262f7a0047f57592d0f76474f8bf58da80094bd1387699f6636b2901a00311f6cbf59c8b67d167d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5993e9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5993e9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 969c01b815783bcf61db62c46f7030bbde0f3ee7b1093d01693024598ca49aff
MD5 5eb4ea9580d7b16285b3692563415e73
SHA1 46111b83b1978bc7ed703ac1454d39971665e529
SHA512 6aeb46807fdcde27000298a0a17cbb2e021229318590f210208685bfdddbb32584ca0b964821fb50f271eca268bbe48a2391862be92b453baaaf6dbd8b200261
SSDEEP 3072:rp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRD:FP8pYw80nubFS/sBNx5
TLSH
T189C312513C854BBFF6A9AD28BC031D5FCE195C19C511FFDA9EC49F8DA06420D63884AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7a2ab26fa32f241adc403c4c718508c41b5445857505e75ebcbb3317985124ac
MD5 8901c31d1691b530246d15b56536f25e
SHA1 79845deacf5cc0f5fed9b3edf7ef2c6518e7dfe4
SHA512 71172674cbb9dd167fc4d2def691115d1e08076b2cde1fa5561fa3dc25f43c67ab6db97299aef4188394cf9b0ba72bbe348982c81e3d61cf43ec161c40f13d76
SSDEEP 96:FC6Ld+DG/K++E0kDf8r6VsvERDotok5hMzDMB6IdGyvJnv50iFPEnv4a:FC48TV1sFDUDiArwqv50iFsj
TLSH
T1B7A10972A07D4D7B62B5D585B4162F03CF6D605FA6116EC4ECE85B0C05FB1ED1346123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 813d4d2d3fc3e2656538dd626b05f3ad74efcb33212fc2d5e927ecc559ba1481
MD5 9b890445d130bd17ac86c781a2ea6ca5
SHA1 fe238a75204fd3e0d2369129c4ea8816b032858d
SHA512 86f3d77e52872b4c21a514f5dd614e475957647cc6223de35f9fa2245f9b18793808da3822872bea1289919dc80b6c9f7c3f007f863df9732c5be103d292715e
SSDEEP 3072:Tp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRD:9P8pYw80nubFS/sBNx5
TLSH
T1BEC312513C854BBFF6A9AD28BC031D5FCE195C19C511FFDA9EC49FCDA06420D63884AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcbbb115f6bb114a5a13a9c06e69cfefc19dc7e0507444a80e0eb850f31a2db5
MD5 c5fed3219a608197bacfb46ddb334e61
SHA1 29e3994387d7afcbe3de0d46c3752894c1bca3a7
SHA512 36da244318795d186ec2e6e98d75a3e379d3704612d17601e99d73fc3139ae569a3be332ec3051e9b639199a836dfbe2410a069eee5aec550b3c6b3d803dc85e
TLSH
T1ACD0A724263665D1D628207A94704602767586E236A98686A250850FDC78491A78B6A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 454db435c770737e58bbf6c0f5b7f48fecbd49a0a2915f5446af6577158fe0ee
MD5 b250e138f0f993e0f1ba74d53563c78b
SHA1 339e404d6190f6acf55c558895c31d8d9a257b37
SHA512 68f9ccd40010ed5412e462aaad54963b121f52443042f89ae73fca23f647d9cb8101efe6060d3f44b67b5707a3b7b852761d751c40ba5814e74909a7a7b227cb
TLSH
T142D0233037391801C70A30326820C30333B1C3D03A68C4828120410FDC380E0574F1A3
MD5 SHA1 SHA512 TLSH

