d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b

Analysis

max time kernel
38s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vanilla_spoof_v2.exe
Size 2.8MB
Sample260708-khlcmaev6n
SHA256 d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b
MD5 4db8e85743a1ae8b1d26a3bccbffb6d1
SHA1 57659b0847aef1d3f7539a4d31697de8c94f782e
SHA512 b8ebee81e1dd89e2122fffea636af5a024fdf3242b6e917becff9a89f6916de68d688896bacea4ac87b0179358af154244c670c24507cdf92d66d5294ff1eed1
SSDEEP 49152:DDGvk+nJmHrQm++AOtV4djxbD9bsow5zmwC4vHsrX2:DDkmHAEadjx3q7hlBsG
TLSH
T13ED59D0B7CD488EAC4AA973689B652417771FC1A4F3127D72E90B2782F72BE19C76740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 3736 created 6112	3736	vanilla_spoof_v2.exe	88
PID 3736 created 2560	3736	vanilla_spoof_v2.exe	89
PID 3736 created 4804	3736	vanilla_spoof_v2.exe	90
PID 3736 created 3968	3736	vanilla_spoof_v2.exe	91
PID 3736 created 3208	3736	vanilla_spoof_v2.exe	92
PID 3736 created 1784	3736	vanilla_spoof_v2.exe	94
PID 3736 created 2892	3736	vanilla_spoof_v2.exe	95
PID 3736 created 2728	3736	vanilla_spoof_v2.exe	96
PID 3736 created 6112	3736	vanilla_spoof_v2.exe	88
PID 3736 created 6112	3736	vanilla_spoof_v2.exe	88
PID 3736 created 3968	3736	vanilla_spoof_v2.exe	91
PID 3736 created 3968	3736	vanilla_spoof_v2.exe	91

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3736	vanilla_spoof_v2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3968	chrome.exe
2608	msedge.exe
1332	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vanilla_spoof_v2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vanilla_spoof_v2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{87A4018C-32DB-485D-B364-C459452B9803}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{F5C519F0-A23F-47C1-A78C-0410F3768E41}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
6112	chrome.exe
6112	chrome.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3276	explorer.exe
3276	explorer.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe
3736	vanilla_spoof_v2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	vanilla_spoof_v2.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe
Token: SeShutdownPrivilege	3276	explorer.exe
Token: SeCreatePagefilePrivilege	3276	explorer.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
1068	sihost.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3276	explorer.exe
3276	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1064	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 6112	3736	vanilla_spoof_v2.exe	88
PID 6112 wrote to memory of 2560	6112	chrome.exe	89
PID 6112 wrote to memory of 4804	6112	chrome.exe	90
PID 6112 wrote to memory of 3968	6112	chrome.exe	91
PID 6112 wrote to memory of 4804	6112	chrome.exe	90
PID 6112 wrote to memory of 3208	6112	chrome.exe	92
PID 6112 wrote to memory of 3208	6112	chrome.exe	92
PID 6112 wrote to memory of 2892	6112	chrome.exe	95
PID 6112 wrote to memory of 2892	6112	chrome.exe	95
PID 6112 wrote to memory of 1784	6112	chrome.exe	94
PID 6112 wrote to memory of 1784	6112	chrome.exe	94
PID 6112 wrote to memory of 2728	6112	chrome.exe	96
PID 6112 wrote to memory of 2728	6112	chrome.exe	96
PID 1068 wrote to memory of 3276	1068	sihost.exe	102
PID 6112 wrote to memory of 684	6112	chrome.exe	103
PID 3736 wrote to memory of 3424	3736	vanilla_spoof_v2.exe	108

