cd6ba78ea24a28b76160d343d46cfb16df91b123afd9bde2ad234cccd8d82083

Analysis

user interaction
yes
max time kernel
900s
max time network
881s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker-3.1.1.exe
Size 857KB
Sample260722-ymnv7steja
SHA256 cd6ba78ea24a28b76160d343d46cfb16df91b123afd9bde2ad234cccd8d82083
MD5 9b2946bb3d8ae8d01f3d64fc6dee2c9e
SHA1 a62be821aeb5667d445fc6710018b3cdce66e417
SHA512 6902a54b75729625b6b7f079e1d40311e051e644607ab5eb6137f1bb4249f13ee68055b172bef200ed600d7c0988d1a747df3d271848fb7b66e1d83ac57dc55e
SSDEEP 12288:vaWzgMg7v3qnCiMErQohh0F4HCJ8lny8QWMZorOBC3AbDYP:yaHMv6CYrjzny8QWxiiAfYP
TLSH
T11B15AE12B6D640B1DF9639F01937E316AB356D196222CE8797F03E628E31183DE2635F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_700425026\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_831270188\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_891327098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Cryptomining	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_831270188\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_574541359\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1566671488\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1823480641\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_485614053\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_90005395\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_330139034\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_669498070\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_669498070\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_669498070\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_891327098\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_571579959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1566671488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_650521258\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_900186457\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_90005395\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_330139034\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1566671488\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1566671488\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_700425026\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1823480641\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_330139034\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1932557799\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_891327098\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1910894645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1910894645\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_529502298\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_571579959\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_485614053\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_700425026\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_90005395\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1823480641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_574541359\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_700425026\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_90005395\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_90005395\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_650521258\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_1823480641\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_485614053\llm_user_input_extractor_config.json	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1076	msedge.exe
5848	chrome.exe
5244	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292237091568311"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{AB1A326A-2E7A-40CB-A9FC-47342A87C0ED}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{9223D057-4AA6-4095-89F2-B4AE15F62F5F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5280	chrome.exe
5280	chrome.exe
1196	msedge.exe
1196	msedge.exe
5280	chrome.exe
5280	chrome.exe
6860	msedge.exe
6860	msedge.exe
6948	chrome.exe
6948	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	AutoClicker-3.1.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	unregmp2.exe
Token: SeCreatePagefilePrivilege	1956	unregmp2.exe
Token: SeShutdownPrivilege	2724	wmplayer.exe
Token: SeCreatePagefilePrivilege	2724	wmplayer.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5240	msedge.exe
2724	wmplayer.exe
5240	msedge.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 5496	2724	wmplayer.exe	90
PID 5496 wrote to memory of 1956	5496	unregmp2.exe	91
PID 5240 wrote to memory of 1848	5240	msedge.exe	95
PID 5240 wrote to memory of 5244	5240	msedge.exe	97
PID 5240 wrote to memory of 3620	5240	msedge.exe	98
PID 5240 wrote to memory of 3620	5240	msedge.exe	98
PID 5240 wrote to memory of 3620	5240	msedge.exe	98
PID 5240 wrote to memory of 3220	5240	msedge.exe	99
PID 5240 wrote to memory of 3220	5240	msedge.exe	99
PID 5240 wrote to memory of 5012	5240	msedge.exe	101
PID 5240 wrote to memory of 5012	5240	msedge.exe	101
PID 5240 wrote to memory of 5012	5240	msedge.exe	101
PID 5240 wrote to memory of 2220	5240	msedge.exe	102
PID 5240 wrote to memory of 2220	5240	msedge.exe	102
PID 5240 wrote to memory of 2220	5240	msedge.exe	102
PID 5240 wrote to memory of 3900	5240	msedge.exe	105
PID 5240 wrote to memory of 4344	5240	msedge.exe	103
PID 5240 wrote to memory of 3900	5240	msedge.exe	105
PID 5240 wrote to memory of 3900	5240	msedge.exe	105
PID 5240 wrote to memory of 4344	5240	msedge.exe	103
PID 5240 wrote to memory of 4344	5240	msedge.exe	103
PID 5240 wrote to memory of 2388	5240	msedge.exe	106
PID 5240 wrote to memory of 2388	5240	msedge.exe	106
PID 5240 wrote to memory of 2388	5240	msedge.exe	106
PID 5240 wrote to memory of 4972	5240	msedge.exe	108
PID 5240 wrote to memory of 4972	5240	msedge.exe	108
PID 5240 wrote to memory of 4972	5240	msedge.exe	108
PID 5240 wrote to memory of 5592	5240	msedge.exe	109
PID 5240 wrote to memory of 5592	5240	msedge.exe	109
PID 5240 wrote to memory of 5592	5240	msedge.exe	109
PID 5240 wrote to memory of 616	5240	msedge.exe	110
PID 5240 wrote to memory of 616	5240	msedge.exe	110
PID 5240 wrote to memory of 3268	5240	msedge.exe	111
PID 5240 wrote to memory of 1852	5240	msedge.exe	112
PID 5240 wrote to memory of 3268	5240	msedge.exe	111
PID 5240 wrote to memory of 1852	5240	msedge.exe	112
PID 5240 wrote to memory of 4828	5240	msedge.exe	114
PID 5240 wrote to memory of 2896	5240	msedge.exe	115
PID 5240 wrote to memory of 2896	5240	msedge.exe	115
PID 5240 wrote to memory of 1156	5240	msedge.exe	118
PID 5240 wrote to memory of 1156	5240	msedge.exe	118
PID 5240 wrote to memory of 4664	5240	msedge.exe	120
PID 5240 wrote to memory of 568	5240	msedge.exe	121
PID 5240 wrote to memory of 5100	5240	msedge.exe	122
PID 5240 wrote to memory of 4248	5240	msedge.exe	123
PID 5240 wrote to memory of 4248	5240	msedge.exe	123
PID 5240 wrote to memory of 4468	5240	msedge.exe	126
PID 5240 wrote to memory of 4468	5240	msedge.exe	126
