3281da1304ea1a9b91b303da690bb32d9aef50a081251225effd5d0c3b187a32

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
Size 7.7MB
Sample260723-bqb99ayfje
SHA256 3281da1304ea1a9b91b303da690bb32d9aef50a081251225effd5d0c3b187a32
MD5 46bdf95ba77d41f988835e71989672d0
SHA1 c6a85dba6050c05d942914558c77544cdd34135e
SHA512 e2113c622bd130d1b673c37568e55e11bd7ce4d405d291d92a99f669d10134f4a86d018a51f535d6e9fcf76210ac5ad095740a4cbb792d429d1c3ed74a764ba4
SSDEEP 196608:89qHpuez/W2nOgBdOWeAKaoHiIu0MGKt4:8QDz++BNWJu1Gy4
TLSH
T1CA863322B297C8B6C9052279CEC67F7F6874EC4556A086CBF748B28174B0CEF859B171
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\sounds\Lockit.ogg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\HighScoreScreenTop_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\HintCircle_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T22.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\GameOverCircle_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\SliderThumb.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T19_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\BeChuzzles_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\MainMenuContext.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Zens\rainbowCHARMS.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\bass.dll	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ClickHereToPlayAgain.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\GameBUtton.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Zens\Squeezer-Rainbow_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\sounds\BigPop.ogg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\Outfits\glasses6_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Cursors.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\MindBenderGadget.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\MindbenderGlint2.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\OKButton.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\YesButton_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ClassicChuzzle_Menu.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\DragFrom_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\GameCredits_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\MindBenderMini_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\Outfits\glasses6.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ClickHereToPlayAgain_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\QuitButton.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T15.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\sounds\BigPop.ogg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\sounds\Hilite.ogg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\Outfits\glasses11.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ChangeProfile_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ScrollUp.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T06_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\TrophyRoomButton_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ChuzzleMouths.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ColorblindSymbols.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Instructions.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ScrambulatorButtonBG.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\fonts\Bauhaus9348.txt	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\SadSadTears.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T14_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\PopUninstall.exe	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Beauty.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\Outfits\glasses7_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ChaBoom.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Chuzzle-Base.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\SleepyEyes_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Star_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\ZenChuzzle_Menu.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Bonus\Outfits\glasses10_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Chuzzle-Splode.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\MindbenderGlint2_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Trophies\T17.jpg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Zens\Zen-Color.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\CustomCursors.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\sounds\CascadePop.ogg	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Matched.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Scrambulator_Font.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Title_Chuzzle_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\fonts\Bauhaus9310.txt	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\fonts\Bauhaus9310.txt	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\AreYouSure_Alpha.gif	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_879793633\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_8688_1038154534\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_288432101\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_901654569\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_1659548361\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\popcinfo.dat	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_288432101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_901654569\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_1659548361\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_1659548361\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8688_591180193\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
9024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292432623665725"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{6E61D992-4C7B-4D19-BB97-C7C5CA8EE088}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
7348	msedge.exe
7348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe
8688	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
8688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 8688	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	91
PID 8688 wrote to memory of 8716	8688	msedge.exe	92
PID 8688 wrote to memory of 9032	8688	msedge.exe	94
PID 8688 wrote to memory of 9024	8688	msedge.exe	95
PID 8688 wrote to memory of 9032	8688	msedge.exe	94
PID 8688 wrote to memory of 9032	8688	msedge.exe	94
PID 8688 wrote to memory of 9120	8688	msedge.exe	96
PID 8688 wrote to memory of 9120	8688	msedge.exe	96
PID 8688 wrote to memory of 9204	8688	msedge.exe	97
PID 8688 wrote to memory of 9204	8688	msedge.exe	97
PID 8688 wrote to memory of 9204	8688	msedge.exe	97
PID 8688 wrote to memory of 9212	8688	msedge.exe	98
PID 8688 wrote to memory of 9212	8688	msedge.exe	98
PID 8688 wrote to memory of 9212	8688	msedge.exe	98
PID 8688 wrote to memory of 3160	8688	msedge.exe	99
PID 8688 wrote to memory of 3748	8688	msedge.exe	100
PID 8688 wrote to memory of 3160	8688	msedge.exe	99
PID 8688 wrote to memory of 3160	8688	msedge.exe	99
PID 8688 wrote to memory of 3748	8688	msedge.exe	100
PID 8688 wrote to memory of 3748	8688	msedge.exe	100
PID 8688 wrote to memory of 5148	8688	msedge.exe	101
PID 8688 wrote to memory of 5148	8688	msedge.exe	101
PID 8688 wrote to memory of 7260	8688	msedge.exe	103
PID 8688 wrote to memory of 2312	8688	msedge.exe	104
PID 8688 wrote to memory of 7260	8688	msedge.exe	103
PID 8688 wrote to memory of 2312	8688	msedge.exe	104
PID 8688 wrote to memory of 6204	8688	msedge.exe	106
PID 8688 wrote to memory of 980	8688	msedge.exe	107
PID 8688 wrote to memory of 980	8688	msedge.exe	107
PID 8688 wrote to memory of 4740	8688	msedge.exe	110
PID 8688 wrote to memory of 4740	8688	msedge.exe	110
PID 8688 wrote to memory of 6176	8688	msedge.exe	111
PID 8688 wrote to memory of 6176	8688	msedge.exe	111
PID 8688 wrote to memory of 6344	8688	msedge.exe	113
PID 8688 wrote to memory of 6344	8688	msedge.exe	113
PID 4360 wrote to memory of 1188	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	114