C:\Users\Admin\AppData\Local\Temp\vanilla_spoof_v2.exe
"C:\Users\Admin\AppData\Local\Temp\vanilla_spoof_v2.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ff98bcac728,0x7ff98bcac734,0x7ff98bcac740
    3⤵
    PID:2560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,15614520914060269548,15307927338131884822,262144 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,11207974362767527604,16710986843272588269,524288 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,17910575690895255244,10195803788409515793,524288 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,5911952022607537026,4072901475423466163,2097152 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:1784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,3080429123628850190,14789460881240303402,2097152 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,6652761872676662871,13055457171498890527,524288 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,10945283581934136752,5514921256037790960,524288 --field-trial-handle=1908,i,11770456221723617023,16154676077934711942,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x290,0x7ff98123c188,0x7ff98123c194,0x7ff98123c1a0
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1644,i,13563944147650101454,5639982534593165092,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1544,i,12064049455979808838,14525603023770864885,262144 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,18352205445632756864,4690257683883461434,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,11157997608416694980,261760619217609834,2097152 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,2426769182557669974,11718780532349996522,2097152 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,9905673798329026893,3543866107567612120,2097152 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,7334273417622325242,4664117043107243876,2097152 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:9
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,5244261709443804641,16073624615259370801,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1322317803945011396,9818874828936481559,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:6364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10809673493341256842,9859925769715708898,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17327608219693644353,6425380129082987199,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17327608219693644353,6425380129082987199,524288 --field-trial-handle=2436,i,3568908518669742099,6158541054972200000,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff98957c188,0x7ff98957c194,0x7ff98957c1a0
    3⤵
    PID:6892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2008,i,1524841935687222068,2561291160707864849,262144 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,2278080573343412537,12013473763963456418,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,9142196259036557180,13562608590285661139,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13779936956804768786,7167623783433887063,2097152 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10245556503601407902,7464868026004071647,2097152 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15566447863019476110,10714185043458569218,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,8827769875871855491,14373741157018266634,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,10032832294174204132,15687907349118046517,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,9680687528226513644,17267665323634169646,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,9680687528226513644,17267665323634169646,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,219464101400142082,6026673997954818260,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,3095699256169505721,5476021479847583675,524288 --field-trial-handle=2504,i,9161023011765600674,6554762047077456423,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3980

