f549cd1e2c50a911914e8654152bfb6cca870df4686ad43be32ab6a433ffb18b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChatGPT Installer.exe
Size 1.4MB
Sample260714-j39qaahs3j
SHA256 f549cd1e2c50a911914e8654152bfb6cca870df4686ad43be32ab6a433ffb18b
MD5 99aa576b58b8ac0bb000480bd3d6b15b
SHA1 258ecd903679405d6d282dcb3a23277f6448083b
SHA512 20f6c16c864796a9aac758da38eda36dea619c6c16fc5503a3d78fb041f7db9e378f4d4c8337b0fbdb1905ad4ffe98b9f704dba1bccf1717d0128a8c8e695191
SSDEEP 24576:jP4Ovf+2DR7BWYpqqo44usW4z3VBW6pIp/:TvD7VlxsWA3BY
TLSH
T17F654B8127F80439F6BB0F79BD7A18210A35BC39A912E69E064D552D18F2F16CDE2737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
130	2012	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2316_151743497\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284903956351639"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{1AB71758-328B-4039-A3B8-E5C30C2686AD}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	ChatGPT Installer.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2316	1196	ChatGPT Installer.exe	87
PID 2316 wrote to memory of 3384	2316	msedge.exe	88
PID 2316 wrote to memory of 2012	2316	msedge.exe	90
PID 2316 wrote to memory of 1304	2316	msedge.exe	91
PID 2316 wrote to memory of 4468	2316	msedge.exe	92
PID 2316 wrote to memory of 1304	2316	msedge.exe	91
PID 2316 wrote to memory of 1304	2316	msedge.exe	91
PID 2316 wrote to memory of 4468	2316	msedge.exe	92
PID 2316 wrote to memory of 2924	2316	msedge.exe	93
PID 2316 wrote to memory of 4864	2316	msedge.exe	94
PID 2316 wrote to memory of 2924	2316	msedge.exe	93
PID 2316 wrote to memory of 2924	2316	msedge.exe	93
PID 2316 wrote to memory of 4864	2316	msedge.exe	94
PID 2316 wrote to memory of 4864	2316	msedge.exe	94
PID 2316 wrote to memory of 2464	2316	msedge.exe	95
PID 2316 wrote to memory of 2464	2316	msedge.exe	95
PID 2316 wrote to memory of 2464	2316	msedge.exe	95
PID 2316 wrote to memory of 2680	2316	msedge.exe	96
PID 2316 wrote to memory of 2680	2316	msedge.exe	96
PID 2316 wrote to memory of 2680	2316	msedge.exe	96
PID 2316 wrote to memory of 2952	2316	msedge.exe	97
PID 2316 wrote to memory of 2952	2316	msedge.exe	97
PID 2316 wrote to memory of 2608	2316	msedge.exe	99
PID 2316 wrote to memory of 4092	2316	msedge.exe	100
PID 2316 wrote to memory of 2608	2316	msedge.exe	99
PID 2316 wrote to memory of 4092	2316	msedge.exe	100
PID 2316 wrote to memory of 3276	2316	msedge.exe	101
PID 2316 wrote to memory of 3276	2316	msedge.exe	101
PID 2316 wrote to memory of 3276	2316	msedge.exe	101
PID 2316 wrote to memory of 5956	2316	msedge.exe	103
PID 2316 wrote to memory of 2800	2316	msedge.exe	105
PID 2316 wrote to memory of 2800	2316	msedge.exe	105
PID 2316 wrote to memory of 860	2316	msedge.exe	108
PID 2316 wrote to memory of 860	2316	msedge.exe	108
PID 2316 wrote to memory of 1800	2316	msedge.exe	110
PID 2316 wrote to memory of 1412	2316	msedge.exe	111
PID 2316 wrote to memory of 2108	2316	msedge.exe	112
PID 2316 wrote to memory of 872	2316	msedge.exe	113
PID 2316 wrote to memory of 872	2316	msedge.exe	113
PID 2316 wrote to memory of 4176	2316	msedge.exe	114
PID 2316 wrote to memory of 4176	2316	msedge.exe	114
PID 2316 wrote to memory of 4176	2316	msedge.exe	114