PID 5240 wrote to memory of 4468	5240	msedge.exe	126
PID 5240 wrote to memory of 1196	5240	msedge.exe	127
PID 1196 wrote to memory of 4860	1196	msedge.exe	128
PID 1196 wrote to memory of 2056	1196	msedge.exe	129
PID 1196 wrote to memory of 1076	1196	msedge.exe	130
PID 1196 wrote to memory of 2056	1196	msedge.exe	129
PID 1196 wrote to memory of 2056	1196	msedge.exe	129
PID 1196 wrote to memory of 2312	1196	msedge.exe	131
PID 1196 wrote to memory of 2312	1196	msedge.exe	131
PID 1196 wrote to memory of 2516	1196	msedge.exe	134
PID 5280 wrote to memory of 2608	5280	chrome.exe	136
PID 5244 wrote to memory of 4368	5244	chrome.exe	138
PID 5280 wrote to memory of 5848	5280	chrome.exe	139
PID 5280 wrote to memory of 1672	5280	chrome.exe	140
PID 5280 wrote to memory of 1672	5280	chrome.exe	140
PID 5280 wrote to memory of 5164	5280	chrome.exe	142

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1940

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\MergeUnpublish.mhtml
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffee5a8c188,0x7ffee5a8c194,0x7ffee5a8c1a0
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,11204636193980201372,747323564962234218,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2020,i,8513225148273310959,12314460989225355050,262144 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,17291567201480007577,8906483363113676605,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,2486108772627359194,18250165891039696674,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,6490365879708015995,1449471731578692391,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13934561059747419627,6165297763161694593,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12773572090831883679,229479241900313385,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4408,i,11608009563838200993,14208309866726073157,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4000,i,15537405432451606087,2422907101069028181,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4016,i,6077148523789623822,12543183084084363133,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,2299943416863594142,9645618061958541793,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,16303547360354634823,10299610534064433623,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,13820916761871145185,3364996048895108321,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18115672553653943472,15551967299163481367,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18115672553653943472,15551967299163481367,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16333596635771244292,9852755135596585014,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,17948526525795365820,9198673996899021682,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,10009245777288356019,20139732960467483,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,8451811199336329085,8372381266784960108,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1348,i,12625901587003296065,9356288812816743999,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,2345790275686784789,14143204434558747294,524288 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6868,i,17935122378274849564,3909556782303252305,2097152 --field-trial-handle=2624,i,9677250984703235391,5227675806692794444,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffee5a8c188,0x7ffee5a8c194,0x7ffee5a8c1a0
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7099141469571457866,9761717349043881132,262144 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,14982920858551274358,17070069529252755291,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,1888672692702512475,17514392563384145899,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:13
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,15197852597594759608,10185473042493439303,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,15197852597594759608,10185473042493439303,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,1226633919662812943,9346363257180916889,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,897497304922326006,9262857850462831384,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,3817926847832277057,12388304907803484135,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,18433109293007132964,340895902732772414,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11589303595076752314,16788095332846550701,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5975256816151284865,15330819310228079563,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,13356900622497022368,2562458863007994924,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4852,i,10063570696110698917,1774990777705310767,262144 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,9846450838127769521,9622126481554654782,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,17063681778780158068,4431385685313684979,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,11159859168490432865,16572156134416689190,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,17738398845352438579,15105360782475936008,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,6553620622452116767,1299589793252812827,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14481890386246829414,2891465979270929500,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,11916107722218840301,6633890355738173701,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,2747745119400805075,1407168059900788063,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,3013305538803575147,6928811285053257726,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,10172181634520525682,5941821549248638316,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:14
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,6699909143220052567,10797037631346384914,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16828753151957301611,580270966343497627,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,14198670443284076528,8684017193582083539,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7246244161642768920,9409442958321045230,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6948709203675572433,16928117224139233397,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
    3⤵
    PID:6232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,168830760229496602,4398937562303507904,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,2904833481452296175,13199555479815677084,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:7080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1108,i,404925105245820967,8146540128392532171,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,11220568229107889299,4746423656902226253,524288 --field-trial-handle=2876,i,446215179367477576,9751181773784163956,262144 --variations-seed-version --mojo-platform-channel-handle=840 /prefetch:14
    3⤵
    PID:7160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\MergeUnpublish.mhtml
1⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffee71bc728,0x7ffee71bc734,0x7ffee71bc740
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,16529909590784872531,3620622225511521547,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,15934641567609513140,599722981209614521,262144 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,18279239867301179168,944876063830028532,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,4158389776441528080,3916171427338325523,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,8530292814962022472,12009959402953412610,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4600,i,12586361377402952344,5272047203134760214,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3820,i,12002338543663557808,11052758250921415389,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,10459772575265538458,3805447738530614156,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,15559533483322582431,7325433132258629957,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5568,i,12450650849597530578,5955125522387703450,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5740,i,3086201391399431134,2148905960820858023,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,16231602094091771780,13888649584822144394,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5560,i,9772598390156927025,10820574629208896798,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6288,i,2805884907349509504,17892679481327494119,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5752,i,5474980533597971433,971874225034357425,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,1886577464217444656,18328343933908968725,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6172,i,1495166769140971907,8682527059937108435,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5616,i,17137120757359343896,5486659597052643603,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,12543540484894038444,1114226224318371551,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6284,i,10115450727903333601,17608220008400074008,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6264,i,8612236334153264118,17155572368271650447,2097152 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:9
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,6512654412811165265,4644262535025769977,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:6880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,4325094935776030155,4460343358159274762,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:6888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,2481743175228512868,5303812327564013786,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4996,i,4941192600814517318,11020749494765709790,262144 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4048,i,15959568157407429714,13010526405311170456,524288 --field-trial-handle=1788,i,8299458590536759222,15728496574734006646,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:6420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffee71bc728,0x7ffee71bc734,0x7ffee71bc740
  2⤵
  PID:4368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffee71bc728,0x7ffee71bc734,0x7ffee71bc740
  2⤵
  PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:704

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cab39ec6f4eb63d064c26cff4d6b8280dafd6cdf860f324d588a5b48e9a4004b
MD5 54f91bccd4e156eea9e77ab5636c095d
SHA1 c26344a294afc1f85144197baab316e80094e0a4
SHA512 04d1f4d3c8a8a86b933b604aabb3ec320ef3a2bf2d504956730fba8a67135c6ed9ca42db4fcceaa442433ed2683209381f81a31bd00baa75b1158f4b5444c09e
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 30c550f0057f53b294e17181d163731b7b3f85eef2005ad88ab7bf9c54b9da68
MD5 f9dca57fb14da310467204d76733fc49
SHA1 84f1014c3751caacb9743350ebce3594616cc073
SHA512 8e9819c082f44bd0e850229adbb4b6232dbbb8c1633acac39535f32b7553fbb9394c3d5db7dac856e06b758c2f68a090ea522e18aa422f73c1801b51f3177ae3
TLSH
T1EA615CB3D3D4CA6DC41566E59B25BE1EDE3D0A24122C3C62CCD5AE4B53F28B2D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9b59a2a12c604bf71e26877e93009c5a1db6144da7e413a87698ec0abdc729e0
MD5 e270037c3209af0cdcde3ad26bb25b36
SHA1 44e4cf3141569d69d201b248126dd20e7b9706da
SHA512 f1948508b94db4fe3d0339fce1e13240d193eea916a976307d611a1a4dee07f000ee10b9bc510396b325b117dc05c06cc0ee57b295fe43fea7baced2a83cb7e3
TLSH
T195517BB793E48A7DC51166E4DA21AE1EDD7D0A24122C3C6288D4AE5B53E29B3D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ad05d63252762a5b60196865b3840139bcc3f79b184b2e2d9259a012117bb870
MD5 19b31ec48e3e752788a34dff41216de7
SHA1 eedf39ab37c09137508124e2a3156079acaa0d1d
SHA512 4dfdd9a972596cbcf63e1505212a87f7839c8ea836076fdd72d01d85c94d45404adce7583ce1f3d5293d1b80876988f285de89a2220745e0e6db4f6cc56120ba
TLSH
T153515CB7D3D4CA7D841566E49B21BE1ECE3D0A28522C3C56C8D5AE5B53F28B2D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9a703792704adbde206a569041cb1d1d3e9991ea4bcb2d8f87443ba17f357b0
MD5 c945e4712d40026a24a39ff55f70740d
SHA1 b8dc42e452df2a37f4894c357fade6e23c3b44a2
SHA512 2d62ade65bf902ddb7f0a7e828fcccf8fc72ebcfbb466204e4fbca99505d55dde5aa14863c88afcd77516fa535d83830237c2c10baefa362fbd4d7231e4b608d
TLSH
T16A517CB793E4CA6DC41166E49B21AE1EDE3D0A24122C3C62C8D4AE5B53E2973D21034E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16e84fe4a6d9ad4a44b2c385feba90119f9a45e841831dd4703d863e89e65282
MD5 720a41d53b136dfe07839711a90210b6
SHA1 3e6a38f5273d6d87d51b26408ef8566269298202
SHA512 58435d12418615a5e443a502796284ba0d6ae50d5c6d2324a541c40da4dcbde726d9d2f083f1feb8461d2715c406878d3da448993e2186ba6f487db80a418a72
TLSH
T128517DB3D3D4C66DC41566E49B21BE1ECE3D0A24122C3C66C8D4AE9B53E28B2D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 805d23198cad0acdc72fe492343160d5a258f2982d17d42f9334fdf03163cd7e
MD5 2c9c909f44b2d90eb7eac2297b1151a2
SHA1 dd7c34faeb6540391f4a9622a586086b0cadfdcd
SHA512 201efb698be699e082c7d76c7cbb3d9dd91b2210461d2604d619c1d79ba1f35e63293d996a3772dd30516ec4cc0846dc6a637ef36c46a75e0d58cdb7b550289a
TLSH
T1E6F05067B62E7053507955AE6D08B806A9B2D435018068E4DF5B425EA0854F71B01853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e1144a2a41c90fc5de777c22964d8e795c712eea08a97396f087ebfbca5bb7cc
MD5 6cdcf08d8b20133af20420261d47026f
SHA1 fb2e535961408eb79173f5e1f14e59dedfeb3bac
SHA512 dd1f4dabeacc93605bb7bdff792fdb9d3d06a11881b8a53f0add90cd8737b7a0a603d06b02369dd203fc58bf60a2a3cef8c9aaba68bedd244966be14109e68fb
SSDEEP 192:ZRGhfz3v7dAPRp2Q9NLHsb+WNnKR0qWeQ24sxVyIsnAUge:ZRGhbfUXD3wg0n2xe
TLSH
T1AB32982EBA50693B6ECBC21AF9257753DBF5102121D42EC4E6FC8A2C15EB6CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bfdd7179ebd61ac0d36a4359f9bca381b73965c6a773cd7b4106ed19b7d2031e
MD5 528439532062a9cfea8bdc9d0685c560
SHA1 51717dd1d3681349c2f376921073a448911f6bf3
SHA512 e084f01efbb81aca07dfcfb43ef4834d7ea2a85894e4930458d38511c80b8f9d2ba54af0121906c3221d93429c2bb3e15f3cab21f4d4bd3f6bf843b9f80ea4fe
SSDEEP 192:ZRGhWc3v7Z2PRpMQ9NLHsb+WNnFDAYWeQ24s/VyIsnAUgE:ZRGhffiXt3wJAd2TE
TLSH