PID 8688 wrote to memory of 1288	8688	msedge.exe	115
PID 8688 wrote to memory of 1288	8688	msedge.exe	115
PID 8688 wrote to memory of 1288	8688	msedge.exe	115
PID 4360 wrote to memory of 7460	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	116
PID 8688 wrote to memory of 7528	8688	msedge.exe	117
PID 8688 wrote to memory of 7528	8688	msedge.exe	117
PID 8688 wrote to memory of 7528	8688	msedge.exe	117
PID 4360 wrote to memory of 7808	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	118
PID 8688 wrote to memory of 7824	8688	msedge.exe	119
PID 8688 wrote to memory of 7824	8688	msedge.exe	119
PID 8688 wrote to memory of 7824	8688	msedge.exe	119
PID 4360 wrote to memory of 8032	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	120
PID 8688 wrote to memory of 8092	8688	msedge.exe	121
PID 8688 wrote to memory of 8092	8688	msedge.exe	121
PID 8688 wrote to memory of 8092	8688	msedge.exe	121
PID 8688 wrote to memory of 2340	8688	msedge.exe	122
PID 8688 wrote to memory of 3172	8688	msedge.exe	123
PID 8688 wrote to memory of 6008	8688	msedge.exe	124
PID 4360 wrote to memory of 4572	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	125
PID 8688 wrote to memory of 5364	8688	msedge.exe	126
PID 8688 wrote to memory of 5364	8688	msedge.exe	126
PID 8688 wrote to memory of 5364	8688	msedge.exe	126
PID 4360 wrote to memory of 256	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	128
PID 8688 wrote to memory of 4348	8688	msedge.exe	129
PID 8688 wrote to memory of 4348	8688	msedge.exe	129
PID 8688 wrote to memory of 4348	8688	msedge.exe	129
PID 4360 wrote to memory of 8220	4360	2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe	130
PID 8688 wrote to memory of 8240	8688	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_46bdf95ba77d41f988835e71989672d0_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:8688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe1d8dc188,0x7ffe1d8dc194,0x7ffe1d8dc1a0
    3⤵
    PID:8716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,5005700630367484133,7664471205212202902,262144 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:9032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,15998222732196911346,9501040210533394113,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
    3⤵
    - System Time Discovery
    PID:9024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,10004211848321380768,16754536201418822938,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:9120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,2576316667781455786,281500778332497380,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:9204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,4431703850684732017,14059010505912209760,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:9212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,845910532007969680,1233123902385049438,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7742401166326204414,4003325249914915378,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:9
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,3246136711790909368,9478636567291971394,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,7790202500053147820,3479616303044278215,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,10786629704232451542,5216277656712567066,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8919966431569604479,8035489087041255919,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:7644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8919966431569604479,8035489087041255919,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,1737579914618831738,14094887492769393382,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10337416571063482638,308002459183673051,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3111684613103648459,4645881854043697427,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,9483504584414618678,12857542575282011836,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6536,i,6741178453396236715,9990401053815185852,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6816,i,4349894165401199416,2065592531096764517,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:7528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4904,i,6344592282461347249,17080652509507555711,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:7824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6576,i,13963289245439948406,7550266362103147259,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
    3⤵
    PID:8092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,15167376883777052494,9930113703296967152,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=1220 /prefetch:14
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,353494740264663056,7692157935323654226,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,13050349872479659301,11248073345072890941,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=1432,i,6707657668015472834,8509792064224615591,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5484,i,14489498731086452969,9282902012306154233,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5544,i,13402421758889771251,8908623020831900228,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=1476 /prefetch:1
    3⤵
    PID:8240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7284,i,13397966569002279293,17904174011706355701,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
    3⤵
    PID:8400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7360,i,14965284310104812582,16717141667460760662,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
    3⤵
    PID:8644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,12078464689747819174,11170674480996788849,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14
    3⤵
    PID:9092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7984,i,9613754333279994713,5631435357490212528,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8152,i,8906516840132423857,1300514543221525187,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:14
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8304,i,9594021892800938020,1960274386879825718,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8444,i,16265206816037860016,12336637094098417007,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,10569075553643965589,12555492696548432488,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8564,i,607547362736667894,11140104749932466181,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8604 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8684,i,9497730622507253094,14120752955169335650,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8568,i,2183895638325220008,13507476503105952614,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8988,i,1820420403845533127,8674951788384342569,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:14
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8688,i,13420807865792016918,16643612905277361678,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9236,i,136148414272994160,13485918611571199357,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9192,i,2039919138594486961,11349059171868798792,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9544,i,1724473422944136531,6784558419680031066,262144 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9548,i,14755866057563551816,17182792186401608077,524288 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:14
    3⤵
    PID:7432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9656,i,3969793542815647410,4175924331314995467,2097152 --field-trial-handle=2480,i,844251555162094675,933790130560071538,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
    3⤵
    PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:7460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:7808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:8032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:8220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html
  2⤵
  PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chuzzle.exe