PID 2316 wrote to memory of 1448	2316	msedge.exe	115
PID 2316 wrote to memory of 5896	2316	msedge.exe	116
PID 2316 wrote to memory of 5896	2316	msedge.exe	116
PID 2316 wrote to memory of 2680	2316	msedge.exe	117
PID 2316 wrote to memory of 2680	2316	msedge.exe	117
PID 2316 wrote to memory of 4580	2316	msedge.exe	121
PID 2316 wrote to memory of 4580	2316	msedge.exe	121
PID 2316 wrote to memory of 2172	2316	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ChatGPT Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ChatGPT Installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PLM9XGG6VKS?ocid=&referrer=psi
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffedd8cc188,0x7ffedd8cc194,0x7ffedd8cc1a0
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,14750350649232138871,9716450526422673505,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16704984137435033282,6017438354117193738,262144 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,1485828487558623503,7264717925629465672,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11296845910673039410,7523974557338401692,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,11500197817659500155,11763317316923409180,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4392,i,3141604922649921599,13466104781602525141,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,12009225631640972442,14415370509309626829,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,5219196583511241008,739034174916723842,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,8338566389173710031,15801945761435435718,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,8176625544162781408,17862349712624328688,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5560,i,12983251389283635767,15095220560522437493,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11295989745136433391,357685678636946935,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11295989745136433391,357685678636946935,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2540972232700264084,18070225105748425264,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8752979167330177420,14038715103923725955,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,7457187359074298554,8549386009033834592,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,14197654056275875934,9664548593390686075,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5705722341251530002,12146114480835404267,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,240113739789386801,3393204810000651047,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3624,i,9331813341642349034,12495930297442992647,2097152 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,6879654964720664445,11582045754484524072,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,2968937950873705019,7103480680374810064,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,12800490499655782147,3915960749907311757,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,8394248171984680015,14157942405543572471,524288 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6328,i,6158960087323684224,1300865470689669314,262144 --field-trial-handle=2652,i,9591485949902135358,8265427441012623361,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8c2bcf6a1280c3a5884dc66d25313a98c1864ce0ad38cc2b51fe56742c2d4b91