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3276

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3340

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 6f525b9f4039570fb5d19746fcae84886156ef5d58b10cf095fe372a83da1909
MD5 67acc04ac12bd0e66864484cd50c65e5
SHA1 79b70c0f7b4c6691396c81a7646302521dde07cb
SHA512 a933de514351a2f4cc072ab44a97bca8b4ce65cd8b12eb572cdaf68a2e8f434d2e584303795ed11b56b52ca877ce8232363e1c079dcb04e009ef0c16b15aa288
SSDEEP 192:ZRG9ISwPv7DavAPRp2q99Hsb+WNnelAPKA9+VyIsnAUgR:ZRG9YHi6Xd/w3PB2R
TLSH
T12022542EBD14A53B5CCBD22AFD627753D7F5102126942E48E6FC8E2C16E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5d419091364e950e1f726ac0282fe90b1b2082f733ecaff3bf597aee94b21a8c
MD5 60a211c98142e082adc1fc2c563f0a47
SHA1 6f1aa8ca27b53c06e4238affd4065a144ca3ea43
SHA512 10f288e985977ef88e15d052616dc6930d2fafe655877984b28a25624ca82e8d44f60f87d044d6ff0a461474f140dd2be52c074dd05a7b23146af870a08a114c
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9NlwLBHxCo:3ZjyV7KxkXqKf/pUZNCgVLH2Hfgslwd3
TLSH
T1FD32EA27998DAA7F4FD8D51CCC566F4B6DB5029633280C2452FFAD0803A97CE114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7ac37afeb2d6c9aca11ed3bb62d3de4f7366a28ddf4aa2d9a1fd18739d3e550f
MD5 9988e6a91e35a9b2122388caca9d5f41
SHA1 465bb97fc28557eea3f154b3e0c75309af01db44
SHA512 2492801d7b166ec6b983cc951dc2c53457830a549377c51279112db85200c7ede617ece73aa6880d7b8913d8c9f1b6afd7d019c63964838ca50cbcdacf6a3a83
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok51sD/B64GyvbNsbxYbcLDqv4a:8ClTjVWDUDcJgosbxYbcLo
TLSH
T11BA1EA71A4799D7764BAD489B5423B03CFBC70ABA5919FC8A9E81F0C01F74E91302A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 962fb79c23891276f39f2d6dd11bf80e3ae58b1879330225c642577f4a77ceb3
MD5 ed4b798a8fea9ff6a1d95ffada201f5f
SHA1 5558df665c46f88b9c6df530237289e48eafb316
SHA512 677ba5d1f0128c832dc593aa3cc75588b8d8602907ebf5e5fad4cbc897f681b65d3e70ab88779e7a36c2c74e0069956efcd2193069a3b84ddc4066d15c24b77b
SSDEEP 96:FuC6Cd+T5Kj8OfQo1Ar/Sl8h4otop51CD/B6MGyvba7FxwzzlYKLI5qxS0j9ISbn:8ClTjVQiU2iJM/7FxhKLI5qxSU7
TLSH
T15EC10871B87EAC7666F7D945B5033B43CEEC60ABAA409F98E5E91F0D01E34AD1342522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90939ebdf681b13512eea5dbe2b62fd61537c7fca4b9c5ec09348216d3bb2392
MD5 81739c1bb55e2ce8f94239f7ccde685a
SHA1 e7a6fb5c3d2a7bf2ba08073cbb1685b661544fe2
SHA512 42290e031581a70649548bbb81ce088c949e169ff07e01b814c94ed264f298e477e0e6bab3fb77defcc8afa9bb458e0c165e5d88fa46c8095970860420f97cd2
TLSH
T1FDD023303A18F589C66530335C51630567351972259283055054D41DCD755C167F79DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c105df749234003df5c74a2309b0c3de140858938b3fb0eb27f0127918404a46
MD5 d27d449ef346eba41fb5188abfe7b75e
SHA1 4c40f09835c94d36b8e94e590abc69f482e37224
SHA512 9db8d1e09d8061a543137666b72e380df05beb3ea2198a3df051f8be6f095b4abda9edbbe7aaa507bebf06dcdec38de254810c600b0babc8825de431c5beea49
TLSH
T113D080343748F509C59570325C51B355633258302496C70550A0E15CDD7558163BB19F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21f333a185cc7c3b450697df1cac5665c229fbed7742713107227614559ddb71
MD5 b3b0c229bd36110389af54588c1db5d8
SHA1 b6b900596ff3253f7b1fa397d46ceaef9c934ed2
SHA512 c73323d0ca52e6bdd4c53289fa3132cad84569823911b5dc7191cac253ee7d0fdf5fdb331267ecb5e20f21c834530cdaf68fdcbb2148007f2074590f3afcdae8
TLSH
T1ABD080303748F40DC59570325C51B355632258301496C70550A0D15CDD7558163BB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 1012KB
SHA256 bb1250b6430e81333f81089164e819e36f163f8d6918351cf6de41b334a8c633
MD5 50152ada45510d223288e62e34d51787
SHA1 d857fb8d6e051fafc47c833771c1ef9033cd89ca