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\Chuzzle.exe
Size 1.7MB
SHA256 dbf8ab70f0de3bb4e4bbecd46ed0d7ccb48a77c597d51ed2c546756b8440f78f
MD5 7a8cf1d8c3644717b088f0acd2fe5088
SHA1 a62985c29f79fabd34b533a29c952a791cc5299d
SHA512 5cad8f67e483ab526cbb443a36a05eac2635ddecbbcbdfbc4b8f344045ee6fd51d72fc3194c44ee6747c84c765e27ac6c1c8b3388168096983127cc87cf9f5b5
SSDEEP 49152:k0mxYj+MFpKuc3L02Xj+3De2TvmgGzYho3NA:kb2+MFXc7rXy3DjTvdho3NA
TLSH
T150852340EB4CC966EE4CC83B85015F46450DEBCA4ED0C1DBB1263DE3AE6CEA7D5172A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\license.txt
Size 7KB
SHA256 93077c8083867e85cd6806fd4fec3a0d4903df421d06b7abe8e28b8e7e56fc33
MD5 9c94b65c1cc1c8bddd1fc889be9393e6
SHA1 8b5833f64765c9dca50769ecae4d3bae64879f36
SHA512 92194c1eb9737a294459af63f15912672a4c2bd29e63bd89dd845e157f59cfa39e88f955a9085c332e7ebf467cb61b121c120bf12df1113a5414e7502d89b98d
SSDEEP 96:jh0Q2b7k1N6abM2GPGdVoegD7XLWi2U/x+L7P55f90BcOmiMVi1u4MzJFMqKKKkJ:un7k907XCi7kLX90ZRszm2DhtjQoy9m
TLSH
T161E1EA6FB216177105910371270AA4D5E30F92FCB2FBA790A578C15D2323D3542FA9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.html

