2369b16d3e2c062c646c744eb025eecfb7afb0f59e87ca1368b58be7f968093d

Analysis

user interaction
yes
max time kernel
153s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$RMQGE4W.exe
Size 139.6MB
Sample260728-y1gn2sbf49
SHA256 2369b16d3e2c062c646c744eb025eecfb7afb0f59e87ca1368b58be7f968093d
MD5 54e1cd4a11d388b27b674d6447ad3860
SHA1 1b62dd01aa0645fd9dd44ccc7d8d6a2d22634985
SHA512 c538490d1a3b43ccd2ee497dedb6bff03eb7c3ab2d82277af2f07f37b90f2913aab64a403c0a26807c0705e2a2f4899041ccf4de0cc6e31a70e65a17791f2d68
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV18MNWtzZAgQxdUKitqfce2vuxTM8A:PBdSL5jsZXoQpNWtzZAgMNfcelTM8A
TLSH
T126689D0177F6A563D167917946AFA002BB31B0032734DAC7376C8364AF53EE46EBAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4888_1684915599\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_202202628\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3520	cmd.exe
5628	cmd.exe
1324	cmd.exe
5812	cmd.exe
4604	cmd.exe
5108	cmd.exe
1060	cmd.exe
5520	cmd.exe
1744	cmd.exe
2660	cmd.exe
6076	cmd.exe
2492	cmd.exe
2496	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2924	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
1608	taskkill.exe
1536	taskkill.exe
2788	taskkill.exe
5172	taskkill.exe
2212	taskkill.exe
4468	taskkill.exe
5808	taskkill.exe
240	taskkill.exe
3244	taskkill.exe
4728	taskkill.exe
1840	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297446737639397"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{844FE64F-211C-413A-81FC-12EDF8B1D692}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2796	powershell.exe
2796	powershell.exe
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe
3984	$RMQGE4W.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	4728	taskkill.exe
Token: SeDebugPrivilege	1840	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	5808	taskkill.exe
Token: SeDebugPrivilege	3984	$RMQGE4W.exe
Token: SeDebugPrivilege	3984	$RMQGE4W.exe
Token: SeDebugPrivilege	240	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	3244	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3520	3984	$RMQGE4W.exe	89
PID 3520 wrote to memory of 2796	3520	cmd.exe	90
PID 2796 wrote to memory of 2008	2796	powershell.exe	91
PID 2008 wrote to memory of 4164	2008	csc.exe	92
PID 3984 wrote to memory of 6076	3984	$RMQGE4W.exe	93
PID 6076 wrote to memory of 5852	6076	cmd.exe	94
PID 5852 wrote to memory of 6132	5852	net.exe	95
PID 3984 wrote to memory of 5108	3984	$RMQGE4W.exe	96
PID 3984 wrote to memory of 4604	3984	$RMQGE4W.exe	97
PID 3984 wrote to memory of 5812	3984	$RMQGE4W.exe	98
PID 3984 wrote to memory of 1324	3984	$RMQGE4W.exe	99
PID 3984 wrote to memory of 5628	3984	$RMQGE4W.exe	100
PID 3984 wrote to memory of 2660	3984	$RMQGE4W.exe	101
PID 2660 wrote to memory of 4728	2660	cmd.exe	103
PID 5628 wrote to memory of 1536	5628	cmd.exe	104
PID 1324 wrote to memory of 2212	1324	cmd.exe	105
PID 5108 wrote to memory of 1608	5108	cmd.exe	106
PID 4604 wrote to memory of 4468	4604	cmd.exe	107
PID 5812 wrote to memory of 1840	5812	cmd.exe	108
PID 3984 wrote to memory of 1744	3984	$RMQGE4W.exe	102
PID 1744 wrote to memory of 5808	1744	cmd.exe	110
PID 3984 wrote to memory of 2496	3984	$RMQGE4W.exe	111
PID 3984 wrote to memory of 2492	3984	$RMQGE4W.exe	112
PID 3984 wrote to memory of 5520	3984	$RMQGE4W.exe	113
PID 3984 wrote to memory of 1060	3984	$RMQGE4W.exe	114