Submit Download

61947884-7142-459f-89b1-1f55f1c6a002.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61947884-7142-459f-89b1-1f55f1c6a002.tmp
Size 32KB
SHA256 596271a59b575ad6f65ef6bf8d9e15f1b3a961229528046b90a022b5d67bd605
MD5 ce533783e4ac076b1b502e0815ce3a98
SHA1 0cc590b3394c8078fb5ce3d3f9257bce4bf768df
SHA512 11fcf95295eb00cdfdab34b3a580c6a64ca3a285314e1cc638f0da8bb31719b8c522f4c699ec5db826bdd5a1cdb32b45d21be3aa42e95855dc444e7d1aaac7d9
SSDEEP 768:Ra7VjA7pLhL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0lid4v0roJKH:Ra7VjMd7wZWgmofLku1jaLliavfgH
TLSH
T16AE2FC3B680CCB7E4F804A9CEC29BDDA6DAD01CF5AD8C95447EA840C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8aeaab75-a49a-4179-ad74-e491eff115a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8aeaab75-a49a-4179-ad74-e491eff115a9.tmp
Size 414B
SHA256 4056fab08a16336ebbbdb8fcc6ee056ee9c92504bc994f015d125b0a9b519238
MD5 f757287fe056b9e51b799df36e75ab84
SHA1 91883dc7dabc2e001cec9ebacd85fd8ecb5abd16
SHA512 f49dd1e114a16e5c22d7c14ebd383b160ef62fc5c2fcaaa47487102aa2b5472bc7f0baa4f194376ab4078fc174c3b09d788827b6324dc5116563dea05cc24672
TLSH
T1E0E02B6AC8259C7714FC072871940646EB40136B3F41498F373C920C8FB153A058682C
MD5 SHA1 SHA512 TLSH