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\readme.html
Size 11KB
SHA256 d1bb10d95ad6694a93a087527d24040df90e444a88a552fd374466100deedce1
MD5 c762f83d907916ddbe38be4f3328d591
SHA1 3c3536fb5fd6d997943e231d2a91196ed10e062e
SHA512 7ba0e0cfcbe65f9a78b51499229d0364d6014a16f4e8d65b52b3b02e06b8d4f34a37a2f53b247f0a5158f1657f574a1c7ae50b0ff5e3e8f7dca92ce56d838d0a
SSDEEP 192:U5YNOUY9y3gqzES0MwfaLaVmqcJgNQ9yG68jl9EFfXkkakT4usK0kumDonNe0WpN:q7EdpkbkyqEFfXkkaAxsKqmDoNQ9rs1i
TLSH
T14032E79FA2117F3F00620F7E7A1D7ACF781A84DB02B5A945BC3F415722A0AAD7336525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DontShowThisAgain_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\DontShowThisAgain_Alpha.gif
Size 1KB
SHA256 017b935b00855e704979899a7e63a73d781c913c758c1fb8b677ad5fcbd764e9
MD5 6c4e0bdb0db5480836dcd1ebbd230131
SHA1 a24575c88e2b8f862229980291a894ceef8a62cf
SHA512 130053895cf0ec287d069dcae3ac7a43ea343630b577398524bc4ddd203c3e7aaf5dfa53037bb239410524849ef97185b248b2bf2dd8756a07f807876e45c48c
TLSH
T1033107C2E35FD27AC10611F5883FED45B23D7F90B8F119E180686A7AB87274A34013E0
MD5 SHA1 SHA512 TLSH

Submit Download

GM_Options_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\GM_Options_Alpha.gif
Size 1KB
SHA256 1b78f11ff6c31880c68b47a9e0b822e7e62bbfcb570a297fedc1de6411d84bc5
MD5 63ed060da580ad2e57668340d99172e5
SHA1 6f602c2c18b89fd2de703ede31cd0b91850a319b
SHA512 d9bbba61c21cb0c2239bca3b58e518394d5623417f5f885c30935f4d7943ec20ba4ce9f6c170ef53946dced0320d94df4b4f413782d5e8d7c5a5a66c073dc729
TLSH
T1A411DC76F35ED414E5D472F95117D2E6939F4B274F3805BFD130221DC49C5480325455
MD5 SHA1 SHA512 TLSH

Submit Download

Options_Credits_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Options_Credits_Alpha.gif
Size 594B
SHA256 c830287bdc03ad8dd498cc03183fe5978e537589ac049f226d918a1345b058a8
MD5 8215b73ee6f4a4dda9a22bd814f53dff
SHA1 9592b67248173913deae1c27a00abdd5b325d61f
SHA512 c1f02fc4771be4566ab017409c2b689f13ec13de05c7e944cd28f58e00f9376fb9596df003225f6b888d5b79cb78934eb8c66c14543f8f604eca300e4aef9c2b
TLSH
T18FF00CD87A21E113EA4348FAA2C6FCE3036989503200E65E528EF7E48686558C830EE0
MD5 SHA1 SHA512 TLSH

Submit Download

Profiles_Cancel_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Profiles_Cancel_Alpha.gif
Size 485B
SHA256 b3a9e6c2ed35bfa58cfee4d4edb404c8bbe502cbabca4cd442133e16b49cce59
MD5 8d98378fec2e2cf47f59afd5a7a2fc17
SHA1 a452936980c42ddd4924321e4c287b6ad81f07e2
SHA512 35f20e2fbbfa833a804c1b0f63080194010f74212a65e14d4e6ee13ae79c986991eebb370af410bb1b307650cae1c58f2243f100808a31d37e900c58c2c19ee5
TLSH
T1A4F054119861A037902B31A85F6407D748C00A6639A8721614B95C0B7393162B51375D
MD5 SHA1 SHA512 TLSH

Submit Download

QuitButton_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\QuitButton_Alpha.gif
Size 2KB
SHA256 5d84682ca1ea2d79be7b62cefec976b0249c971191b72651e53eec62ffb5c68f
MD5 013d3fc4a15896514b5db79b196274ad
SHA1 979ac361d4aeea6ce121de368a711521d32e53e2
SHA512 26cd9b3057787a50dc2c2e8e6799966a6f0849c3d1d99655210307c98ece3ecfe026c56c21c4d39cba604564ee774b3d5a545f41807dbc37e36b4c4186eb8298
TLSH
T1E8411B93A961D185966D556209AC06EA3FD4E7E0747CB90229D6EE1C54803FEAE400E9
MD5 SHA1 SHA512 TLSH

Submit Download

TrophyRoomButton_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\TrophyRoomButton_Alpha.gif
Size 1KB
SHA256 4beba7b750ab76a4e4ebd82751e8e85b24c0e04ec1bce7e7d70d8a8711b48ce1
MD5 2f98719a8f1b0989d6404abfe2097bd5
SHA1 2e14b0db08551b8e2fd845ae7f7270989932f491
SHA512 fe1b9f01747a3d7c1922c43ea412467cbaf37e4281bd7a5a93caf8870d3b737b1a1338ec847aca34baddbbb0c8a122bf90e01164dda9c2e1c14e70fb555c2851
TLSH
T1FF415B70FC20E5C3D5CB89AF8DB3B1D66980522B501D2F40F567108BF51C8B3A43E5A9
MD5 SHA1 SHA512 TLSH