PID 2496 wrote to memory of 240	2496	cmd.exe	115
PID 1060 wrote to memory of 2788	1060	cmd.exe	116
PID 2492 wrote to memory of 3244	2492	cmd.exe	117
PID 5520 wrote to memory of 5172	5520	cmd.exe	118
PID 4888 wrote to memory of 5536	4888	msedge.exe	121
PID 4888 wrote to memory of 2924	4888	msedge.exe	122
PID 4888 wrote to memory of 1628	4888	msedge.exe	123
PID 4888 wrote to memory of 1628	4888	msedge.exe	123
PID 4888 wrote to memory of 1628	4888	msedge.exe	123
PID 4888 wrote to memory of 1820	4888	msedge.exe	124
PID 4888 wrote to memory of 1820	4888	msedge.exe	124
PID 4888 wrote to memory of 3116	4888	msedge.exe	126
PID 4888 wrote to memory of 3000	4888	msedge.exe	127
PID 4888 wrote to memory of 3116	4888	msedge.exe	126
PID 4888 wrote to memory of 3116	4888	msedge.exe	126
PID 4888 wrote to memory of 3000	4888	msedge.exe	127
PID 4888 wrote to memory of 3000	4888	msedge.exe	127
PID 4888 wrote to memory of 1016	4888	msedge.exe	128
PID 4888 wrote to memory of 1016	4888	msedge.exe	128
PID 4888 wrote to memory of 1016	4888	msedge.exe	128
PID 4888 wrote to memory of 3576	4888	msedge.exe	129
PID 4888 wrote to memory of 3576	4888	msedge.exe	129
PID 4888 wrote to memory of 3576	4888	msedge.exe	129
PID 4888 wrote to memory of 5300	4888	msedge.exe	130
PID 4888 wrote to memory of 5300	4888	msedge.exe	130
PID 4888 wrote to memory of 4264	4888	msedge.exe	132
PID 4888 wrote to memory of 4264	4888	msedge.exe	132
PID 4888 wrote to memory of 3776	4888	msedge.exe	133
PID 4888 wrote to memory of 3776	4888	msedge.exe	133
PID 4888 wrote to memory of 3872	4888	msedge.exe	135
PID 4888 wrote to memory of 4616	4888	msedge.exe	138
PID 4888 wrote to memory of 4616	4888	msedge.exe	138
PID 4888 wrote to memory of 4836	4888	msedge.exe	139
PID 4888 wrote to memory of 4836	4888	msedge.exe	139
PID 4888 wrote to memory of 4840	4888	msedge.exe	140
PID 4888 wrote to memory of 1560	4888	msedge.exe	141
PID 4888 wrote to memory of 4840	4888	msedge.exe	140
PID 4888 wrote to memory of 1560	4888	msedge.exe	141
PID 4888 wrote to memory of 260	4888	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\$RMQGE4W.exe
"C:\Users\Admin\AppData\Local\Temp\$RMQGE4W.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wblzsd0p\wblzsd0p.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1176.tmp" "c:\Users\Admin\AppData\Local\Temp\wblzsd0p\CSC3AA4D5FE40D649BCAC6E60857376F156.TMP"
        5⤵
        
        PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM zen.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffde3b4c188,0x7ffde3b4c194,0x7ffde3b4c1a0
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,1353943081238922202,17440604758623263366,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,15705388132764654611,8654094844656707699,262144 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,10770054025120493412,18358667411776409764,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,11830528761053406378,13253308270157693291,2097152 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,4625735245761954306,3468606121913549502,2097152 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,3686435037048123058,5004846390371070190,2097152 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,9400448150807561106,12667385513338781431,2097152 