Submit Download

99fb132e-1376-44ab-b032-060ebf88e9af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99fb132e-1376-44ab-b032-060ebf88e9af.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bde4c0019a3b4fc855a1b50ed647cd849613d50e673fadb2a3f640671c6841e8
MD5 e1a037821e573f5af48c110db945377c
SHA1 1680f6ac4b75d916f0a631efc5f66878102e97b1
SHA512 0ad635b1f0d2468dedfff89277971fe4d692bc7350cc68bab4d091f958849fe040eb3b3cea80ae933713ecbdd362b6a260a43db012c1a2ad62f51aa78a5bb444
TLSH
T131516E053DAF0916C7A603FD0BE2168DFF6898F640037E84C0DB91FAB986328635A473
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d95d1e596e5598a9605984c9ad5cc585beb7ec47a2923f8451afd451a54a350
MD5 3b82921d770fb63a312bdab36d4b79eb
SHA1 9d387cd7b990574cfe85a8ecbf887305fdf0689c
SHA512 1f833e36f66844727d2717ad55f831f981cc1161aac60a2ca5500bf59c64d7aca2dba3a5f1571f17a4c02ba45100fdc6612608e8d05f28c9660c5c2f3f5c2818
TLSH
T18A51B0F7C3E8866DC90196F4BA146E2BCE2D0915832C3D5AC5D49F1B93F2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2044c75d471d1590745b237a04c8dd1b1a4364d1576e04678dfa4376b5e74d4
MD5 d1fcf15f4f5efb20ed805e9e23ef61ef
SHA1 9baf3a86c3a16f8ea1b3b7f14b35e2d8e53f3c50
SHA512 d2d980f70f430e4c12fa39b79e779cf6648bdfeced7dcfacef7ec15fdeb6120c59fd10a6f4025a9f9824a559af4142dc121a3c37054c882ff95627c893402fd2
TLSH
T14151D0F7C3E8866ECA0196F4BA146E2BCE2D0915832C3D5AC5D4AF1B93F2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dbdabcf15a042005f17c724a62111ab6051e553d99cf503d46ba52ed03b85290
MD5 ed5ee213a6bf5251cf27bf0eb1369b7d
SHA1 cd03ac2f22ee86d6e5753934cbb3ff8c4343d62c
SHA512 0fab5a46094dd573d5f098005200128dd6be2db5f8781c5c8ec054b2019e15a6b0041a5ae60b4744f67ab3ace16ffded982109cb63984a9c915feabac5defd7b
SSDEEP 96:stMZVj50XscmIbDCVXSDXKSn3oo5h16ZZs7/x+6Mhmuecmje4K+gIA57M28XMnQ0:stMv5sspV7W3oo+sV+FijUyGhHJ
TLSH
T16012B6169E28A93B8CCAD21DFA657F53D2FD607261D42E44FAFC8A0C05E75DD220742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3e988b598726b33f1abc2a47dc3acac94c7e26a92be15d1b858f5978e71a3efb
MD5 5e70f62af26274b9f575f828ad2446e2
SHA1 1b27d87a140f60cfaa41128b0daeebdc89efdf9c
SHA512 e4fd976d246f358fead3f911b4d7422036f6533acadad5c8b07efccdaf56e87f57948538e0709f79a2e03798e6361352dccd736f82cb14061c0fec51be324996
SSDEEP 192:sxR3RCyM/jK1Ml8QcI/f1sKWpVhscTa7yzoA8pi/g6+WNLooH/YImcXgbIgDsJ:sxR30sI/f1sKWvh7a/i/5Lz/N4M
TLSH
T1A562DB16A9385977CCDBD20DFA567F63D6F81573A2901E44A9FC8A0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 67d6a905b5f9378db8a9cecd7dec52e11cdf7ebd7c1c6bb169a58c2e70ce5188
MD5 d1426524491e49a58cf6f3cf622c570c
SHA1 704f0071ab7c242fd566dfd0ed6a72ba0ce47517
SHA512 77b3a3af18eccd4b115525fe32a7abcabca03984d1b019f405af065a9e9913571cfe89ffcdaddd3b6006dcc3014b42817ab8e309db876d7fd468b3707aa30ac7
SSDEEP 192:sxR3RCyM/jK1Ml8wcI/f1sxscTa7yzoA8pi/g6+WNLooH/YwSc+GbIgDsJ:sxR30CI/f1sx7a/i/5Lz/p1M
TLSH
T16562D916AA385977CCDAD20DFA557F53D6F81573A2901E44AAFC8A0C01E7ADD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 4e74a4bf5b5b30d51b24e84e8d4c509165c729ffd7f76e4f93dfe70b1cce1506
MD5 ed53d556aa40be1fb4855de7e225241d
SHA1 09d25e88660c89b9d21ded31b87bb419adef09fd
SHA512 73f66ff9d1475af6b509ae9e8f7deeb75c8d2b0c0cf87331e0a71aafc974e8b691ce9da3fc4cc1c9fc36f1d8579a1ac5425675660464f1652e4fb5dd65c696a2
SSDEEP 768:RGnVVA7pLhL76ZWgmofnk8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0lnW5Md4F0rogJ:RGnVVMd76ZWgmofnku1jaLlnWaaFfgxf
TLSH
T1BAE2FB3B680CCB7E4F804A9DEC29BD9B6DE901CB9AD8C95447FA840C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7e7a249f005acfa62f417267f7f1229d3ea9a0682253b16a9b223596abbe29dd
MD5 81d443e46a2d9de3908bec906db8d615
SHA1 f6934ca4681fc1a7688fd2840596171cc8eea159
SHA512 539978c5135c1b50009aeba13a2610be7c07bd1f5b4d2946e0e29d5d19a226ef460a13d44eaf5585aeaaeced0131c5e4a37ba0956d2634d28a412028eb771f9c
TLSH
T1F1B01242C55CD180C440007864A2109803081C710004270116A49164DC550429826021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598f84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598f84.TMP
Size 72B
SHA256 886f3b49f453835358aca6682719fe3dc650eda7ab2bd322a05e998f21821add
MD5 6a779589ad453f1c4413cf7f601367c5
SHA1 125f2beb9905d797a6ab30754a6663836de8e09b
SHA512 ababf767a0b3020e19ea5f6db06d5ee429891ce18c0ac544945ca676a2639c0a78019bff53c838dfb6880f6a8519b1e7f0fa3494b21a5a05e418de19ac6411e7
TLSH
T109A00210174A2447C60047B62185268037608C52024312035595E5BCCCA52C45951501
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d6c9337880f8c0cc01606733020b932d91ad59bbc8bbc1a7be2e32c44ef1ad43
MD5 317cab542fad9cd79707e90f3154e82a
SHA1 b606faf9006f332462fc80532607932c57a55d15
SHA512 8f8ef6027c79eeae21e0e1bf8ed855aef618ef2b9e2b571f795e1a48583e673803a296115a6ce7a439273dffb61d6a633ba5ca042bc7fe00b5ed16e6df776ccb
TLSH
T1A4E086B146DAC779B41464C38274971DC2F1BC1697C93A4B6B0C4864A901148B7FA6D5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d407199d525283a4a216945803368122a63007bba88dc9d4f93faf3fe082ddab
MD5 3e516fc60e6024bb2e03529b9bfed689
SHA1 b84df5c7c5dffb1102af9d6f4855709b11619d44
SHA512 348b3a95a8d6cabf23b48cf2d934d72597b09e4a349fa7437f2cb18cc43fef5d20816364d6d92b6c1908470b853a3425ececa50d7d5a00227b160c1beda9a9f6
SSDEEP 96:KOWhIEeUITx4Li38TKfK3iTDGuTQIw4xslRHffexPaF3xeKfr37eDJxiLmKmuKmK:9WhIEeUI94LU82K3iXGuTQIw4xslRHfg
TLSH
T1A891254531B61700383E6A0D82B8886B56813072309A683F7BA877D56F6BF054FFC9DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d35b1998-a648-49e1-929a-56de5f2c52a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d35b1998-a648-49e1-929a-56de5f2c52a6.tmp
Size 14KB
SHA256 662ad9912029d3009bf15057e69a18546c60b5b3e1e29a4a0072a70d4ebb05f7
MD5 1476a884f3c27aeae9d7c7ba336fb65a
SHA1 2b100f09f14e9f41d535bbbef278e8b5432d15e7
SHA512 442cfa735897db14dead06f8679d8788c41d46dda67dd9b532f89787b224ae6c97ad89b7c33b6f2e7ed2c5a1c9912ed56d470b1e13c77fc4a25062b33d86f0c0
SSDEEP 192:sxRURCyM/jK1Ml8wcI/f1sPscTa7yzoA8pi/g6+WNLooH/YwSc+GbIgtJ:sxRU0CI/f1sP7a/i/5Lz/p13
TLSH
T12762D916AA385977CCDBD20DFA557F53D6F81573A2901E44AAFC8A0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b5de6e4d31241bc088946954b6585717efc10e3c0883f9b2d9e837c95f33b54b
MD5 357982dbfa39ce954fbca1e98cb8ea59
SHA1 f314c3426569c91d5e7c5ef30f4d07ad70d9c6e9
SHA512 411d3d13279cf8dbf5bcc791a98a9d4f3fcf6989577e54fcca1cbd0ccbe32b9570d74a014cbfd76349e84eb39d46cbe38a5fc9f8b8242490709dadb5e299e026
SSDEEP 768:Cj+9533AV/jy6iFc2q2dlcnSl0bCTwZWPb9M0O:x95336iiZ2dynSl6bcb+0O
TLSH
T142F29E31AC199EB38CE2CA85B24B3E57BFF4116742C51E84DDD96B0E06C769D132783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b1ce9d857cfe33ca8a8a0a6fb150ab1ddf1c6ebf524a95dcc42b955337533de3
MD5 9ea25047d47ad8e9e49e87ce580d95b1
SHA1 50a70aad55bc440b0983f14ae5c2a45cb1df9472
SHA512 02196591c10fa6a03dd12a72d258cc57d5acb7405ad54da7e5307eaaf05c6947c372bf6578546f3ad53fbda20c95c9973d635cd677939b868ccb6b5b40024f76
SSDEEP 768:Cj+9633gV/jy6iFc2q2dlcnSl0bCTwZWrVsg6nb9M0O:x9633aiiZ2dynSl6baVsg6nb+0O
TLSH
T1CE138D3DEC149E7F88AEBB49620F2A27AEB80237C1A50D94DBD91B0ED17355DF312425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a18f7e19f687d0772ed66076620fd27b0107ae5286140835a0f8bed2cf17fda
MD5 7ba8ee777b072ecd73e47c33dbc71986
SHA1 6e04c29f437229b49961e9e404cab304b0380708
SHA512 2f04c7183db72a157fcf8d8e1328ea6f567644305d2755b1008a1b0dc07a91c6fd528549ab7f50d26bee3f7e3fe7f78a781517dfdbb556cbb49df6a3c252ed1e
SSDEEP 768:Jrv+4UNbdr3nP/jy6i7q2dlcnSl0bCTwZi4Q+8rEnk:Jbsbl3viW2dynSl6b0DrEk
TLSH
T11403BF31ED58DA739CE2C685B54B3A13BEF841A356C60BD4CDDE2B0D428B59E131B862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 268fae091ef82fae8020a505b7e8e38510f65de2409b55adfc24ac822f163350
MD5 87d698176aab9862e21974cb8caf90f6
SHA1 1a28f6e3242535d6240ab7997a4c8f46f3fcadce
SHA512 6d55b558268b8bcbc7ca8c17119e81facec3e5f2f221b5e37c0985790117083c0f78ac7868f346ac7bb614a2a9d51d941aeae42042546b1f08424c6478271a5d
SSDEEP 3:MsEllllkEthXllkl2zEflVuh:/M/xT02zXh
TLSH
T1954404047FC40407C50010314155C35177F0DD500551574374D144335CC75400C41000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