T1F542B91EB910693B6ECBD61AF9157B53DBF5102161D42EC4E6FC8A2C15EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 70275d3d84713a2fbacdf0801e6eef8e557c5392dbd5915c833d453912499a16
MD5 c791003b88d522cd4d955102d5236ff8
SHA1 7737c37b69e73fd21a74439762643372c90f7cac
SHA512 3dbeb1e1c81ef5e3cfb4585f97f50e77faacf325c9895fd5b089166d8ef894327067eb64f35880bf1cd6ee02f46c165a7d491ca8190d706debdb326d78716d1d
SSDEEP 192:ZRGhfc3v7ZAPRp2Q9NLHsb+WNn7YJlWeQ24sxVyIsnAUge:ZRGhUfwXD3wMJy2xe
TLSH
T12232A92EBA10693B6ECBC21AF9257753DBF5102161D42EC0E6FC892C15EB5CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c1065a04bde15cdc63329264ec1ed64c479f448c31b40e18039b60f71d63c3ea
MD5 b66616e8d2423ab05d6e32091eff9077
SHA1 f2f13406f1dafec16feda0cdb7210b02f261b209
SHA512 1b456b99d08905f78ea316cc86b7ac5f3f9e640cd9f8a2baab0358f358bf9a5e28cbe4ea4d48f3d235482c7efa35cc3eac99bc70d07cb0e6cf545323e92aab06
SSDEEP 192:ZRGhfc3v7Z2PRpMQ9NLHsb+WNn8IFQQWeQ24s/VyIsnAUgE:ZRGhUfiXt3w8OQl2TE
TLSH
T19342B91EB910693B6ECBD61AF9257B53DBF9102162943EC4E6FC8A2C15EB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 4ed71c9efd51f8d57ece2e6cf183cec86166b66ae0cda13b2710150769c5ba20
MD5 58fdf4dcc50147f1cac9362dfeaaa86e
SHA1 35b04381531146da74d977f3467f49844e908033
SHA512 21017b9b21bb2ff878caba8ba1878a9346f19c81b5cf37b2401e1d7d09d208911e677f4d5f605d7120d916c109dd852a177113ce663165254dff874439542b9b
SSDEEP 384:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xXODyh+ErU3+9HGAI31HZ1:Z7wX7KxkXqKf/pUZNCgVLH2HfgsGVOu+
TLSH
T147521967648D9A3B0FD8D64DDC17AF4FADB5024766685D2492FA9C0803A87CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b681d23be3748bf40540ad6c7a6196238bc66a5ff4574f54b3d193ecf4ff584e
MD5 1cebf9c30f5f5c40162f326c23d232dd
SHA1 2081960aee7c662e22f9071249452751e58bfae8
SHA512 07918da5d84a9a8f44b49f631a19db7b0333f6b2e8888c901be1fbf9db7e38487c7cd212589a9e1ae250f98d6eeb11a4cc03ebf1e4a83e328b8ce5cc773e10dd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 50ee633d0e5d26407d7f1bd090a7882c6a1f27c67d5372ef3210941ebdd92621
MD5 db2a1aeac6b943de09f29b26bf1a2f85
SHA1 5062d639caeea7b1d7835c97bda41cc91e410709
SHA512 d9101983745bbc505bbc1312a078f87bac16256503b30af89727a04f388d94321e4a03c7dd888fe7bad3357d250843b3f4c41cf8e5bdfebb297f3cb348fd6b2f
TLSH
T13CA0023471E41B1ADE10C279F1A11691B256DD251593BB0354EA04459A5F1D0C11A200
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 053d2fc55f1ec2b24d5170f9bf89e68c5b5228183b7820ef85515e1725341abb
MD5 b582b4eb7fc84d7a8a38124f35f8566c
SHA1 4b213a36dd7dea698f045a9af932b8ea07bfab20
SHA512 bcd16e453a94aac70db9d446df5d5cc1216075077a3a5ec55167b762f268de87ec23362310a1ed00935f934a9c1df01e48d2889f8c7a410061b2f904116eb118
SSDEEP 3072:gY95ojdiex6bP7MMk4am/mfe06ZYSDryELNP9Oo+lHY:gYDojdDx6bPYMk43/mkBOECo+JY
TLSH
T128C31235A4242D7C8F7DDD04711F689BEDBE93076D2CC9DAE4403D4C81AEF98A62741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 88b72ac5d4ccd78af31ad324b8d1fd29220519261b8fab220c3afce375f95991
MD5 9e66c281edcbc32a92f8f52d73fd9b34
SHA1 678ea36c792bc601281431a8742592f247a07982
SHA512 1616466ea3579f2c4476bf170e4d02db60309f809bce25d4c06149a759281e8a73a8b1bd65619bdf01184b7db1f241a4420e46b262aeae9051467f41f4dd7cec
SSDEEP 3072:X85ojdiex6bP7MMk4am/mfe06ZYSDryELNP9Oo+lHY:X0ojdDx6bPYMk43/mkBOECo+JY
TLSH
T1B9C3123564643E7C8B6CDE00B11F889FFE7E42072D28C6E6C4902D4D96ADF99722791E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9cadbdbdb8c8ab289c4e9eb61cdca26a4e246fb18558e88493d38d02ca091799
MD5 6852a34145fe75800546657e444738ab
SHA1 cd7df885fa3128f6f7fde276e7a6543264b34b06
SHA512 5572c25f15233c671e01d65e5210b73470c03ef22032fceb17e3c878e59abf6269432879202edd9670678aada107ce0f89a10cfacc67ff43e39edc7ba8063de9
SSDEEP 3072:g85ojdiex6bP7MMk4am/mfe06ZYSDryELNP9Oo+lHY:g0ojdDx6bPYMk43/mkBOECo+JY
TLSH
T186C3123564643E7C8B6CDE00B11F889FFE7E41072D28C5E6C4902D4D96ADF99722791E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 18bc9d364d6b5a44069efbb5a31a62f5e3f042af1a0a73c3e72c43f4f3bae49d
MD5 75adfd806203baaec33644f79b8405f7
SHA1 35c1d58f44d33d4823ed14414339da6299c53be1
SHA512 e3dd2c33ab82e8353c6a38b983044e46191eb56155e647d9710e9e13619d2153ff1f5216724284d40004ce60520e5d21ee0bafb08af98341631d2f74c335aab1
SSDEEP 3072:AY95ojdiex6bP7MMk4am/mfe06ZYSDryELNP9Oo+lHY:AYDojdDx6bPYMk43/mkBOECo+JY
TLSH
T1B6C31235A4242D7C8F7DDD08701F689BEDBE83076D2CC9DAE4403D4C81AEF98A62741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0232e521b5bddb15b8c1232d37f4220a0314ed87a169e34a18a70a9e0bad3ddb
MD5 c5e59d1453e0e8cfe55b2c6834d55539
SHA1 9bdc06781475fd3d7d7437643b8ac36974552c28
SHA512 642843c092ffad64c2600fc7f7464eb5719c774fc431b9e19cd39ec22958d0a8e09e9e20cb117b4e891f14208fb98f724d476d757ff9389a3a5140aa19c91b56
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5UqDXNB6WGyvUU+JsbL/Mmv4a:BC0qDHUgvIdaDUDJXTCI+JsbL/N
TLSH
T1C0A1F932B46D4D776A76D549F9652E43DEB4602BEA21BE84D9DE0E0C11FB0EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c417ca1ee0d7e06f59674d5b3584579b4ba1e6e7b50ee722bbc77f9dbf4be1d4
MD5 6532c221d2f8475abde52ef927eefb21
SHA1 bbfba0aa32dcb2a2f79ea184058747436c8ceace
SHA512 5ee0bfa5597931b4d330d5fd4adaed9327243bdeae3090aaf4953519b4242dd0b88c1904c1986a8e03708fc4f1e951f6fbd1b8e932d648492bed3456b4aa4bb4
TLSH
T17FD02330373CBAD6C63C357080204B0071254452722183003990450CCEFC0C10FC27C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 547009a68c94bac01f52abb5f66b0adcaba66378787043f6e787e5c78bdceac6
MD5 ce16d1f42ca37b74e038d131af7ae73d
SHA1 b1675592495b5148dff4c90b88c12554168859c4
SHA512 c754f9ed3111911b906b2028789260581fb4fc017090ead10fbc37872f95685c12b9fb14f56471d3c8005e224d0138439e97631ab2aa9c20a1372fceffdf8f6f
TLSH
T177D02334777CBE16CB1F39706411C75273525550B515D36165B1410CDDF95D50B8E186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

4699819b-473d-4416-9bfd-cd73118d501b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4699819b-473d-4416-9bfd-cd73118d501b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5461409c-7067-46a7-aca5-add178b62317.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5461409c-7067-46a7-aca5-add178b62317.tmp
Size 414B
SHA256 fee1191ac0c99c22b2e4522fc29e146073615d27d325bbcb6cf934b5371b2688
MD5 c40cc01a5f8f229a0e15a7c682e7774a
SHA1 d5e314eb5039d1687d63cd9a3a1ea2c2cf56931a
SHA512 47bce544eeb7ab1064f1832f571558cb53fa104f82c1783aee456bf29ed65b7ec4d8e485a5ee4c928a5f2a902707cb9c40dbc529041683e283abf716f33de4f9
TLSH
T1DFE0ABBACC20E8730CFE0B08A040420AD750034B2E00890B3A3C820CCFB47260246C5C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f1d2292c5d4c169125dfcfc3ca06ec125c563e447dd9e9fe3f2afd2f82f8d280
MD5 8c5bbac1b45cb3ebcaa10a447a64fa18
SHA1 de96aedc3de0f62ed5be6d6ce4c87887382b5af1
SHA512 c20c04c089d98c36df86f6cf49545c0265ef467454d31a3c11bc57ff39724b8a2898c20bc0f056094324565ccf23fb3d9dbad0bad8f64f08f211a48887b0ec53
TLSH
T1E1E020C418D5C35DD60174C7C37C634D81917A0EE2C4B9295F08AC647101444F7E5770
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d03509f3ff7c7fff23fd485cf8eb96b5a52d72ee1d8363da5508017bc1a6b4c2
MD5 68fd0385b783fddd8c2c5182729bc447
SHA1 188bb772a6b65dcc868ff03c578d9c0b88eb12e6