SHA512 6684503143b31b819135cc88c3e985d2ede6206b8629ca79465c46d04f63ed8ff4406c5f2174c39d9be834e428342ed613aa691944f7dbc777096eaac0608c44
SSDEEP 12288:ZlfBWQx0LxbHMsM8BYAbIg7G8F63R73MDEiAtKBrk75E+ZLFpt/GN48/srE7b:ZlEzzMTZMDEiAtKBrk75vE
TLSH
T1D62523CAD7F079BF0296A852FD39B89D13B919808070EA3B4FED454F92CDDA4815B391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 e4bc641d64dd3c2e27838cec1aef31c793d6ae265a9ac69f46133199edf9030d
MD5 a8e3b560c3c5999c3e9bd03abd01e9e1
SHA1 c7dc010f8d8204966db6b4bf8ee32c5561457c36
SHA512 f58d8b3fcca5da28f69b680d660099cce418fa4fc158391329e912884c8bdd6cde180dd205f2e566373e81f1611df88c5dc1e21f6378c8137e715c96589ab6d8
TLSH
T16FE080D82AD9C25D5114654B439C434CC2D13B1A96CDFD5E2F1488DA7242545FBDABE0
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 33c57857d1092bc3364eea70e971bfbfad285de5612da1346b4d452e3ccc6988
MD5 243ff612d25b1c44568059e886305307
SHA1 6cb13eb5b522be3fd817a6345922bee625ed1470
SHA512 73493c21f5432a52202acb17eae6bb39eb962dd48173d225a6f03e78892b069ae0bf38f5d0edc137b9f207267640fe2ba38d22c6a49a91c697a315f5c2c67c0a
SSDEEP 192:xVT9bZWg2jzyJff2U7bqkorKfzuzzmvN8Crj8fO+dt7CBiksYG5R4Qwc2P+I0:xlygEzyZ7JW+n2kERF52P+I
TLSH
T1BF137E7EBBC09F52D2E7873E814FDF312334C66ED9D15913163A34119A08B45AEAF209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 20888d03abf8f2d7c4e62c4384c0b19290a7ebbf385db079c188248c6f555b09
MD5 84ba4a101073b414964a41712f61189e
SHA1 578f07b3cf8c4ae1cfd4c27fa960df762d22680d
SHA512 261596adc9fb847a0b30d5105fec7afe6877fffbcde10a6a93ec6606fc4253eeab7455516cff9490acf7bad04ce7dd2f41085a90681a9511a8d1b6cdc484fd56
SSDEEP 1536:Xu4MrL/asL/wAqGZGdK9dvSFRdg/NRseNIaGUZSXKQNlEL/sL/DL/F:XqrL/fL/BzvX7PlE+L/sL/DL/
TLSH
T19B444FF70951A11BCBA842F5D2037E3DD17B815E6CD1F8E9E2784C852829F31B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 977de07af0e10e9faaecdfd5e0951b57129a88d8819c0d14f0094d004c35ef4d
MD5 1e6d8846fdc63b0895190894dfe7cfcb
SHA1 32ab8ac63ba6ba7f60c219ccb515a9595b920b41
SHA512 27803a1ca0d4023579b76b0abf750e27d6a186d69af248bcf193ab92248f6a4c7fe6a5acf09fc9a22a797a3d61c9aa612cd071f009a351d453c3d8f0d7bfa9cb
SSDEEP 1536:ii49G+PNaMuANR7Oe7587cW67Q7piH77s7/7y7+7T7BDz+w7rRe57n7S7k757N7W:iv9G+HNwkoniHYGTuliJ03WmhoVWDk9
TLSH
T1062518EECB682C82CE6B877470E0E9077E712183B64DD0D39944C5D997D6B8176E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 ae3586652b8641c4a6781008e9d22d8b397865271df314c25d48a75be54d55a6
MD5 f95b5ce971040acff2c08fd3b0175c19
SHA1 5a7253811c9ec4af685998ca30c9ba14a3588bad
SHA512 a37ec09dddd8f8358cc4758a22868e675e9c915089bb576676ae971dcf3e25be707ee7ec9f1a653361ca43d2691160387530b41046f1e983630fb3c87a21fb49
SSDEEP 24576:RHqU/l9ScxTADyL6XZAqlbCAjJEljJ3PR8RNEXAh:R1/3JxTKyL6hlOW2lj558RNEXW
TLSH
T174167DEDCA7859C3CD639A30B4F0E9877C7413C3F994C1D6C898C584026B7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91d6c846a0f6716d0a165caeb766b565233cfc831e3b26807292f8f83a6e8fc5
MD5 772720bf55ecc2740209d88be32da55e
SHA1 ee04c72e7462ccd9bb1a1565fd0832981e032ca7
SHA512 a4131ea6b3a1b180daed7bbdd52feb2a04e64b2483f6d07517028cbef6b067170a884779860b358333cf448deeb2aa37537bab12d8fc330b77333c96f3fbb68d
TLSH
T1686150F4D7310BD5D734CFB2B5E2E8AE3DB6548D504BEF006C90A0742886B69A4DD050
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 abad53c2bee487da52748b8a5de9dd4168665e78c9d4feb51637f34ca1efa76a
MD5 4a35f178144ef97ccf42c6bbe3a65806
SHA1 72ab0db9f3337f6f357029f97f6883b92c76384b
SHA512 43e9a23c4f439608d4f32988c5d3239d91c46dc6a77bf34eead07a57f7a3ce732d3c5ed0ba32c897e9c88927a2566f6e8d7180685ccac3241e2be5a9dbe5a090
TLSH
T11FE0D8D877C6C11E5511388A826C574CD3D13972D695AD43AF108CD47703042B763AD6
MD5 SHA1 SHA512 TLSH