09d145ad-f3d4-4537-bc2c-0531621e1fbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09d145ad-f3d4-4537-bc2c-0531621e1fbb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4664_198092041\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5892_1642243958\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\background.js
Size 11KB
SHA256 326d9688b7211fb1d363f1ae7554dcadfdf0511277ef591d43d4dd487c19ae77
MD5 bb4d515fbe39c04c3b85842d13cd087a
SHA1 2f5ae70405b61404325542e993da21d7678f86bb
SHA512 f7aa9494aa0e88fcf0897c3b21da7b12db954e40633e5001bd85f11462ad96aa3193de260e48e07b22f9564a77f0c6753c0b26919efe3786dc5c2f96c8370531
SSDEEP 192:v5XVFv9SqIjiphSA35qM4dbdUSVd0Ud9p4U/KpEMo4qQepk/zhqE8g5GjOXl5:RIUDn/STEdwQT7oEoqXj
TLSH
T1C032646A58370939657237BDAB33A046FE23413B2500878A7FBC59501F796E646E0FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\content.js
Size 1KB
SHA256 cae68eb9e63245b9b3d67de03e06cb28b7b30f886ea7485368fdf92d3f5f0c57
MD5 4353b8bcffb1a35320c8b4cd9c8f36cf
SHA1 6a7375ff1b03853b3f6687a416fb2805a88fbea5
SHA512 cf393e48176f850cf5124ab2b5634d6475d28133bdae97108501464fb11d58654a7c7eb7a320128eb9a75f85b9708879d2d3d34ddaa8ad57030856c9f6652ba4
TLSH
T1C4310DC77C9B283A4970DBADEB365945FB2A406725619316F1AC89A43F25FB00150EC9
MD5 SHA1 SHA512 TLSH