MD5 8d6ab1b4cfbde2a5521c902ee2e0ff09
SHA1 1aadd0811abf133028ace84b8e458b9b3054afb0
SHA512 6a28126c668439aa9c4e71653793c25daee9dbe9776e95d44c81c2d59b479e432bacd5ee61d6e1b499b237cc10fee26bb30cd69c47a24749d39f3c4d1cea4d51
SSDEEP 96:P4RzaXyZmTeOgEFj38yFlOcceQ2qnSiwv2Bdsu:PI2GO5dlqe3ru
TLSH
T12A9152554B2F8AC8CF25997653E894F8BFF044B9B10FEFF6687059B0180EB2452E08A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9ced81b7344f2f2bba50b3214977b022b9e2e65456e898dc474c7a8964a1db7f
MD5 90957170d8cc56c7b4dba351ffc9a829
SHA1 19cb4caff682bc18df8037cff9ec9a6a97d174fa
SHA512 a7d4d978804c673311661f2661ec460b1e6f401c59531c27bfe82d4d1d6630a95f43226f5d9716c78d75d70753baa1274dce4274aac42363ee1e6e9e76b5d343
SSDEEP 96:Xy4RzaXyZmTeOgEFj38yMlOcceQ2qnSiwv2BdsG:XyI2GO5Elqe3rG
TLSH
T16B9163554B2F8AC8CF2599B653E890F4BFF044B9B10FEFF6683059B0180E72452E08A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0745.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0745.TMP
Size 3KB
SHA256 027c3de9a0a17d708d39d03fe0f43c9cda1be338d08fdb96d626af2d729de4ac
MD5 3b1aeb4e05e0f82ce1d7b85b4e22e158
SHA1 52d6dddd863f32d0fe37033a10994063ca5f3996
SHA512 913ed8881c37ec39eb4fe42da73854600a411bfe2e9bc78a58ddf63678315f6187286c059f4fe733b1104ab5775f1ebcbc92bae0f58affe1ee91459f884d5579
TLSH
T10D514F5A072CDAD5CF21857661E8E4F9BFF08849F10FEF3778705D705902B2462E19A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 692fa5f07503c8867493e78e099742edcb8a0004336228a4c1e0a97c7173a41e
MD5 4924a1ce5643761875681cb310022b2e
SHA1 b7da249f5900f723897a403e7c5786857000c7b9
SHA512 3a850813972b42c654ae0d2684c0e0813c6daf3fb7365c69374f29e23e3ea1a210c9e351dced2a90e1972b8455750a57234f5f6e2a473ee3bc6eb5c26ea67537
SSDEEP 96:DlO4JZpaml6zBPs4b0MvBQGwBj6rUYbqvBsuBABewd6:Do4JZpaml61E4b06QGkj6rUUqZL0eG6
TLSH
T1C8816DF783E4856E991196F0A618AE2FDF1D0515431C3C6989E4EE27D3E3472E10265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 13c3d3025e171c31d57d2d3d9977f7f6fc3d1daed68cccf3028a4e29ff177185
MD5 f52a8e64da8be3f7f64fed9253933ba6
SHA1 b568d3cfb4f82938082b8f07f50cfe64ac8b4d54
SHA512 3c77f3291903f45eeddfe7598afe619d39f3271c55608f455989ba3e0b4254480fe012950c8e6c2a0b9795265f7719abe2e5e335af542362173611f9849ba5ab
SSDEEP 192:sxRHRXyM/jK1Ml8wCQ/fbsCW/SfzoA8p9P/g6+WN/Q+/atL4BlZ7D4s3+GdIgtJ:sxRHf8Q/fbsCWq2x/5J/Z3P3
TLSH
T10462CA066538597B9CEBD21DFA557B53D2F91563E2901E48ABFCCA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bd905dbaf6a34be2e6dc79f6927d8eb4165f7536f259531f1a9aa896e0a1596a
MD5 e91b6bf66b7faa9778aeb5041f495e66
SHA1 418049d9bc7f812415437b456fa1d9ad29b6e011
SHA512 06759adbab926ae76cdd8bb35f144f15dbf7053f2b81acc573606412d4345173aef707863a353e5c778b9b4a6e7724ce855a7c13a010321357ef437e295066b6
SSDEEP 192:sxR4RXyM/jK1Ml8UQ8TQ/fbsZkrZujfzoA8pLP/g6+WN/gXXatL4BlZ7//s3+Gdz:sxR45quQ/fbsZkFo2b/54XG3Pz
TLSH
T11462C916A534997B9CDBD209FA517B63D6F81523A2901E44ABFCCB0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eaadfeb382b43f6687f74f5d592f3e64307f4f7e85bf3708b10c4a8cbf8f7e26
MD5 5327ccc96ac0671cfcdf963b6443c97a
SHA1 8ec964de773c817571633b90f17c07c9a18a5be6
SHA512 ad9de91fbbf2f7434c2d77936403f7025ca410c12c7578e546f672469834a2222a03122edd55321e80e73963726f4c576c172df925153668a3651563659362f3