Submit Download

domains_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json
Size 128KB
SHA256 bebbfe4cc71fc091339bb3028cb2ca5a079de94406777f4fde2edcce6b53e176
MD5 35e15ddca3c102e79796c91d14bbb1a2
SHA1 e21661a21f58216c43d2e78a3c6e3da603940a58
SHA512 f8eb4dcda0eae10b20b9123b791b481ba0f41809d01623686e42fc4db052312391bbf3e4ebf6fcefeaabbc1ea90741f50fa154b93c96286144993d952df7a7d2
SSDEEP 768:OgXv3f+MKGMACimkMAQeeE+GCsk1j2zk4PCAziRQVFzfZwkD4q0MOu0MGWs0GW+g:OgT9CAziRQVFzfZwkDHA789VnDA54Z
TLSH
T196D3164231FBEF3B45DA970836877F52B76C1AE5406CFE65BFC72C449AA00A4B362146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0331d1a604a6ac5140f9c960b9a706faa643f7154561f226678692d4c947862c
MD5 641418d9ee2c4185820b0fb1e71a92dc
SHA1 2b9511b39c740174fe4184b9eb5eb9b7b69ec380
SHA512 85abdcc1dc5c0b1f4f820823dd3c2e74d143bf9920994003c49c82841d3fec7e91e8ce2382179a26d3fe24e758e2762a8a3e70afd2dac62c648644cd871c8515
TLSH
T11BE0268866CBC12991247A97826C530CC2E23912A3883E0A371B98446341681BB8FAD0
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d2d7e1bd2353b5d6b51b74bfe5d12cefeb975b97956ad6e47717b8a58decd614
MD5 57a52d60f293230a1303628019a016dd
SHA1 7794c5c04304449aad649ec92aa09d891b3eaa86
SHA512 e85f8687ac382a57a51e85e03d8c786f3ab4e200269e64bff68b107568f2e405e4d9a5190b229ea220054792857508f16ae09653735b173b21b5fc6f5567660e
TLSH
T120E0D8A477DEC11EA14820CB8238770DD3F23916E68C6E432F05A854B106004AB8D5D1
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8cade9a0b24295962568ec71aebcf80d2bd5fdb552e68374367f34b495f42901
MD5 9a4f4bf00ad30b6023e4efc584f3952f
SHA1 201b39ecd71364c64d54dff9c849ce9ba9780d3c
SHA512 b1458ec956a1a9503a62ea618e800d5cbe09769c2409b78c2e978c4143bb818a942316805a4ced1a92e85bc564b3e1234e2067db2a37febc0b9c01833032de7b
SSDEEP 192:sxRZyRxCJ/fNscHGK781zoA8pi/g6+WNIYtZIZl9WqBGUIgFJ:sxRZySJ/fNscj4Yi/5IsiDXHv
TLSH
T16232A5166E28A93B4CCBD21DBA667F53D2F96032A1D41E48E6FC871C05EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f405d99d57a1284c39b6b11b61811b7383552dde9095eac2a8f22a95cd36baa1
MD5 61df7001d042991e05ec6c72c3f761fe
SHA1 02c516a0489a51d44aeeee7e4477e4986bfd5206
SHA512 698e1beeb33c21f2ce28ce3001902f951918502c87a752b8bc2ea9b9cf7c955f6435fd20e1086771a3785670733a1fa67f49fafb537f682d50a71539cfd5074f
SSDEEP 192:sxRZ6RByM/jK1Ml8wCJ/fNshwJOZnuzoA8pi/g6+WNIYtaIZz9Wqq+GUIgtJ:sxRZ6H8J/fNshCoTi/5Isb1Xqq3
TLSH
T16E52C815AA249937CCCBD209FA557F53D6F85573A2941E04AAFC8B1C05EB6EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1d15b93556c42c66c11e31ade66b596dbf48e0bf12f05a46bb96717001441f5b
MD5 12c38ddf36eee8297d9b747990ffd5a2
SHA1 7e33bd97b2d860e9bcf515570200ceb528aca32a
SHA512 fda6fbb8929dfda1c72db547bd3c3b65db57a87c1e77c876e1e45f92c721914222871cbf25d862607f10eebf3bd90ea4f9ba91ab2dc68f27631d5d772a057abf
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEA:dOwS1wBzwRbYE761wiWg1zwsfMZwKu1h
TLSH
T160E2EC3B684CCB7F4F404A9CAC29BE9A6DE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3ddcb354774e2da1117ee37cd6db24691d7d08f7e74ba6936f67944bb22be5a2
MD5 ef17ddeb191627d55f87c46264b9958e
SHA1 1cc24d1b27f606657458aec01ddc672dbfdd4500
SHA512 b42d48bf3f41544162cb14d953afea75700068f65cd58f6780970e9dfb5b439a9871632581568da3920da7bd26763e1ed4fab15c679afd51d726748d60922ff0
SSDEEP 768:dOwn1wjzwRFU7pLuL7u1wiWg1zwsftZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEq:dOwn1wjzwRFYE7u1wiWg1zwsftZwKu1r
TLSH
T148C2DB7B744CCA7F4F804ADDA8297E9B6DA802CB5698CD8087FE941C03C77EE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 9d38736add718031d189af492f3a375b2f79fc08f6c49adc92138b902590d6d4
MD5 e6499579152236aa76948735ff6b3f4b
SHA1 bc7714e585fc9e68631a0de6c4c14135db88d5e2
SHA512 b0728f45d117591055a532481f316b8a88bc8859ccd7d6a38eba53e6a8bf84b5242adc4031ccc7c11bd2e9cfb668600766872d9f874be54510582030c59fda88
TLSH
T1C6E026E427C8C1BDA0163257022D834CC3E57D77F2C8BD063F01D8E5A382584B2A66D0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13427973436353118