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,11603897981924681688,11394957985139635858,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,11465331502387170922,12413273152184916385,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7093113136767767441,14699549809608264976,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,2963322079298265813,4640700551614346274,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,2963322079298265813,4640700551614346274,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,11906928108972871006,16572890014381244700,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,14935920347295817278,12885378454239862603,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,18206145817181525713,4752025214895773484,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14731144156822239999,10230747353739867683,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16456006279274262312,17644628824144077470,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,958430693375809042,7685517047041739292,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,962321695577298245,17858017218468744808,524288 --field-trial-handle=2392,i,6896524034395381883,15133894591351554167,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5c7604ac1eb3f7d6b21a9b8b83f5103d68c57c71982caa95e4ec74e95ebbd1b5
MD5 1d9eb76136f6882cf095937cad3b3fea
SHA1 417bfb5409eb340a9c340c06ea300cb256de1973
SHA512 a93f2e7ec187aafb486e1aa784708df1d1424a752b25ff95c52684cd238810445138d16dabcd4ca885392d45ddf8ba21799bd41d6539515f03a18214be1e5371
TLSH
T1EA61D665ABF33EA0DF506731E4BA4C4921FBA15D950327C3914423FAEE4F1CCA340096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bee83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bee83.TMP
Size 1KB
SHA256 f7d8f3e0e5e21a6d835b81d394cf7cc3f54fa97d3824eb08eca9760efdfd0e91
MD5 58673a88b0006458a0fabfbf654cd71e
SHA1 205a36dd30db2f076f4dcf83fd109f8378e7b3e1
SHA512 6c631b0f3fce262b17686e067a766623d28bfe6f7ed393a2a990e29464c2133c8c31f627090b32d31ec67f8a91bb76ca8a9f88071a24f277ce06fafe82160019
TLSH
T1103144AA13731FF3CBA497B264F75C9A32F7DA9D1A479FCB01C85238CB063246155064
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f009afac79e607f98312cb68334e0a11e1bbd1ee006df508db969c0fcb7ca62
MD5 7487c8568e014068c5e934a8c555cf6a
SHA1 424172022e266a15d2c4e677cb70fbf84cf37a87
SHA512 f3a23d582f2f6ce064498421b760109097c37ab4263342ee868e3326145b89f877b949727b578d82c56fcc4ba0c4953fb5d3f1513a8d9ead55370eb5b106f511
SSDEEP 384:sxRfVnC0jYSNgJ/fHJsxOGtidMlb/5X9G/Sd7nr:sD1C0jYSNgJ/fHWOGtiAb/5X9cSd7r
TLSH
T1F852D5166928593B9CC7E219FA16BF53E7FC5023E5945F48E6FC8A4C04EA6DE130380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 162a12f3b89648c0dc824f8ed2f5b60a043b9a7e2e61bd046c886938ffa89e90
MD5 a7aa2bced2090aa82de20354c0acac6d
SHA1 ab83ead8588a743592728ddb08ea0c7231ffe7bf
SHA512 6073ae9b1edef3b84018958c2b8e6b46be67625b62802da21f9dbccdde6cc1ad449b50ab5ae3d85df7dd471956728a8d35b8d088e8876b3fcdfec018a0758a7d
SSDEEP 384:sxRfOnC0jYSNgJ/fHJsgqaccaFtidMlb/5X9G/Sd8ndp:sDYC0jYSNgJ/fHDqacrFtiAb/5X9cSdQ
TLSH
T1A062D7566928597B9CC7E218FA167F53E7FC5023A5941F48E6FCCA4C04EA6DE231380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9217edd24c1d7fbdf252692fac799bd33f2f4483b2a9066eb0d0017ec7ef01e7
MD5 3fd5fc4cca25d6450636b7ef9bafec50
SHA1 1895569e86596b1543abcbf5238e7de781437e3d
SHA512 9c1afd48c2e472c011050e527daa2d039899de441b395bf1ecf3dfa6d7ec09c0bb26038e473deb419e91dd0b7722d0d755e34387dda18c0e267d116fa2027f44