SSDEEP 192:sxR4RXyM/jK1Ml8wTQ/fbsZkrZujfzoA8p9P/g6+WN/gXXatL4BlZ7//s3+GdIgz:sxR45FQ/fbsZkFo2x/54XG3Pz
TLSH
T11A62CA16A534597B9CEBD209FA517B63D6F81563A2901E44ABFCCB0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 20aa33a7d0d438f539984ef714db28d7f866ab842ed6cd9f35b446361285f311
MD5 a3a28a8246f7032ace0ae17d57fe7893
SHA1 5b70d5156719c9a8fccbdf83e27b14c4d2adec58
SHA512 44572092403efdb77c4fe7e3b59746e1cdafb2283cfe1c99baf35ca7c3314f7f1d37f0e038f0cb0150117f61eb49e4fe0400053fd7c27d9b659ca0636a80d17a
SSDEEP 192:sxR4RXyM/jK1Ml8wCQ/fbsZWrZujfzoA8p9P/g6+WN/Q+/atL4BlZ7D4s3+GdIg1:sxR458Q/fbsZWFo2x/5J/Z3P1
TLSH
T15262CB16A534997B9CEBD219FA517B53D6F81563E2901E44ABFCCA0C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7def9845a2f026dd7b51ccd4a787855c687bc1381f47f7419e4b2139d634f3a0
MD5 4a47ed91c6249affbd66ee65bdf8d5f9
SHA1 f173be8f0b7c7affe51d9645fa9a87b7dd0b3ec0
SHA512 8e5c01986d7044690e0355d639945d98f55613ab25110fad08469eb606f3b929d641067171e577f96b42e29a8c5a4953c33afe6906f99ab029fcd5ddee4ce475
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8SV2troHh0wf+x:kfISGqE7CvWgd5fWbu1jazU2GHh0wWx
TLSH
T18CE2EC3B640CCB7F4F8049DCEC297E9AADA801CB96D8CD9447FA850C03C66EF55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\49a69137-08eb-46ac-9615-357eecd30d95\index-dir\the-real-index
Size 3KB
SHA256 8781a694dd89bec49c41c681faaf23a0a24ac2aee563d0ac1e00160cda469702
MD5 18461e8afa648beb74cb07aa2d260ce0
SHA1 2c5b4d96b713bae25f215907bbed4272c52ba387
SHA512 eb9acd514cc8cb62bda4d386704b11f4790393a5a30c15de57a7d08a17f007853059ef608b78583fc838b726b64d5ddbd60ffb96e6c46a1955709298d9bdb4ad
TLSH
T12171EA8A9D52D531C37C0B7780F8DC1EB72437CD1B4B3B1A113D86A4568622C5F832E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a03ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\49a69137-08eb-46ac-9615-357eecd30d95\index-dir\the-real-index~RFe5a03ca.TMP
Size 48B
SHA256 561302bf16a7125014cc06e984415630aba3e3d7e9eeef05430b535b40bc04e4
MD5 32a2cdec0b4ecb7563604f38a8dbb8c6
SHA1 72f3757c8b31873fd64f243079d0ba219d1e6328
SHA512 825502afc7c028f2dc3fd003567f37955d03a3cd80ca0358c465c4ddb1e25225f7d73c3f28309ee3fcb2e33b75d875f266a8c989ed821fcaecc1d7d5c6e5250d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\bf8ecc1e-284a-47f9-98c7-e90703c72a03\index-dir\the-real-index
Size 72B
SHA256 b04f8cd99a7ea3d9702189d8db1b44d21a1e45237944042d380aff5c80054944
MD5 dd9a34cc4e6b85e3764a99724d58ddee
SHA1 7285558b03ac8dc586faa66d876fed82112f656b
SHA512 6de4c5c4b7a49e155d94cbacd0f62742c500553fd3e11eeb9a5231ab292bc4e96535188b88d7773204cbfe9967cc8866af0bd457c8dd5f9a000f437d0da7b26b
TLSH
T13FA00290B9478136F002D67568F201AF321158D90302034258A401C48C58544C211175
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f3cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\bf8ecc1e-284a-47f9-98c7-e90703c72a03\index-dir\the-real-index~RFe59f3cc.TMP
Size 48B
SHA256 47940cbee38191379bfb5882640a3331e58c68a12968883c7ab3296fb58d3269
MD5 15674d677d07ad331c6d4ee54423f978
SHA1 d239808861fa44a426eabbd786ed4550ce3d923d
SHA512 c599cbbad8ba5eaff7d9b3e3fdf3cb272ce90f3b584dba042d3007040b29d7e66519cf4b182b9a3db109124dc79a2908c98f4a6f132200242e8a2c228e2d3fb6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\d245f3f3-8909-4166-bdb5-b5c52dbd0ed8\index-dir\the-real-index