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13427973436353118
Size 979B
SHA256 98fa62bd9911e9b863d3ec210b33d56143ca2cd8e8cb056c6f7b9b560e1cb378
MD5 ee330dcb5f461da19b79d62eff821e0b
SHA1 76b93cd3d3d68a461c6de96b29e2787346729039
SHA512 907d5ebca36ee048374462d4463573a343946768c8395f7e77c35310937556eb73fe17e2ca51bc717cca5103612f2e99c0ba35eef50886b39660a170c683f1fe
TLSH
T10E11F6164850023ED5FEC57ECADAB6D760305C53D28E0C466251B2B0BBB3AB6265CE5A
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13427973437099260

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13427973437099260
Size 848B
SHA256 5f5686e09c7d9c78252c71bfeab28b8c168ce6b05973bce68ba78491c28958e3
MD5 a9397bf611c7a333625ef90b89d1c37a
SHA1 4315b79e307b6b412bff963de66f85e354616fd8
SHA512 21cd1fa2b38aa371babcd13b606f976160c82e6c397f103cb40dc0414c68b32d95b66a4afe0a2ca1da5fb9ab4e92d523451e6c575ea20db4f816336eeabe2843
TLSH
T1FD015C1A9DA04637D57E4CBEC4DA02F1B920AD01B2850C0703C1B2A1DD32BB73F18C80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 092275c58c2b6eda14caf1827f8aaba525ba162e4da67e19ef967014002829d2
MD5 68f4923d8c4ed2b49cbb053a4ea3841f
SHA1 d608a49020214e7de5da170478396efd58523baa
SHA512 951bd7cee6f90d92bbba4ffbdf2bf251860b02852f053d116b587c34d37b7d3efcc72f9bf53139b6808a80111ca24b0f66585fc0b6a7fd0bed2890d94e5df155
TLSH
T186E0D8643FCAC2AA614B218F4218DB0CC1E37972D6C9EE123B09A5946347280B343A90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 38a06273ce0d0798ad624309415701549ee6dd36686cebe1bfddacd077363248
MD5 cbf7b83bda895b25f5bdcae96cd28311
SHA1 b79004264e22ea01aadcc4eddb9bc81285ca5909
SHA512 f6a1a65420f8938ac15ca9ab6d72e074bc2a270bd05ee63bc7a31cfbb2cfa943d77d51f83b445fa72666909d945286392a35c1da5eee0164294e10a6b68f6476
TLSH
T1C7E026B467C8C2795000B0C7426A970DC2F17D6A93C9BF026B0858E5A341100BBB6ED0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 c311a54db7a6b71c105440eeba34100369e47dfe86cedd06b9211e0378ac935e
MD5 ef69a18ed9322cd4c7528db6264e1c41
SHA1 2301e599f64dc66610e6a0e4bbc8dffda969ec12
SHA512 0c3250ee7b505afafd2df9c892e486d93928a4a5d015ec29c68fbddc0cc4e95bd74266fc5d33a7a8bd33ea05eadd2066db4981079c9880aaf012bb339a21939f
TLSH
T154613248333B26D0787E285C8554A8D7D2C271A2311AA43B77B915F25F27E029EFDCD9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1aa6468338ea34d6c55fc8c41954e842301af955f8f01ccd4c7dbabf200cb5ce
MD5 413de1e042121810a06e535c65e678ba
SHA1 dce040d200b3593eea85cb66a9e7b25b9b827db4
SHA512 abc947dd36892056dd2dbf53e05f3bf6f644b0bbdc22428adb182155d8ef246163877776d8f39c86e3566d2b04fea651b6d83b40b1f8c19731a2ba99662ee718
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHN6zn9Xr/WzoWgv/K4ugR/cVtgDbUHfIta:Cv4dZvtNs529BLIgvO3f+BtiHN6zn9XK
TLSH
T1E9915348323B26D0387E6D5C8594A8A7D6C271A63119E43B7BB805F24F27E429DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 67e205e53ad6baa52b97f3a29f16ec83a1a29019fea7064c61325e03f7b09005
MD5 7833b35b4ba4966450aabd993e9e5149
SHA1 e494faafbc5bd4817a9efd0234d09b8b21736b29
SHA512 395b2d6f9eb8a01ab81e38af29935ed24a68f1b7240b88869a6f38f8561cf18ae438f45082f272d0b3bc1c971e37489e5e28b80a69f6ac2b7614d151cfa4c355
SSDEEP 384:zN5RZyCSDnxTICjMIMEhIKyll7svbFKfk7:hHZJSDnifyI1l7svbF9
TLSH
T15444850A7B747001EDE6D9725CB080771E3CB16DCF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json
Size 19KB
SHA256 5aff8c44b87ea4ce18f920e968b12704e9905366d716a99465e2de7aa588505b
MD5 73a472aea2a998a2af88f6c61bf0f4ad
SHA1 7666b8d53304ab3101a234f363cfaf17d3273a4c