SSDEEP 384:sxRfOnC0jYSNgJ/fHJsgqOcaFtidMlb/5X9G/Sd7ndH:sDYC0jYSNgJ/fHDqOrFtiAb/5X9cSd75
TLSH
T1F652F7166928597B9CC7E219FA16BF53E7FC5023E5941F48E6FC8A4C04EA6DE131380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 da9f82ebf066919ba49d8be76c1830f2394914d3bd3d7387065d2104b4e772d7
MD5 69b347573613d72c9537adfe92d35c39
SHA1 d6989a27ce23506282206658f837f1961970a23a
SHA512 a942cceacf4c61e6069030fd8535132333b1fac7c6f2145c5d03d60a8e63231f40bf4af544931584d033eae6cdb060e62d2d391ddca2d8d9f041ffe2ea2f9477
SSDEEP 768:K80E+67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNwLWg3roLuhKT:K80E+SE7FwWgNhfVNu1jaagWgkLuhKT
TLSH
T1D9C2D97B740CCB7E4F800ADDAC197E9B6DA802CBA6D8CD9047FE851C02C6BEA51154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7fabbe18-80db-4417-a0d3-f31b3a577a7b\index-dir\the-real-index
Size 72B
SHA256 346b415361689a6447826c9097379301b5efd27253bb521d0c3868db3d3871a9
MD5 3dc5814b2b0c5aa8f0f9c6c874572bab
SHA1 d2cde316bd9c3e8b2e615848323ae753ce6d0450
SHA512 400e4ca8c2dbd38b407b5e874bfaaeafbbb7a01b2fc8445012c51f6d5989830b63feb6880adbb5d628f802b733ab79bd994a8ca8a9e76884f853497e1dab2b31
TLSH
T141A0021A02820409C106A2B075F605452712CF590301630549908098EC685D55D6201C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b341df21-d56c-4f4f-8e0d-5e0ba5e0c7fb\index-dir\the-real-index
Size 2KB
SHA256 235c6c8757b82f917237e65474d6f8f04d28f9e485f11ef0b475bb2de155b9e8
MD5 fd31171c9c5ba00d14188a2b8cae5182
SHA1 5c0aed85062fbee6fd0dcf00848a824215e6f7f5
SHA512 adb46a3bda62fa378c05bc61a047b6d2350420da598e7840c60bf4cf304dcc9b179131ddbc561b0d3b8d31b2b573e6e8a66378a3eddd3b555c96ecb71b3a9ead
TLSH
T18F51B84F4C4B6F66CD7D24F328B659C2373124FE4A888B0B555CA57878C33282D79A19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c0094.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b341df21-d56c-4f4f-8e0d-5e0ba5e0c7fb\index-dir\the-real-index~RFe5c0094.TMP
Size 48B
SHA256 0af41126de013dcf6b5d9f8854c42952563e54e8d1758eef9c676a9472cf41c4
MD5 7213195b6d00d8df66bc6ee3681e004b
SHA1 fed7afae06ee7e6078017d3c55065cff0d245f02
SHA512 abffa66a4def5de57e1e62704542ca7a435eafb3d55b18e12eac27806a0a9e4a836147e05da7a3a9e465587b8153c3f6e7c50d7fe171091c439cabdb13bb5c1f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8ff329876bab4c2dded6633b431a3699591dc08d95d6a1cfd6790a98b759df4b
MD5 723a7347dead67b5f15db19110a7839d
SHA1 9508b0c6540ee593bbb4241a8fe1cb4d1554ec8e
SHA512 e5f06d0cad53100908a78d8b5212aef9faa204c8061e9eb36d73e34a5a9f07fb1a979adae4e5f266e4e627dd035b30eeb4e32aec4a54906326414662632a67c1
TLSH
T1BBE0C0FB3DE7180CB87F83F524B2549541013894C504FC4E102BD6D79C71350308AC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 4fd89b88fcdecd021123267ac6c7c6ebae0b764d1d1a3484b596e21c3c6df711
MD5 f6de197a8e7ba71189f541d89c54108e
SHA1 a531f11dd87a165946840e6f372c634c220674a7
SHA512 25e3cee758ba6feae6dbaf6851822fc3da3ef42aaf1154a9cb23b9350fb5af8e1c0974731144b10033adff001e23c717e53fe1575857ee14a4141916fdf2f396
TLSH
T107E068BB2DE7281CB86B83F624B2049541013C54C504AC8E101BB6D7A871351304AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 86785355c05086407cb31610e124d262f788b1acdfaf78bc0f84581f652fe7e7
MD5 fb1a10a841509c1b5a0b2d6f5b4b7534
SHA1 44a6dd335e3cf4c339a99304d3fad4faa76a9d8d
SHA512 ba2bdaffb15c2a5e57946a7fd440be1aa61b1afb3c041e410eb96d34599cab27fa30778d4b9d4a89591882e997d9d0fef65e513de4491d48da4cdc2870a093ae
TLSH
T149A00271CD4E948DE04002F0617941E82214DFD9A71A271284BF466ACC9054541D9000