Size 72B
SHA256 54286f8a96c047cd9fc0a243c3b2da3f6242aada2b7318123f8c5f3ae585c16c
MD5 9b184713a8d4d082bdf700820be66f1b
SHA1 2e3c1ae6f02351e79701875ebfe2f9580e4f426e
SHA512 123127dd863e2584117c5833f494492401918c60294a7400be201c8af37ee1f92a207d4539249b2d57d923577786070cafd1eea74cb2668510325cd37bb87b14
TLSH
T15AA002A196F16423D61A03716561154673D1889412A5130EB499095CCCD518391C5CF0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a951d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\d245f3f3-8909-4166-bdb5-b5c52dbd0ed8\index-dir\the-real-index~RFe5a951d.TMP
Size 48B
SHA256 d61488d8f67501e95d3c7b07bfa83368ffe7982b307fb0a63c3d8d10c283d309
MD5 ce717ae2a13e9eb901a480f6bfff1f13
SHA1 1a24c3792cda6ad8f5affcfb2a57f70cfbcdff23
SHA512 6aed985649cd087abb1171c6d8829aa66523c8bb19be6a5b2dac92a3fc0cb95df165a1ef79a5f053ebe897a027a7dfe1fdaf4f074602dc383753f1bf23ce144a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 488B
SHA256 7650a8c4929480f26193ef95ec3722acde230bb492c67867a97450eb430e5c45
MD5 d7493924c1918a4b37fc21ce649dd14a
SHA1 e562d705ad7f31a9a19f2841417b1a2931df0253
SHA512 28adb46a928d274aab061a391deb7195d7808dc2a3d9a7ec77aa8f7ac72e0f27a339bbfe510d1f45d54dffc81a0f0129978d9f45f6728b92f7dd95ab0dd02fb8
TLSH
T118F09E5353728110E7F1489A09B4F768D82F3A479960DE6C8084614204BFFA5E7A3F82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 dd2788d69b58ce7278a3e06d5e212c73b8cdd47bcf5c22a18a3be5811f3e5ecd
MD5 6fb43b04da1dc60e6baccc65bd87f154
SHA1 c61400bf814b0f2daef0db8cfd6bb60c31c82fe7
SHA512 13c536df89fc4aedd1cd915391ee5e22ee7af847541d5049f9bcd78cc1acae7e36dbe2a8334c4d53423f99231ff0bc2b7d1fdd10089d4bcf4c6410b8e5593448
TLSH
T1B3E061525331D111D7F144DA45F0F25CDC3F2E835A50CF6880847101087F6AAE663F52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 bce99f8bbe27c3dc1b68b3bf001f19121e7349050e1465248b48b09fd4c9280a
MD5 374f4fda0d09dce2b37efcaa9c8eb243
SHA1 d9e34545935d9cefce549b5b54d952c33e6dd174
SHA512 7d6bd8a2cf1329bfc1bccb7abb670c00d6a9ebb886ef37593110951e86c93a0613181ea3d25f4c7cce403ab7bb4ee413df2704e402cb10d972445edd1e005b0a
TLSH
T198E061525332D111D7F145D949F5F75CDC3F22439A50CEA880845102086FBAAA563F52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt.tmp
Size 482B
SHA256 bf3e92204089dd6c553bd7be5ff2273746992c64f2002d3959cfd550391cf2ed
MD5 3d78899a325faf71182aa74a536cfc5c
SHA1 e6b093505f52f6dd84728226111c09c4365327ed
SHA512 274ab671dcb140227342ad38299461022800baed692609b6699dddcf6e38cc8236187abd8781232a7c6245acb8bda673419672b3f8de553a431127c613f49656
TLSH
T1BFF09E535373C111E7F1499909B4F768D82F32479A60DE6C8084514204BBFA5AAA7F82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a59d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe59a59d.TMP
Size 195B
SHA256 bb62044ee23c08117c5be1ed07d4f1f739f1a2dd9540032a6b48a213ef3a0569
MD5 c15c242f516c489fb107eb1e8263a03f
SHA1 670042377d032b1b37e1ba5339a07af21d305441
SHA512 475a825f00d4c240442fe58df083f1d1507f83641b2855681e0d7ae3d7302fb70bc2321e6d6ba2f86d4947e03717efbb04f9bee649dcc53449c3bc13306b1cd5
TLSH
T1F1D022A2C1329002CBE052D28E61F2C4D92F1D932AD0CCB88084B2411C7A39A4183E61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3da39b5483abd538e889bab9a4a3764aceabd09420d1cf80eab8284f4cc9b971