SHA512 4b4d8f9cf5f708c4fd2cb0022404aac7f665cd7d8af4fa642fe9b44bf31de9d5572b8f268b6b401911cdb57189e22a84fb6630bd37cc186aa8a637613776555f
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzYOq59/Z2ef8Hw54ecoaSbqG/I5zT8/:vQeiKF0jojq4uGEigefsSraSbqG/d
TLSH
T16292C150FD1B7D6F3BBAC0246B9464475CAA879EA874900AF2BCCD049FEDF240216D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 aef4bdd5e243224481a3bba3885514665da86faaa88738990077bb7f01f9c3dd
MD5 f93e3c0ad2c2d781cc0ae0ba54a1624e
SHA1 e0c5f44c2b426c4433cadec2dbcd2fc368a1f94c
SHA512 f7d442f1458e5ede97d2e709ee216c01b8f572a76ae3645adf85ee63e73a06cb2f10bfcce94e40350b8fffdbc8df53504bce7264eda53165d2615ac2842fbd22
TLSH
T192F0A8C7AE021977CC0294354133AB82FB259ACB046464A743C921AA1A2E2F1C9DC0E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7647b01c2b993f504b15cf5f75f1748f410765d0c4a02c88885c31f406ee679e
MD5 0f6717ebcbb1c603d51242de087538a6
SHA1 a8188c7d4c09b43343f0a50893bfe46dcb08978c
SHA512 d77b871e6793414c1b0e1040d69131a57b09c33396db235e3d377c61d7f3b47d964a060c847be45b2a89ed0eaf00771c7a1f156e6c35f93fc73b118694717846
TLSH
T17FE026B4BFCAC16EA019228F4128470CC2CA3E13EE8C2E062F01C858A641101B78F5D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6cbb7073257ca31db68d6fe4594212cf86c3a4419f3f61404b552612b690fa4d
MD5 71879fda5ee92f46f275156dfa33b053
SHA1 1907352ef99dcfffd6976d79bb58dc4a66605d09
SHA512 716ea20ef5d4c263a96846897dafe1236ac4755ff5c5d632891816ec8823905b201149f91e62777eba920789255e9b9a64dee9e931c20be2a4b4acd8696129cb
TLSH
T11121B516F330D114E15A827E647F9B351738D8168FBCED0F44B520646D75B440E8B7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 470aa71a0bc52bf7331104bca0d5e313df703c15855f523300a2280ad4aa8909
MD5 a7afae92dd4cdc12a6f0abf6a1da2ef6
SHA1 25fc373d7923e05bf00a6569cdbcae325a0820f5
SHA512 d9925313060b1e06a91c6fe56811ef95394fb2bb79030c241101069142d4de93a1bbcbb1d45a37acf0e1ae2ad3256ff660966e2f7fb7181f5eb1db97ed75a5d4
TLSH
T14DE026D4BECAC1AF9059318B4268874CC2DA3D23EE8C2E022F01CC98AA41141B78E6D2
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 687d7617d74e6c9f2f99d949dae79abdcbbda8141a1c10bd3ca647d627a3509f
MD5 d3da48f5c8d7c4ce9cb1a21a52461d03
SHA1 879b1211a14ed216761af381d124a85ef30b5f88
SHA512 e0202e3792f575a99ae9f2d16a382f588ee45bd8c7d8d210011aef0f0e7f1f8c9b6fd35670c63b9136930380ef4edb2e9b18ce9dabf133b3ddc3f132721339fc
SSDEEP 384:nfHtNn/s3n9S238NU29HFKZ5cu/z2fppPQuvbf9v4lIvuh3n39WoBtAdEF7jgHKk:fHj+9t3rx4h5/u37BtAwjUSzWdMjg
TLSH
T1F5F2AE72AC509D679DFACBDAB21B6B429FA051B384C51E94CCE92B0D01C72AD1347937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2b714e0fc48c72c8fed130e4b2fbda1b69447a3554d1c3419ea56815d2b58af1
MD5 4aec1eff97ffafe035e8f6967dc2599d
SHA1 3876c2262e636e663026431a7531572b552cda56
SHA512 8a1221fc25085bfaceb1580d217e8b3d074199598e08b8a013a40a2674cd1e995a24947a427230f0e77323a8421c1e2efa55e28546666e70c7e2e4bd113fba20
SSDEEP 768:z6rv+4UNbdX3Gx4hGu37BtAwjUSzF7cynh:z6bsbR304IuoTC7h
TLSH
T10003BF31A85899739DFBDB85B25B7B43BFB410A385C51E94C8E92B0D018719D230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2735ba28c235e9699ad4f8bbbec5ca5d6b618e7902b4874fa7bc237f295dca0e
MD5 24a9173889f73bf4d821165d9cff0d73
SHA1 3ddfcb69f12ca261f719cb70da92137361cbc310
SHA512 73cda21190ce4fd66a1c3faf1f2c044a98739c5e1b08dfb1fa011a0ab7326a52c23b9dbfbb8ddb5a830b386f54f7f553a24b99fa40b61d2e6f98e5958e26a01e
SSDEEP 768:CIrv+4UNbdX3H2He4hqu37BtAwjUSzZAUikB+:CIbsbR3Hqe44uoTFUJI
TLSH
T12A03CF32A84499339CF7D29AB25B7A43BFB45063D6C91F90C4ED2B0D428B15D234BE67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