SHA512 8fb0c1c294beea7866823be64411b128dabfcd82e117265aa8e6b72a07a8dcaf0d4d5c09dadcb4620a41e0db4e3f076d1a8cd894b41a1c40b1428ab2f97c446c
TLSH
T1D5E07DC908E8C32FBB0164A7436D430CC281370AE2C8BA3A570C84C4F503098B3E27B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ef131d9fafff6dc250f8321e55967d63db9eaa1eb63049716b2e06e54c7ef083
MD5 21d11ba191c6673f706be746fa082918
SHA1 7fbad5ea02b8a672f655e7c72028e2d0830450ce
SHA512 8e12f151b91b4b5a1386cc38375498a8aeaa119564e41c373ac892007d9f55a348112937461d0d2431f2f061b17bd0aa886ae490bb4e4a97a607a3bfd21d266c
SSDEEP 192:Xi0cvQCCipf2vEjeIVAYoT0iam1Z39DrIt9ln36FhzANq08eziERQYw0bauxStVD:XbcbCBDp9DrIrB36YpHKYwXtRZjaGb
TLSH
T1EA13A43E3A064D5BC3CB513C6F9B5B3567B0C869D4C6010B9AB132160766F7A8BCE923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ae11aebb561b43f5a68392e3688157e79b8f486aa98b9a6b9eb48b57bce42452
MD5 6f7c20c61ceee8c7198a11ddf3f32757
SHA1 78cb1477197c9b7f46b256a9aee8ce16cbc8c93e
SHA512 92805ba8a98439c9a8b0e3f6c32839f89deb789500570492acda8f9d14774261274c0ce33d906b7cff7e9d833e806531ae2ead975bb5ada1d9a3b132205a0e5c
SSDEEP 1536:Oi+9/mL/X4L/tPFuDi+G50/GFZLh+VvCtu7:zL/IL/VFner7
TLSH
T1B1444EF71951A01BCBA852F5E2033A3DD1B7454D7CD2F8E9E5784C852829F32B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d24fad09633edfe72101e4e2722b69b52da1adea69082cdf297e0a34fefa2479
MD5 71d8b42a700d877870e2339497e3aae3
SHA1 78e13a63b11d4f328594756a09068d430ea67d74
SHA512 58ddd56630e898f847ed44013f2591f639145068105419d1fd72314b88d49ea6f9ae11f20060d996b22ff864bef0cabb0a3ad019750edbb71cf7717c5ebde1c6
SSDEEP 24576:UFH0SwOa/nWUvol59X+JV0RURmlPZfDe+qjmxWF4fL:UFUxV/WUQ9X+r0mmnkcq4fL
TLSH
T1B8167DEDC9785883CD63AA30B5F0E9477C7413C3F594C1E68898C584026BBC5BFAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e84f98617e06f521b3efdfe26ee4fc1a06466f1f225b6f60de651b2d0f47e17
MD5 e6c38db236911d5e0a7980efd1e334aa
SHA1 2067e337383e8c94a149aecffa9aa8fe2ab956c9
SHA512 d027dd7b0bfacb499f81732f9cdf31b7f8061ef86978c303a23f78acfb1335bd7d80662eecdce0ad53589f84610d0e5b0935914b61b96900afd6ba26f43f7907
TLSH
T1FB615F41831A19EDD7A788B1AFD0974833F19271EBC3AE55A0412CF45B67F3493DA027
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2665.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2665.TMP
Size 3KB
SHA256 3c692959a082957de01b480f699b56d3a41fae8d24ed36caf0dbdc6c9694e758
MD5 b52c55ee5d5ee3ef4d9d39d7f8af2927
SHA1 864e11caf2827ebd2f5cdc0f8111ceb4ce1a314f
SHA512 6fe936636925d6b89fa4d317688a9c83f616c916e688a129a65f0a7b01ff72e2fae0a4bfd8f695ec6beb3645e4752e960afae867a9e56c65e783b304dd64aab3
TLSH
T1E2615F41831A19EDD7A788B2AFD0974833F192B1EBC3AE55A0412CF05B67F3493DA017
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 46d71c3dc45425f582a1b45241c7f713b0310546d7848819f1e532c6e0c6e56f
MD5 c0ffc358d620ae787287b450bab9e6f5
SHA1 0153fc5db5c005ead47f8c01b561a17583029950
SHA512 e17cc1f5e823894335216cc3274abab34d719f25eac933a6b5f76695c5070b7c8ac4c47248282de3dc3dc7e93d3da2774d4aba0d5a23fcdc472baef22ca26a41
SSDEEP 3:MsEllllkEthXllkl2zE/ln1r3t:/M/xT02z4r3t
TLSH
T1964404177FC54407C50511304051C3503770D4101733774334710437FCDDF400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 7056754ba8917316a6516a852b7571520228f6371a0a3d22c8fdd0121a0f2b07
MD5 9978ef510199dd069adf4ccf78b0cb5b
SHA1 e0f353f5a7f969a61c8039c4fdf4fab8b03b12b3
SHA512 8a3c883678c16a5d5cf32eb6ea193db109cc322273987413872d20782b61782e077edae3690bb0e05d2b81f7ce207cbabc35b337d5e49e83fbd3eb722b265fe3
TLSH
T13BE026C414E8C269D51469B3C27C4308E2D23502B3C83D66271CC8607141241A3A72E6
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 7afa39a5aeb7d4b8eec590bebe8c5f97b914189acd5bc63c292fce68a4cfc588
MD5 dfc89a8a1ebe7caab8fdef8c7aa6e8f0
SHA1 2e8b7ba5a906a9f7183e439533f5f3d3025596e5
SHA512 e7c221a6df951a71c8081524d9f407d349fd54ba1fd433a121e526a6aabd4a134dc3ed97b36050935b00e0117df00b361f3b816c84f2b8ebf1acb80968a912ea
SSDEEP 96:NEyTOoHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/xo9bbEOVpZf24JkMfXSFRe:NEyTGH+bF+UI3iWGVoWN3qL/xOVVV63
TLSH
T17F24111E5F353722CDBD813668E744A35C7DF03F8B1326DA68611474CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d1e4ef4026fd549357e1e5872b645f05618659265f5b0ca94b983a69ba474292
MD5 96d1a6d85ebe17edfa7d738f2e27d1ce
SHA1 d9f6f0aad1cdfac8dc5f1dfa24c7bbb76fa3b32b
SHA512 69ff0295426c6437dbd389f58c70404579cb0c54b433e656f289af050b8c9efa4732f1f01eabc5f2ad324506709e566e03f4ee18bb8e5cf18943b04b12cfc96a
TLSH
T11CE0D8E145DDC25D5704605B52786708D3A13506E7C83A126B089C40B446004B7A21E6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 d9e05a2fe284ad3388e0b0ea1e0aa706492b972ad4b354013f386489889a9629
MD5 15f78425585b6c4715c07fb77bd485f1
SHA1 be8737daaf2755a3052fb61946d76d5ff3f377a2
SHA512 b295aa174d02b490b64f7d03554037749eee496888141663388d7ecf8c4cbaadaa9f50f03ded17175e9e918ebc88d831017c452176003f47cda152b17e199a61
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oEwVcZSRBQ4Vc:qDeMatha9RAIIcZSRpVc
TLSH
T1CFB2E04D5F307211D0F44A76EDD185672F7C211DC3B36659D91860B2CEA269BF50A066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff3badcb3b69ce4a2adff8357b001e1a2072d0f8ffee4bcd21aa32eae9914693
MD5 c0f49050046ea05d4ca3a8474ad9f95c
SHA1 37008681b9da981b314150e5226ad9ffbb0e3212
SHA512 448037c5dc657fefa052b676f1c5f9359a0e0cb5f2441a1362eac1d1312a83acef168d1d90f1fbffc483f1e1c92b6db2c42f8a0ce12f4d2ba70a7d9de9ac98af
TLSH
T1B351ADF3C3E8D66E890156F0AA187E1BDE1D0964832C3D5AC8E4AF5BA3F2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 97b346182cce4837fe18c97289300c911d56f808b72b515a059f6db212dddb52
MD5 4fd6ab04a3b99a50655f26f7be7c7875
SHA1 9e54a5e9f2e1a5a6ae9cf29e7a145a5d5a04ec99
SHA512 c1dd4e32abf251f4ecf0bface8cd157190606679d6fae4f008efd79cb3b6f55c7dc58378a322c0906233125f25aec242ac08098bbcb92a404e4e0e43e4026aab
TLSH
T1FA51ADF3C3E8D66E890156F0AA187E1BDE1D0964832C3D5AC8E4AF5BA3F2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 7fe44956c852aaf2c5e3664abb5c72d7d4ebecf0ccc430cde5960a1377aaeacf
MD5 57b22323b874790ccdcae85365e1fd63
SHA1 a7961ddc0bd36c7e6725fc34f76d50de1ec18460
SHA512 788fb64c335545c226902b018a590baa11f78d4bf9fd53e15706c3bd97f8772741f9399766153899e32e4c2ed518d1784627848fd4182497e5599164d59b87dd
TLSH
T150C0221280B8F8734034583B6D80B885BA79E03400A290E0D89C973DA0E04B7AA0202A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4b77e380cc8bba2d46d660061b80da10be94c6344ecdec790992f3ab5126c8d4
MD5 8d21233ecc70b53640048beb213fe26c
SHA1 79773cd8d6995dae2e04f1d84ebbddbd37b331b7
SHA512 6d65d803dfa9cabf8e5f0b1bc5377ba71a6502a8216baa092b7f8b4736f79db1b81ccc2a5bfdc0d24fe410b77ac2a9d1ea1d4367e67b8a48a182facf219e6278
SSDEEP 192:sxR3RyCB/fGsgQ0MZhB3zoA8p4m/g6+WNIYD986SEFGnhIgVyJ:sxR3HB/fGsj0yzej/5ISSE0c
TLSH
T1E232B816AA68993B9CCBE21DBB65BF53D2F95032A1D01E48F6FC960C04EB6DD130741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2c8bb7b8e6f0c7f67825580b0dec1716042d81783f391569dd96b92516f06ebd
MD5 7ecb812d24caeb61d0446cafa4320980
SHA1 fd7d05a88f793ea54b10bebacb323aa89b538cfb
SHA512 3c2a1fc2d8aab91b6049e74bbab1b1dcf2c75e0eb2f247c0d11eaabdd1e22f666d1ca7684edc388ab1adc1d0561cea736c5f9a64c7db9d5ca3e705488cd4f83f