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-128.png
Size 1KB
SHA256 f9d1490575602aeb22c282b80fdc6d096d9e7eb783e659a7fb21275c5ee373cc
MD5 87194cc1cdc7d8ef4bed77aed0c02bac
SHA1 8a5498cf0c18353f97c12ea544ced2f0731312f7
SHA512 fa60b4fe72a38f111e1bfcbb932c3a1e0cd751382087eaffabf402d82a30970c2de31f4f034285e324f3da98ff5918edaa9d8408ca62beb5603ffb57bd1e6b60
TLSH
T1D8310983801035CE119A4F93B7D56C31DA2ADE85EC1CDFA0722372BB284A489C856300
MD5 SHA1 SHA512 TLSH

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-16.png
Size 252B
SHA256 f5be0c047ac80fd71f2875669e8c671d85b023bf43c52dd0c65dc08420f85412
MD5 2e274e9257d4f34f32243418c2acac62
SHA1 3bc52966811647667c0df500d0cddc14a72bdefa
SHA512 20e4756382972a4481dc09dd03192f94d22d99885ad0896d549600ddbdf6e465ba92373f6c97a02cfa45812e9c1cd218c391707456dbc27b8dcd1842d88d5acf
TLSH
T1A5D075DA7126C860CC60CB3ACCBC1013FD09313D4468178015890439022148FD268D77
MD5 SHA1 SHA512 TLSH