MD5 e5027255021119d50332c00721c366f0
SHA1 8213c772efc4cb519e750793698dbdd44343420d
SHA512 563ad36f6a485f25bb82f3d64272b265b3a43cbc99e910ccea90b61bb1b011134a11fbc087015546ced455b908c0ef082a9244d6d7208ea3585620a8ffc0d719
TLSH
T12EA0026345DBC073D0015372A042458C323048101712561156E509749C543434112A05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f39d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f39d.TMP
Size 48B
SHA256 576ec7f09b92b30235cd9e4724a509e53052b83ede17ec1816fa5671013de04c
MD5 a8d67dd5af3fba3dfe8321cb89e95bc1
SHA1 24c6e4af2d4c1d1d31b250a3506e8106c35cf711
SHA512 74c2ebb31ef7ddb85af7248f348baf45fe12627ad662ef9d1bc8e226fe52c146bf85a8909ab9d0905c340ecbc0008f1539ff6586f72e45c688c07ccc6b2ec2d0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 afeb3eb8ffc4c43e44b19f264cdf8d75d98bec00b015a4d2bb38b153af87c0eb
MD5 bea9d9883b6e9a0b17ccc405899fa0fa
SHA1 3cad7bce1f7c465a5a93a1cee3a84c15b9890cae
SHA512 3d4d357c2c2ecaf202a5303a37063a497c9bdc09791e88d30881dc4df5cb153b2d1efd9fbd7490b33a27b54cc30c1b148dee0740f22fb0b289cb2209be4a4cdc
SSDEEP 768:vj+9F3z0EiqyLBLMqAam6aQMGdjWca4Ghf9nJ+:C9F3zHEmaME6pn4
TLSH
T1BAE29E3158699C679CB69595F72B33C7BEF011B388C81E88D9D8AB0D069724E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6b80d281b0ff4792812aa7bdd119a817dc47c06bc4a9b076928348ba746c3a11
MD5 bb321940742856d10cbf8a82a9c09b25
SHA1 25c05abc1d3d781d7d392107fb3a57174b9b2f6e
SHA512 9173ced8e92367e3a5e4504c2564363ed668bc316036790f56c5d2c19c8284c9f4c7431f825d4fb365550f9e15aecc65e5bf97702f40581da86453c051770922
SSDEEP 768:/rv+4UNbdq3KuqyL8AAam6aQMGdjWca4GhfB8PeU/:/bsbc3kKmaME6p0H
TLSH
T10FF2AE31A86C9973DDB79A95F21B6787BFF021A384D40E84D9D86B0D439718E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 91aa23a17173d2d45673ab93b0237d7c056331f8db91e9191b86265025df04bb
MD5 2f20f89c7a53e01d8ac63a19c5fb2ee4
SHA1 acd41809cbdcc742e7897ef794ae4798022aefbc
SHA512 a316ea87800eb20cc19f6c69c9f53b549b99aecd0bfb5863f5572193bf4edb1d9b1d6d792161656f1e394570fe5097a7d4be1fe9579ff86c3171582ba966931a
SSDEEP 768:Yrv+4UNbd73I0RiqyLBLMsAam6aQMGdjWca4Ghf9nSt:YbsbR3I+emaME6pna
TLSH
T1F103AF31A868D8739CB79195F26B76C3BEF421B388C80E84D9D95B0D469718E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7d578e6771df80a507a16771d2fc9893ff201ec44ea640d23b75ec8d55e472ad
MD5 6874ad72fb20208f26ce5dea57e55a36
SHA1 a3759264d47d1a48883c2f908dce6484b5fc4075
SHA512 68401c7e0dfb1ba6b2a3b83dd033476d65ca55c075b3f129825aa30b8d8f2e299f68f10c5ad0ca73caadcf72afd5c2b8f7f4e0f2171d967d7fa1214d6b290e4f
SSDEEP 768:cFKj+9i3Qwgm0E+8LBLSAam6aQMGdjWca4Ghf9nJ+:s9i390maME6pn4
TLSH
T1F2F25B329865C96BACF697C5F72A7687EEF011A388C85DC4DAD85E0C01D728E170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a011dca4de44f947d91f3925893100e4bff809e0c61a83a6937f36d6b8e67c57
MD5 0b9bf05e7f9fea1d70c9ee233b32d1da
SHA1 595bd4af75afaa1a55f156367a36a90a21db8563
SHA512 31f0eb653aac141f1018e2572d32274278af3aa89156a4e03a4e5fb66e8ac33b3769912023b35bffff3906f3db80bb2865aa9866574ce50c86d244223bfe49f0
SSDEEP 768:yj+9F3z0RiqyLBLMvAam6aQMGdjWca4Ghf9nJ+:B9F3z+5maME6pn4
TLSH
T1D0E29E3158699C679CB69595F72B33C7BEF011B388C81D88D9D8AB0D06D724E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