Submit Download

Pop-Rainbow_Alpha.gif

Path C:\Program Files (x86)\PopCap Games\Chuzzle Deluxe\textures\Zens\Pop-Rainbow_Alpha.gif
Size 7KB
SHA256 0793baa763bf134c498cf9553819f96e53071f76099d3594c284b520953b38f5
MD5 56af971b93fdfc9f329288493769d053
SHA1 dcf5f5291ed09853e5608625f585f35e5fd3e0ec
SHA512 de4be265091231975546460930a05120d09ecb3714b2578dfb84bfe748a90a938d89a9f18950167a2dd8a93b6ae53964a1c2afac93d0d1622726675fe8adc42d
SSDEEP 192:HpeRkFwZxP/n3/6CA8wPriA/feLJ1VgAzCPUyExxlF:Hpe6aZZ/n3/5A8wPriJLJ1Xe8yEP
TLSH
T1C7F1BF4FDC649D1DC1A59E23E1D04F8EF04CE70A6A86EB7428A7D5AD32A50426B8ED48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 af080610cbdb489bbdc43a575a467a04e4f04e5d89b64f3ca5b685ccdef1002f
MD5 a03f154dc4966741bf9970a70443f3ce
SHA1 18ba5f846936112373d392bbaef4c30598a49dda
SHA512 008fccd651d431b6618773e859bd9eb5f9b92ac894d8146b7cffea97a57d5e18fc207b099f61f896593f27538d4d49f131bd3d6da47458eaa7b3cda76218a1ae
TLSH
T1AE41C6B44F72B9EFFB2899F665C6675772F4BEB502CB6E2181902E308E5332570210B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 672c0a1d0eebb3a4ee5d4128bdc1f46e870d13209a443a5e32fa43f62afccb17
MD5 13eba8331abe59d1b8d494e3146f3e29
SHA1 3302ae5fb90285275b682c867c14ed477c2c700d
SHA512 c4cf9bc6ef501b1cbf2bb60621c0698fad5b154780bc3b9402efb73b43f6073bc595aee5716f02830aead68d150cee25fde4d16e7e4df9adc99ad96f71bbe1c7
TLSH
T1B951BDF7C2E8862E890256F0AB14BE2BCE2D0954832C7D5AC9E4AF5B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4c7b0e68245df43ab3bf5da2daf9d132eb01ef095e032751a2f391dc0f07ab23
MD5 93eb9259287432b47689ff9fbe8d90b8
SHA1 20f6a3d452c81019d1b4265b6836d6a263f2f5af
SHA512 f3a2f3b9f0933f2e122c95c33b5e0d5531971058b04a9be0ec3e023dd69b29be08133bd3bb08d56b8b730e5f0f94c8ce57408842dba94d3bff0b92a08e4f184f
SSDEEP 192:sxRtRSCx/f+sBQIcZRVmMzoA8p4D/g6+WNIYZ7PasFGZIgDedJ7J:sxRt7x/f+sBdiRc9O/5Ioys
TLSH
T16842A816AA28993B9CCAE21DFB557F53D2F95022E1D41F48ABFC8B0C04E76CD520751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2665f46977d017e28f853614ea729402c502208001e9e130622759811fb097fd
MD5 0c173f0bcce24c7875a29e5504dc72c9
SHA1 f1df1ebd249080366678e0c7304cc5cfe610219d
SHA512 76708c057045a103ded0a46476d21179eb4ddad4d29defce3c458ae39ed8c182d4b3febbe95585f5ae1ad49cbecf652875e3a6eabaa1ca0f075c281c0198e439
SSDEEP 192:sxRORSCx/f+sdQacZRVqMzoA8p4x/g6+WNIYZ7PKsFGZIgVdJ7J:sxRO7x/f+sdjiR49c/5I6yT
TLSH
T1E932A7166E28A93B9CCBD21DFB657F53D6F95022E1D41E48EAFC8A0C04E76CD520741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e90a0fa82dd1d780123cc8d09cf7580c472d5b2d2c35ec47a7db8cf3699ed76b
MD5 41b3ddcbe16582c9564e96e10969138a
SHA1 65a7858d869a540bf1eb3d3f8ad79e5c40adbf5d
SHA512 77f6d61ce045cc3707caa279516229a82d8af33f2e668e35bfd7efbf2191b191cf217c68ac89890902f667d2ddb1c2647345459218af19c899d853debcde81f2
SSDEEP 192:sxRtRSCx/f+sBQacZRVAMzoA8p4q/g6+WNIYZ7PKsFGZIgDsdJ7J:sxRt7x/f+sBjiRi9T/5I6ye
TLSH
T11142B816AE28993B9CCBD20DFB557F53D6F95022E1D41F48AAFC8A0C04E76CD520741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3cec022de08aad3e9c0533d69c39d103312b69abfb1a6b32b7c510cafa61f3fa
MD5 8607a558396911fe8cc0308834bf7575
SHA1 1546a4ceffc1ab2cbd321f651bdb46d40917e66d
SHA512 cda2b3c5b0fa3a097b67fe1813a36b73dc83d37c54941611350ad553c67aeb9b778e9262682e6fa1a1eb2aaed7c14a40be453aa0dbf9ea5d3f936290e82c1553