SSDEEP 192:sxRQRyCB/fGsxQvVMZhB3zoA8p4m/g6+WNIYD9Z6SEFGnhIgDJyJ:sxRQHB/fGsuvVyzej/5I5SE0M
TLSH
T1FE42A716AA68997B9CCBE219BB55BF53D2F95032A1D01E48A7FC870C04EB6DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 11b185a4280ccfdeb677f281523c78d67a1b9186097b9a78ae711f04875be251
MD5 8e56ac20fdb7f8e707744c6f5963d5f2
SHA1 ab099dcbc61047d816cf9f00fbc66be310cadeac
SHA512 e104032fd6c5c6adb65feabb89ea84245d65bdc7ab61c4933839db5a03e1f5ab658c264e9ea0a4428e6ffed4ed36439748edbf24f4f5a674c564ff63b694198f
SSDEEP 192:sxRSReCB/fGs4WpVnQ5VMZhB3zoA8pem/g6+WNIYD986SEGgnhIgDJyJ:sxRSHB/fGs4WvQ5Vyze5/5IaSElM
TLSH
T15D42B71AA928997B9DCBE21DFB657F53D2F91032A1D11E48A6FC860C04FB6DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad95abee1d3184e876c3bb23f0ce93ac752eeddaa4b2bc3834e37c9d5315f7fa
MD5 91518a9ff0f3bd064254135a9a46917c
SHA1 c8761eb365537ef11ac707224fea7f1594571b84
SHA512 39246ea431c9e6821032edb05e66e2df0a2f15ea1613b5b6a7266d51cb6c0090bcc10177657de7ec567a527dab74e8f702e2a0ae237aab049fe484cc5ce69b01
SSDEEP 192:sxRSReCB/fGs0WpVnB5DMZhBbCzoA8pem/g6+WNIYD986SE/GnhIgDJyJ:sxRSHB/fGs0WvB5DyzbP5/5IaSEmM
TLSH
T14452B81AA928597B9DCBE21DBB5A7F53D3F95032A1911E84A6FC860C00EB7DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 59cba5ad374ae907fd0bb0f5fb8d17acae11582043dc878f5ad0d5beb9f9b5bd
MD5 7a60cd2f0022efabb4b634db0874f554
SHA1 7b55779af5c17f3fad284b121183e97d35ab4c25
SHA512 f3cd9b6e0f4cc1b6d3ac34c5433e931e5837a2ebe64fe3c2d162f73e2bf41c50d50917f16610b5134ce1da2802a39ea1b02ff6678012e31326de66b2591f5933
SSDEEP 192:sxRQRyCB/fGsxQ0MZhB3zoA8p4m/g6+WNIYD986SEFGnhIgD7yJ:sxRQHB/fGsu0yzej/5ISSE0O
TLSH
T11332B916AA68993B9CCBD21DBB55BF53D2F95032A1D01E48F6FC960C04EB6DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2d1cc0c56c2667bd9c13098cde3251018675438cd69389c852449feb14d5da13
MD5 7f0a5f4e76a3e37993c90c092b44fd74
SHA1 4f54e5970ecdd16e685a93fd4983834c74268b0e
SHA512 2955a56cfd69d227f34ab7fbf738dda31bf2bccfb36c5bc89024ac92cebd02634ffa74d58d1cdaf1dead346af50999f82857f23abc21f6cdf1371809c112ab18
SSDEEP 768:azfWrL7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4Yc16oropC/vH:azfWrdE7J0Wg/XfHfu1jak4Yy6TpCH
TLSH
T199D2DA7B640CCE7F4F800ADDAD197E9F6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 008a9f003a08e04824c2f9a310ffbc18649826486e239532b1c2b0c501bf06e1
MD5 a43622cdf39007ccde096efa08d5d7cd
SHA1 f628a5812df7e858f964411e5edfa6c5649db31c
SHA512 7caa32b969b3a0e2a697a4bf675dd3d8f77e8182638c5ea3ef595b0ee5dbac96632b6de4293d6dfe743eaf8f39eb097f1ef821e8718cc45ec980674874176b50
TLSH
T115E0262049FAC2BD6555225302388308E3E57507E3C83D223F08C8857546508B2A22AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 ed6d18645d1a7b4849b5b0d5dcf68ebacb854c475e310a1b2872bf842c681a7f
MD5 ea4294813d569a30c93856ced818617a
SHA1 13f40a291525efac6916bef69f76fae53855c109
SHA512 311d4c6f6f5247e9a6d395a068a008e12bbc1be27a59ba4db71331d27da9fb1d7e26f6d25b73e2723fb4d5ecd606d55b43089bf37ad3b2fe35e175cf6829d58f
TLSH
T116E0D82059E9C36E664560974328E308D2A37503E7C93A353B0D94C4720A180B3A35B5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 7fccd0d451da27cd37b5a042ddaa5407d37e3a6edaed2fc8da6de76deaa54b46
MD5 6da790e050ee8c303aa00045a418e03c
SHA1 d4842a440508ea62c6cdf29a994076b88152cc4a
SHA512 3e5eb009ca907ff0ac9df68b554597be63410e8b18082181aecd7ca98ca970e879ff8025c19a44cceda91a00908c4d2ee82cc43ba3eefd943dc69aa2ee0f2651
TLSH
T116E08670C5FDC37E5708A0934274971CE2F17906F7C93A66A70C44A0B509564B3B69A6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 878241591db7f28febf49226d10b860352ac6fda7bec34dde23bfbc891b5c6e2
MD5 ae1ef7f77b4f0ddf727ab4c07716a36d
SHA1 e73b70ab60de05a20ed567c38798c3f42ebd126a
SHA512 4ecb27f3c6f6a16855dc6086c0ce571e2016b23189fab061016b98f296e4fbac531d885bf1f2817a2feabd5c6fa58a2ab0d1064ead5c3adb9b0b056203a226a7
SSDEEP 96:KREWELEaE2EQE4E4EeWEIEdEFgEWEeK4ErgEEEecE+EWE1E0EmE/HEmE7EKEmEgm:CEWELEaE2EQE4E4E5EIEdEGEWEWErgEd
TLSH
T11D917441317B0280397D6A0885A8981BD2C3B876716CF4AF3FA805A68F6EE135DFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 3bd39fca005d64084f6587bcf9c142e8b8b8b1b67e9be3c1a1523be5dfc23711
MD5 738d86b5dbc332a554d99afc31793239
SHA1 57c7c427adb22b70e614a1d9db065399ee8b803b
SHA512 d5d95ff8c9539deac5b7ef1719c3a4853c1b323392a72db3186f5a9834200bf106eb384030fff215a807e58de30f204dc163f8cfc553b62bb9c99e0db6adf8f6
SSDEEP 384:DNrRZyCSDnxTICPMEhIKyll7svbFKfk7:xFZJSDniRyI1l7svbF9
TLSH
T18B44950A7B747001EDE6DD721CB080771E3CB16E8F26A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 2a4e331f22bad1942eb93d5364902648a881dbf5f2c7b4155bb49861aabba25e
MD5 857bfee04568ba0846ab5ae09192378b
SHA1 b9ad77230322fd9b5e84e2f8dfa1884c073b912c
SHA512 335bffcd9aef26d670da8e536f3c3e1ec4841949229f810cd2626bb9eae35496d1ec8979546fd00b4dcc8b7d1734023c3ff20062ea13b53cd7d5659633ff0158
SSDEEP 192:bqQ3III2bGMIMAhYcYVFO/L4AsVlrhNCs9G+jQG:bqQ3III2bGMIMyBt/LhsPqs9G+s
TLSH
T1C742949A2B411B73C0AF5F762362C6589BD84883517A212D32526C1F8DF3F9B82C56F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 aaa1496127eadad35ffa7107644b8b4d997e90c325c2767dcb54e43b85d20207
MD5 69be4f043ebca3e7ff85b014e356a993
SHA1 a36d0c60c20733adf6e4b833b32ae1674dd808b2
SHA512 b510323f855bb0a62116423986400b7a6dc6c6110aa4176981d6db5eebf889e3c83e06023f5eb82a09bb38068b507a108e31ae4f2012b14036c6ebadb99c0349
TLSH
T155E086A1A9EDC6EEB91421A742744348E3923A0BFFC939663F0CC494B545148B3AB5E6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b209c05fae49bbe418be6d279a1b025a2e4ee9617373c068c20d72e63c99055c
MD5 d91c72268bed47ae714153e5d6082bfb
SHA1 9a8f8587d2a1950d8b4bbe7915cce2f43788e9ec
SHA512 d10bbda6469fe505658ed555efbf29eae62bb3f045a483b7ba23317a269348dcadae2d984b46848248f79f3163492789fa3ef8b5f86b8c5c096017b99b656729
TLSH
T1C6210495F330C208E14A863EA07E9B291738E816CFBCEC0F447924256E72B400E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 c55dd1101ed72deef03682933bcdaad91acb086658967f2a78cfcb428d8b8e5b
MD5 39c5c93c757a6982e916ba65dd8a542e
SHA1 751633b14f0700cb9920558ee4c6ebfe1d5598af
SHA512 cfd6f32563db2b3ed70659cfcadb760fab88dd41439282ee3386b65886dd25dc4c47754961958e6218cb3bd0ad6e3754fabe0f3de89250b08121bbed5c9c9202
TLSH
T138E0806464EDC6DF651421A343749348D3923947FFC53E153F08CC547545145735F5E6
MD5 SHA1 SHA512 TLSH

Submit Download

821f86c8-8bb2-4d30-b9e8-a5b6fca098e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\821f86c8-8bb2-4d30-b9e8-a5b6fca098e4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 cd4fa5a6ae784870cd4e3b2b003bb379d0636cee343137ccc4909d8a17b4e7ed
MD5 0c14b062981c5cf1ab049d5e3874f879
SHA1 e7098cccaee094d2e4aa9462b29103696f581fbd
SHA512 c455a182f726afb07fb9f0006995e83a124c4a10b9aca2e5f30d971d03af4eda58149d4d718fb8248e955e079674c80e0dbacc11bd82de55b37387ccdb5b9c97
SSDEEP 3:MsEllllkEthXllkl2zEQ8rd:/M/xT02zfq
TLSH
T1374404157FC01505D70F1030C051C3501371D411153157D7347304177CC75700C00011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7d83f7359c7daa793f8364247d50905bf1ab8888c6979f663de673e48c9350aa
MD5 c681952e03b43563228c8967373e4194
SHA1 0d82af17a7225e34330d85bef5628f74c54e564f