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-32.png
Size 450B
SHA256 81543a9c6b400ae6ee27afa3792433dfb3adf4ac03b99bb98a6fd69bac94c1ac
MD5 6549cb07555e9984b6f8801233d544ae
SHA1 d3c7749a17c87ea99e097db372868d2c5e9ff1c4
SHA512 f14cb10244e21e0c934fe9b9d1076f07606d6403c4a3e1610ad856ed7c84d939fb82d8281f03153819cc4994f1a358c52836a14807e8a980ea38895130fa15ca
TLSH
T130F023E3775865EDA200E307570B52698C331F0C001EA9063180523283B3B1C2593BF8
MD5 SHA1 SHA512 TLSH

Submit Download

icon-48.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-48.png
Size 633B
SHA256 ef04c8124ec47beed0a68b3e2445e65f6bc19b0f00bffe6f31e9c9043317b81b
MD5 c146d15b2a82b696a4d6ea85977a06c3
SHA1 8649ff8e195cbaf93c2891af6077ced9fd416b6e
SHA512 f3f0920437ddf1a240dd3ef783383509ec16dddd3eed044486a38e17164f87eb99e06fdec90c39c322d0171976f09a2a85963e1f5540727bedae29cdb43c325e
TLSH
T108F062D13EC3706CC72F156A9A4220634808033242A3803E86A3213527EED4EB8F82EE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\main_extension\extension\manifest.json
Size 896B
SHA256 d7a007aa1e923dfbd0873d568bdae26c3b92b2de275d2b1c355ed664fe3c97f9
MD5 c1dbba9c98138c355499f2f5076e1fe1
SHA1 db214bb13d7647d91cfe02b3e81a96a4fa0744d3
SHA512 bde29f93c625353e11e6256f93656c0e4ade54675233b69efc3bac4a2e2dc314f86ed20d577d4f7a7e84c2a8c922d458158cb6f104c88b62b47a886a8639d47d
TLSH
T1B2115533E8204E3303B8AB6929B24243FB20078B50D02C8FB9BE90584FB96990557F58
MD5 SHA1 SHA512 TLSH

Submit Download

pr.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\pr.js
Size 980B
SHA256 cded005c7dc6d6d8669fed3540cc12b81a5d4a4d5fc991e4f0e1ea1e038a0ed5
MD5 1f92ef0995d6a9548ea6324b5b5594f1
SHA1 62a22c1db26dea3a25e971567b82d54bd2be2995
SHA512 f086d8ccaa1e474f4ae11324b8a13e101160a2e129ace9259741793b4e4c29b421e3d182744343e6711c7441d7de93bd38750e035d283ce48ef10b5851c8774e
TLSH
T15211BDF3713250220DB5AAE57563A836E623E23F3585C281BA2D44A02F77294C4B1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

socket.io.esm.min.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\socket.io.esm.min.js
Size 39KB
SHA256 56eb37a25aaac55ee1481f278f306008881b645abe1b415ef943db56a42631d0
MD5 fd9c2d32975ac38dbb59055186830659
SHA1 4460c08fd9e3f06b1e05c813ac96a234bdd9b99a
SHA512 abd8d9cae2723e1da1548e8810967f4ffb60c9528a4d99e3af82ac04be76ea63e5a4e8c6e13ff8407c2a949fa36a07708b906d03824b4e2dbdc9fdb1de66561f
SSDEEP 768:cZozDDpC89b6HJhziqfPgC97cLhil9utGFvpk+ymUIOd68IUwGMGl8+/+nHlqUSl:1gHsQ2twsI/4NI0
TLSH
T16E030BC5B2A1506143E251E3C0750503F329A969784580ACBF6CEEF3AC69DCAB277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsw.exe

Path C:\Users\Admin\AppData\Local\wsw\wsw.exe
Size 1.5MB
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download