SSDEEP 768:ky2SrT7pLuLfsvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSKdSV4Broj+j:ky2SrFEfsvWgd5f/bu1jatKdU46Sj
TLSH
T139D2DA3B640DCB7F4F804ADDAC197E9E6DA802CB9698C98047FE951C03C6BEB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 020109f66b8d18143374f3994e19f0d61025a8b0322c38b9976635eae3be4ab8
MD5 aa85f76755326379e5042fd7565d2778
SHA1 2dadbf23ced0ce25f147b1a7f10a6dc9b75670b9
SHA512 e219bd108adb6f58b48dd9285223d004cab5b83677b6d148897fb998259915648fde5d868ddc3ecac7e340bd7b4d168249e56a5f1cc3b207670cb38b7b7f47f1
SSDEEP 24:KSioyEioKiojioPPioESioVioxiog1ioNio8DiozI4ioPiogKXioThPioJiog1R0:KE+I/K/asjydXI9KA04gZIRKys0ryS
TLSH
T1E3915D65B57B5211287D2A5892B1D56BC6C7B0733008A93B7FE820A12F26F460DFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7f63.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 0d6d12c20b53cc2c6cc4db9c1b126d8da00e96822c1acb72beef0f69b99bdd18
MD5 facc0ac56064a544b0e5f6cc91f29e8f
SHA1 d67de40a71bce8212e2e1aa92dbca69975515896
SHA512 4e9b61bc888d4a9e03134226df5323886f331d571a4ee1559d236f95ea5c13efbd7c068c4a5ac375bf06e8eb516b20ebb8cb244f7fb8a057cdcccd1ee773c2f7
SSDEEP 768:Pw3LzT9UqUL7LpKAam6aQMGdjWca4Ghf9zSB:Pw3HBKkmaME6pzi
TLSH
T1CBE29E71586998739CE7E295B71B3683AEF01173C8D84E84D9E99B0D029358E270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8fc66f2f6e84f322b9d1321e8b3e9ab3ebbdd3473b7eec8ae317c9cb8a4f9c19
MD5 53395cc150d5b5df6c2aaf10665fa584
SHA1 eb580f44769fb0c1338bb1d2c6a1993de2e5b818
SHA512 d40027fe2a2f794a34053158558fc29b9c771ca46fe0902ce635aff18474598524744f6c8b16bd778fccea1bac61f9945b3667e95fae516d6b184179c052fae9
SSDEEP 768:3FQd3ywgUzHBYuL7LnAam6aQMGdjWca4Ghf9zSB:Kd3ZhtmaME6pzi
TLSH
T120F27C729CA8C93BACE79785B71A7687EEF011A3C9DC8DC4D9D85E0D019318E170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5812cf5b85d92f2a610e94df1966804ea3ab4d62e47c1ee33c1351c6d2cae80f
MD5 1afefc33f7aa93db05231ba1f7738bb6
SHA1 8769684b37e54b0dc205630e9754c29230de167d
SHA512 d3299134ee54b64942fba5b483718ff5e023961c301203313de691ae31e93e532595a045129e4338843ad89dff374149ca84103b8bde96ffbbab939412bfac5c
SSDEEP 768:crv+4UNbdi3OzlFUqUL7LpKAam6aQMGdjWca4Ghf9z4x:cbsbo3CrKkmaME6pzA
TLSH
T170F2AF32A86CD8739DF7A695F31B3683BEB421A388C40E84D9D95B0D429758E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 af572527f778742c725b923bb0fd5d058f2920458df8bcdb12791443f069cb24
MD5 2221bf75a0c2fffa06cadea9b5ea2f4b
SHA1 edfc62ae5b685f05767e3186f5828d050873f90c
SHA512 52df1d0688c911cd5cc0059d58b82f032e194d63a178a5becc18c7653e8cf7f7e8390eda1c20d56bd9a218deceb164d2d5a44b77f4c7da2269d5fb1749d8806b
SSDEEP 768:/rv+4UNbdq3y/+qULcAAam6aQMGdjWca4GhfB4PeU/:/bsbc34ZKmaME6pgH
TLSH
T1C1F2AE31A86C9973DDB79A99F21B6787BEF021A384D40E84C9D86B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 205619add5f96b53cd1cc925f7960bc60cd9e8cce46c7f60f8d26c3829e82871
MD5 2787555adaf45781c98d2e6fc5fad804
SHA1 26ff9200d2c1494bf27df464b72fa3835778a78b
SHA512 3381c38d11f0c01ee4d7a2d426038a3f54e035940bf1c0e0c5a001fd23302852d285c78a0824d63fc6d5b2b904fce5ffc09c6b76dbb3c54a6442023acb33e2a7
SSDEEP 768:4w3szZFUqUL7LpKAam6aQMGdjWca4Ghf9zSB:4w38HKkmaME6pzi
TLSH
T1E7E29E715C699C739CE7A295B71B3683AEF01173C8D84E84D9E99B0D029358E270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