SHA512 c0b32cda0505f2e2385fd931cbafb32e960bde7bbba758a7822d8ae913035d0b62b3611d87dfb8083809b160f029a5a12e2341e47784cbbd1b050b03acefc65c
SSDEEP 768:9irv+4UNbdS3VOi0HrEnjN3Gac1FGeVH1SC8:4bsbg3+HQnjMa9EH12
TLSH
T13203BF3569A8DEB38CEBE385B18776437FB412A385900FE4C9D96B0D06975D8230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e0338b1f24ce73d233543d1f1645d39c9ec424f4dd73bfa33c3f3e053861cc50
MD5 fb482bb0caf331d3888f96acf107a56f
SHA1 72dcc37d1a9a4cf284d2e975f10b89b751d1c135
SHA512 5c3e1eb802393e5e99fbc2a9d133ae39f2bac2ce14938803dd6fc4d7f1fd92292aa42354b95cef27fef2faefced978b0adace2b240cb11fe5b641129052a8105
SSDEEP 384:nhhtNn/s3n9SV38NNNnFAUCi2WZlf8hyEGSO1RwOiFcy2rEoajo4cdR8eHhVODjZ:hhj+9S3m4iHi0RrEnjN3Gac1FGMjpm
TLSH
T12FF2AF357DA5DDB38CDED285B6477B42AFA016A385C00E94CAD9AA0D05C76EC130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e2c6f5ea0c87567b15e4329506f826a5f4741f3baff74b219a49970528f0fa5c
MD5 b2bd35d130170cbb9de2566b5db03bbf
SHA1 7cb1304866c567ed31ed41bcacf2c94045e29a27
SHA512 3fd9381db90a9d8280b0bcebcb7afdbbd3725896d1c0d2ebadd9f00bf211a0848b57b44ec999e3f27cef4fdad879d03dc9cf22ea4229cd72ad6d9e3f8971e07a
SSDEEP 768:ULFxj+9F3bwg07iksvrEnjN3Gac1WyNMb3jhu0jp3:39F3ZvQnjMa4Ne3Nuu
TLSH
T120136C3AED94CEBB8CEAA7C5770A7A029DD002A3C5D849D4DBC86E0C10E75EC9307D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7a4935d99365e53b4ddb263038b91e1f1c4cf60fc1a2265069d11069def97e3f
MD5 2543f22040914faca508714c2ce61c93
SHA1 23b6041b0a16edf8049c95fbb502ddceafe0ca34
SHA512 11727d33e1a7c890458aa936f9cc456ff92ace4887ea411ded7769ebcb426bec978c935818a732d1cd722a5839c7c1a5ea7426ab2beb6b15656aff0def1e3b63
SSDEEP 768:URFxj+9F3Uwg0iiksmrEnjN3Gac1FlUMb3jhpMjpm:N9F3jmQnjMa0Ue3Np/
TLSH
T104135B3E9D548ABF88EEBB85760E7A169ED402B7C1B449D4CBC85F0C90B359CE307925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f80ea4374d6fe6eaab13488c5162a6616b7274f489757ddca5cc352eaa3e2dd9
MD5 d3788ef2b5ab2937ab44fd679d8611c0
SHA1 9ff64c273b3a36718079cfa0eb267d3621a7a77e
SHA512 da8d19cfd27097a9ee34372f3150ed3a215d8b60dd5e2b711c30a47045b15bfbd7b1c413859c0512b237d16dcaa619c49668a653a072f2c190c611d7f1c84752
SSDEEP 768:hYrv+4UNbdS3H2iHi07rEnjN3Gac1FGeVH1SCx:ebsbg3x7QnjMa9EH1X
TLSH
T17313BE3168B8CEB34CEAE38571837A437FA4266385C40BA4C9C9AB0D06975D9230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52f5f7e1bd6ec33d79fd7dd66f2b514c0c132ef05ae49e22bcdf1f8f8e40a1ba
MD5 3cc88e1429f8e03c18ff7e87eae61bf5
SHA1 00f06e348e24152a51fd791ee16e5414548e3dcb
SHA512 0366cbfb46cb59db5ae29fdbe08a9a4647e9e36ef8d53c1f0f0be1cdb25f54064ccc04929decfa7efc039a93f36552f3f494d1725f091adad81d5b7d400f651d
SSDEEP 384:nchtNn/s3n9SV38NNUnFAbCi2WZlf8hyEGSO1RwOiFcy2rEoajo4cdR8eHhVODjZ:chj+9m3fniHi0RrEnjN3Gac1FGMjpm
TLSH
T1D2F2BE357DA5CDB38CDED385B6477B42AFA016A384C00E94CAD9AA0D05D76EC130B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb8c8f1ee4019960d7805424e687881a2d34864fdd0699780565c3f4d948d198
MD5 d6f28aec49db2488f30070df43c9ce7f
SHA1 22c47a0125fcd06dbff7811375c275588cecdb43
SHA512 d2cf619af472d425903a7242f0f5645e8f46bf0f59fd15110cbe0912aad8248c75fbd8d9c51bdb462c9720dfa2eeab226d6313403e034cda9da6c76e84ca80e1
SSDEEP 768:URF1j+9U3Uwg0Biks8rEnjN3Gac1FGMjpm:b9U3K8QnjMa9/
TLSH
T177038D36E9A4CEB79DEA97C6B7067B42DED012A385C84DD4DAC86D4C00D76ED030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6d6bdd15fd424a08640f2725eceb51b650eaf02fedaa0107ff1317c57fc3c32c
MD5 baeaa1b7baa2e768520b9dd07cb3afe3
SHA1 611f1379a7d3b62830846eb4c9d233d37b6acc1e
SHA512 88755e22fac3e7facaca7b1b115868b62dff4adec09be5745b40724663c26da6b7f4343c732b32d5431c2bce6a6a53cc68d0373bfc813284cee73c59020038a5
SSDEEP 384:nchtNn/s3n9SP38NNUnFAgCi2WZlf8hyEGSO1RwOiFcy2rEoajo4cdR8eHhVODjZ:chj+9k3foiHi0RrEnjN3Gac1FGMjpm
TLSH
T150F2BE357DA5CDB38CDED285B6477B42AFA016A384C00E94CAD9AA0D05D76EC130B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 81fef1a7cd6a056975b8e65d3f8ab069e35b9004d568573272b9048a34ac6a34
MD5 8f6a7397e9d809d55a06d1f7c5b3698b
SHA1 b5c8cf42d7ee068276811b5c4a895c8572dcfd0a
SHA512 73bd38c6570cdd8587928539a70707ea8fc9222e5fe62dac06910be6b18257adce24b527532ec3464d0ad547ca0e620686f39e50cae101ed69ebbcf1dd36b496
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isuQQtydNXzbdRaUj:TL+j0afDdWec9sJVUOLfpe1jy
TLSH
T1BC9202366D351033E8DA4775BC834A910EB8035DC9A778548DE40D620DB1BC1A2862FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e02bf4d0859dfb2f8142d8f653cc052f6161c3a0a2a7fcfbb6b2a7b24da84dd8
MD5 3a81a1b1f1d45f32dc197d1d9051454b
SHA1 8b14327b20c12ad6e442c402ae39055bf5871449
SHA512 c908d8c60a6d86f94e5a8564dd258e3dc423fcd0e7e5105ad7d2cb8afbfcffd6db3ff7d0383f33652b495d079173e97a5f4ceedd77ed1d3b3c3501fa3688e871
SSDEEP 3:MsEllllkEthXllkl2zEEat:/M/xT02zzat
TLSH
T179440415FFC0C505C50510304051C3501370F43107335747347104137CD55710C01310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

94ad5528-0747-486f-86b7-ba5bc934e51e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\94ad5528-0747-486f-86b7-ba5bc934e51e.tmp
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1165cf9acd5fc666f61d051d7b9597343ab6408353578b54e9d2811a699c004e
MD5 57931d2d242e27280e553a42b2434818
SHA1 321cd651fae6db52e820fee998ad73802ac71d6d
SHA512 94389ec72192f3d6e30c474521dc4758a8ac52dc5d92492c64b3cea6693456a84c8ed8d9fad58cff47e9496922406a6ddd93ccfa3814f90afaea7eac111b4f16
TLSH
T198410FE19C3D1AD1D4BE0EBFA48B35FC84D8D226F59034792858E9548629A1E254147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 433af05e8b076ce45f5cb82447acd0ba605129a165974c072fd5340b9cb4e9c1
MD5 62b4587f21810cd8bdb4fa343d1dfd02
SHA1 a367cd14eca8ff8dfee59c48bba8686c7836fcc2
SHA512 c4b5c406264ca12d5dea526269defdb61bcb9c4509cba97b01aa72d651c88eb2e5e88855bd49279e3d07d864f8163c4e60cab6dbbdba556b3e66999704d48c36
TLSH
T1D14143E19D3C1AC1D4BD0EBFB49B35FC84D8D326F59034392898ED58862D91D254043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2d558acf280054d4e9ab5d4d0cc3f4fa43777275d3c45f6dc59948d62f4135ba
MD5 57cbbb442f85d4338bd5bbdd7bdbc6c0
SHA1 70fcac4acbe6f61090a6467e99b0114154a6beeb
SHA512 b26589e22508a1cbf9179a86a8b73495c0f40074a9f3a20e95e5c5e3794da5755c4a0019dabd7a6b257cf111f34e6daa52ff1073a0417e6ec642b1cac6e17520
TLSH
T12B4122E19D3C1AD1D4BE0EBFB49B34FC84E8D726F5A034392899EA984639A0D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 923bb621b6d18617e36607e30a4140ce9dfc454d77c4d62326e61d694a9daa19
MD5 578e14c1822a404f3988970be1a7c4f7
SHA1 5cc7c5d0cf41ddc6bf7addfbda51ce103933d6df
SHA512 80620972c399ebaf8baaf4834e6cb6895f4c5aa09b4c527c1c093a272e702046ba1e43c3d72e1ef0b602e31e2b8d688784b903a316f50300fa21265ecda8d651
TLSH
T1073121E19C3D1AD1D4BE0EBFA08B39FC84D8D216F59034396898EEA8563DA1E254147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f6e02e1e-0fa4-4050-852a-d0d248a6b204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6e02e1e-0fa4-4050-852a-d0d248a6b204.tmp
Size 38KB
SHA256 95984e5fbde28d77c532ddffbb02226a82675eb2ac8720e9fda202039519b3e5
MD5 8d66ca563562c65bc54a61fbe6a78fb9
SHA1 8a3890f410673f2f01a82893bd98b0cce7bc8494