fad24888-c1d3-4b19-b50c-48797954b9a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fad24888-c1d3-4b19-b50c-48797954b9a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

08be486a-27e7-435f-8cf7-7ce0fa3278de.tmp

Path C:\Users\Admin\AppData\Local\Temp\08be486a-27e7-435f-8cf7-7ce0fa3278de.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14615f97

Path C:\Users\Admin\AppData\Local\Temp\37f59a0c\14615f97
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed9363b0-a60e-4dd3-bb0e-fe304cf63773.tmp

Path C:\Users\Admin\AppData\Local\Temp\ed9363b0-a60e-4dd3-bb0e-fe304cf63773.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6980_164090996\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3736-84-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-76-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-93-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-92-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-51-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-49-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-46-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-52-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-38-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-37-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-32-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-105-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-118-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-108-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-119-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-121-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-123-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-124-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-125-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-106-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-109-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-100-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-98-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-101-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-95-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-57-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-91-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-58-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-59-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-67-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-68-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-69-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-75-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-94-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-77-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-78-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-83-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-0-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-89-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-82-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-79-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-74-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-66-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-61-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-53-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-50-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-44-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-39-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-33-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-28-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-17-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-15-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-14-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-13-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-12-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-11-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-10-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-9-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-7-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-6-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-8-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-5-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-4-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-3-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-2-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-1-0x0000000410000000-0x000000041021A000-memory.dmp

Download

memory/3736-3520-0x0000000410000000-0x000000041021A000-memory.dmp

Download