9fdadf5b-ab5a-4516-9a1d-a79299d25982.tmp

Path C:\Users\Admin\AppData\Local\Temp\9fdadf5b-ab5a-4516-9a1d-a79299d25982.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\popcfg2\files.cab
Size 7.5MB
SHA256 64a783cb987f180b1840f203a4b8af317897fe6c25e1d00cea6861f42fe49fd7
MD5 62f65a1712de32dde73af1c20b3cc860
SHA1 eb5fd7ee3a8b4d555e8155a8aab68c0ea2820925
SHA512 881f281ac7cfa7b318aa837ea05054937a223818f21984f44da3c96ad39e35d503fa52643605b660593e1d075b8b06eb52d6ee5b1e313269dee39b6f228e88ac
SSDEEP 196608:y9qHpuez/W2nOgBdOWeAKaoHiIu0MGKt4:yQDz++BNWJu1Gy4
TLSH
T1E4863316B25B8DF64E007289CEC67F5B9838E0896AD492DEF90971D174A0CEF85DF0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

props.xml

Path C:\Users\Admin\AppData\Local\Temp\popcfg2\props.xml
Size 3KB
SHA256 5152c2227647262fed9c9e4285aa88438a5bae6c023128fc5ac488268280b0af
MD5 249f77d87e26d9a7c28cbdbc66f431d6
SHA1 21e1a3e5237cdd5b6da46187b87df4ca6299f24a
SHA512 96aad0ef52465222c470dabdfc4be0d580d16fbb6b6af1fc4ec1943a5767e4ffb0a8c00fe4a355433f0731853a3a3fa891156a61f2c617803980a82bfe700903
TLSH
T1BD815895763A69A0F9410265EABF1A7E211580CD933831F5EDEF222B014D473B3B6B87
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8688_1225542917\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chuzzle Deluxe.lnk

Path C:\Users\Public\Desktop\Chuzzle Deluxe.lnk
Size 1KB
SHA256 68356ce9562d522deb61ea1d11d82ba2094f5c56575cec9317957958f85918cc
MD5 4fa8873c8469e45ba1ea1e1f6461af95
SHA1 cb0ba79fb9f3d4827f0e508c4affbd87fe8caaf0
SHA512 29f7a432b496fb2ebe17f5e0b824b2aa9672e9f0b160e4a2fcaf9e4668a7cb76fc188a9bfe130c02b81affa29e0f16600d9c5ce85610990211249493589715c4
TLSH
T19321F0251EC5052EE772E5717EB147222733FC03F6694F6E40DB02490842901DCB9F6A
MD5 SHA1 SHA512 TLSH

Submit Download