SHA512 228c91ada70d7fb774e7f6a54dc5e48497b3c2fda40d975f2a44e3768e32cf68e8309bd3011568dae6406ed19c4f294b7f36cc3e09d79acbce77fb47f28f9462
SSDEEP 768:rrv+4UNbdS3jmi09rEnjN3Gac1ZqseVH1SCz:rbsbg3I9QnjMasEH1V
TLSH
T11003CF3669A89AB38CEBA385714776037FF4125386C40BE4CADD6B0D069B5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 ea363af3de5fd899bc881ab98f3d5881c8aa116c3bf4bbdcbe02cfa8f7ed76cf
MD5 c971b115293673f1bdd80ae8d6e7d4fc
SHA1 433d32a52366db7c0e7bad909852be7d534d3218
SHA512 a2387e6428db746a56d100653c1c5bc3164e533ac99dbe7aa9933a2e1ba7b378a4cc5100fca26dc3feb425c888e9cd21dabe06953f756e8db768c48e701f99eb
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:a69tQeoVYocxYCutFC
TLSH
T176B41037A560A098DF3C35B1E2AC5F4CBD72650B12E006421F74B57F7A237D98A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 2085eaf345127d3977cbafeef019bc6bb9fd4ad2b42490514ad7eeaf263d0320
MD5 98258bf8692d424f319080782144370d
SHA1 f17f035fd60b356824a4fad2c6c85081e5d35318
SHA512 c9d035a84eca2e4dfc1062cdaa59ce4ace2cc9a742b7c92e909647b1faf6c7681b20461266b39015b79dbd24fb4cc781157c2e2fe46247c998efba73bca3e208
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba9:oZP2tFP3vqY8KqEMvTaBacg
TLSH
T1D3258337D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 6a76cb1eb58709e5bb4442fe750159354dcd3d97b42202d746bec6cbf9cfc89a
MD5 2827561fad3c9a7c1f88ed2a1a448103
SHA1 9ac65880a6b7dcfdac4ab6fd94dfc5983c22ba47
SHA512 24c9f23c8ab8db809b2ee5e81ad2e030e0987885bbe2dce3155d2ffc637a3d57704da41ddfff39fbcd79adfd0f2f41dd7b4f48ac347f378de2b8347291e03b85
SSDEEP 96:WkagltpNXtiUMUst47XtZUMbstOUMlstDOXtIL2tRLXtzt6AtKtH:rajnanbnC
TLSH
T17A63E5501AF85B5DF7F72EB16AF9A9162E3A78A25E39D14C1210425E0C70F2CDE35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5240_1199316031\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5280_1577449741\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 14b0bb788518531d0a2848faef010b89f35119fd4a2cf5bbc5169c1b3eb40b21
MD5 5400d039cac2a1cad88784b8b6893976
SHA1 bd64444e3d149d9bd8ac197b06cf05cc72b9463b
SHA512 ce1d1d05d5b4e5333a6f54407604b0a5db25c792064415f9f8141406e36799bb28b38ea72d9ddcb9e9d44b3657baa9f3a553c4894f2aa7bc91ac49e243f7265d
TLSH
T1B6118E474E0AE4B1CD6187B359CC8E27B3B6B7CA5764D025B38AE06A490513E273D17E
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 5b47be10cb54385b2a1a386b210237c15ae1e8e43ddc3cad154774e1f1f96ee3
MD5 f980d97b4e463b6a517f9837a7a4ba2e
SHA1 6be3d09faa8beccd284b72f4cc7123bd882739ae
SHA512 2c2dda29be431300ad01d84cf3f97a881bb6580165be63535a3bc7570e90bbe795e3c6daa1bef50109bc7953fcb3eade49655265940d97f0df7fe7cb8550b9b6
TLSH
T1CD71200097E6624AE0A29933BC776B01AF77FC01B719C64E418C815B1CA5100B9BB77F
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 9879a7470686a294dd579df398943fbb0836d1cfe83508b28add59ad614849f8
MD5 436b6cf5ae6fc89511db01ca7a25e51c
SHA1 1426fbbf23fe5660b3376e58c4a11cfc4d73ed5d
SHA512 ad050cd1ef09b1a4eb3b5512f496507ba29fd5cec52e25df3c9a0690daa5b4220290ec8947351477e166e66ec21604b262d3f1c9be18a413d71729b2bd644cc6
TLSH
T1DF310210D7D66249E0B38573BC7B6B026F76FC01A719C64E418C825A1C65504B9BBB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_415185889\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1196_700425026\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2724-319-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-308-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-295-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-294-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-293-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-304-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-290-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-289-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-288-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-287-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-286-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-284-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-285-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-283-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-282-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-281-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-279-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-280-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-306-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-278-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-276-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-277-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-275-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-274-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-272-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-273-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-271-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-270-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-269-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-268-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-307-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-305-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-310-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-309-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-311-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-312-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-178-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-313-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-315-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-314-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-318-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-136-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-317-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-330-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-116-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-321-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-112-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-320-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-322-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-323-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-324-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-326-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-325-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-328-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-329-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-339-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-338-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-337-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-336-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-335-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/2724-333-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-334-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-331-0x0000000000750000-0x0000000000760000-memory.dmp

Download

memory/2724-332-0x0000000000750000-0x0000000000760000-memory.dmp

Download