330eb23d-9e03-40f8-8f06-7f7f6cd2df1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\330eb23d-9e03-40f8-8f06-7f7f6cd2df1d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Tmp6DA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6DA4.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2316_507721757\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChatGPT Installer.exe

Path C:\Users\Admin\Downloads\ChatGPT Installer.exe
Size 1.4MB
SHA256 acd3f669e586a17bb3eacc17ab1ddb66524e2c2eec39e7145ffb6991c1047ece
MD5 c1b049804b79e5609d1a910a5833fc2d
SHA1 4f4c41223a134d87fde9e7691f05a89ce94bec6e
SHA512 3de73b5f41fb3c4431954a392e4e0ce5cca7904570a0ce3c316033f8d410a8a0d42b27cf402f1ed8253dd52f6a6355f8fb08d6f5ef7d002a86b841d281d42ff0
SSDEEP 24576:x8917wW+2DR7BWYpy7o441sW4z3ZBW6pIP5:+vUk7VUqsWADBE
TLSH
T180654B8027FC0439F6B74B79BD7B18224A35BC399912E69E0689552D18F2F16CDE2337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-6-0x0000015E57BC0000-0x0000015E57C7A000-memory.dmp

Download

memory/1196-31-0x0000015E588A0000-0x0000015E588DE000-memory.dmp

Download

memory/1196-23-0x0000015E57760000-0x0000015E5779C000-memory.dmp

Download

memory/1196-17-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-26-0x0000015E57C80000-0x0000015E57CA6000-memory.dmp

Download

memory/1196-8-0x0000015E3E460000-0x0000015E3E46A000-memory.dmp

Download

memory/1196-18-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-25-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-22-0x0000015E576E0000-0x0000015E576F2000-memory.dmp

Download

memory/1196-37-0x0000015E58FD0000-0x0000015E58FD8000-memory.dmp

Download

memory/1196-7-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-1-0x0000015E3C470000-0x0000015E3C5CE000-memory.dmp

Download

memory/1196-36-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-24-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-80-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-33-0x0000015E58AD0000-0x0000015E58AD8000-memory.dmp

Download

memory/1196-5-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-34-0x0000015E5C8E0000-0x0000015E5CA68000-memory.dmp

Download

memory/1196-21-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-35-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-4-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-3-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-32-0x0000015E58880000-0x0000015E5888E000-memory.dmp

Download

memory/1196-30-0x0000015E59230000-0x0000015E59758000-memory.dmp

Download

memory/1196-29-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-28-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-2-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-27-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp

Download

memory/1196-0-0x00007FFEE26EF000-0x00007FFEE26F0000-memory.dmp

Download