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 99ebc69310409bd4e140739a981d009d8c4589f45968644879a038c198a7f13b
MD5 5564762fd1ba3123862c9e3ec09d0944
SHA1 d178f01019940b26b4c5401292b0310f54082853
SHA512 03f570945d46809609d203022d3b980639acdb346aad50dee12864e73b9a8c497ab75355cd429fe2c5681747520f7aafa2471e5fe63df5ef0c994ebd3998b17f
SSDEEP 768:tn8t3zlSCT5fVqXm6tc+LeSFOUubZbgtZFX4fouOToPvB2thtA9VAgGcb9Mp1Oh+:tn8t3zlSCT5fVqXmawlA1snnwthtthcK
TLSH
T19FF2B071A8AD8DB3DCDAD358720A36936FF051739AD41F84AADD970C0547A9E0B0BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3fafc2aace7158335f8c9c3a5844f845da0b45c0f29126a9187e1ce2cb18df3c
MD5 0531f9aaf117c74ade1177e3eb5c3581
SHA1 d9c2ea0d3643d7b80f843397de3cadbbdae33232
SHA512 95ba588017bfda4c537557e51561655e8b1f99bf1cc9f764e79b4c5e338784a37175095805dda48ca1e1003dd606d6b1b44d73818de4a7da9af3a4f116f494e4
SSDEEP 768:W8t3zeSCT5fVqXm6tc+LeSFOUubZbgtZFX4fouOToPvB2thtA9VAgGcb9Mp1Oh+:W8t3zeSCT5fVqXmawlA1snnwthtthcb+
TLSH
T10EF2BF71A8A98DB3DCDAD358720A36936FF051739AD41F84AADD970C0547A9E0B0BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9bf11fcc9b7cbe1ad808c737b84e97a6be3147fde2efe9a71b3f3198fc37546d
MD5 b8ece2fd3fc7ef2a78f436006e51fb85
SHA1 55f36f6e0bb17ccfcf3f1f071eb6f99f2d3094a6
SHA512 7d2d32a6bdad8b804bb2e59615aa6963504858d694ce32505b39092653649fa509c114c774d69c43f3001021cb701e28f1b6ef718c6c317ad2582f2406da095b
SSDEEP 768:grv+4UNbdH3pxXj+LeSFOUubpX4fouOToPvB2thtA9VAwGMeVH1SlX:gbsbh3px31snnwthttxMEH1Y
TLSH
T11A03CF32A8AC8933DDE6D388320B72532FF4915396900FC49ADD2B4D079B9DE570BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 19db4a106cb03f10c2e3ff112b20fe8b5167d460d8b427a7bf44509097f7bd4f
MD5 5f350983be3329c6e40f232aee08b5dc
SHA1 31a50b97c0cb609d2076d7cbbf01934473ca9514
SHA512 71b65e4fc8bc1147f917d0999d8fdb19e74e2cef4e125b3fd00e217a6a3add67e123a2fa19a051a7ad24d393ad7d1130d03685269873de671245f3d5717e9ded
SSDEEP 768:yrv+4UNbdDt3zySCT5fVqXE6tc+LeSFOUubZbgtUX4fouOToPvB2thtA9VAgGc52:ybsb1t3zySCT5fVqXEawlJsnnwthtthR
TLSH
T11D03AE72A4AD9D73DCEAD298710A76933FF4116399C00F84DED9578C068B6DA1B0BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92c2cce8-77cb-4f0f-87c4-b9f59379b9ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\92c2cce8-77cb-4f0f-87c4-b9f59379b9ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

8b2079e3-6059-40ac-8358-cf790e5bd620.tmp

Path C:\Users\Admin\AppData\Local\Temp\8b2079e3-6059-40ac-8358-cf790e5bd620.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RES1176.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1176.tmp
Size 1KB
SHA256 b75b9a82427ace67f59a38d8c6516bfd254ee88d5760a1be1592615513df6fb8
MD5 d9b96a7878b5ce76b3c6745d8365af3b
SHA1 f0b5eeafa6220ff0f4dbc6678e63a92004c294bc
SHA512 7420049db994fb75486532f0b7e7685bff1309e7e2cbaf1b3aece87d3156288e8e89a36cc71ad43f3e0ce2725331dadfb4df316edb58d0938fa36b0fa9b444b6
TLSH
T1B1216A0593E94B0EF073473269FA172FD278FD59EF62935B944542292C01214EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_847539164\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wblzsd0p.dll

Path C:\Users\Admin\AppData\Local\Temp\wblzsd0p\wblzsd0p.dll
Size 3KB
SHA256 925ad99c6c91b22260828293d7200694132f857b9349368c420a978d068d3980
MD5 e05cb88e6fa673c3e4c5f4e6cb978ece
SHA1 6e1152f7a450511691b39c7dfc14aad5d7863113
SHA512 5d1c7dd3dda97634113926e105f47a91b7241b57bf16b1b0fcb523ef07a53e00d7fde1931cca9d13a9adcd19d305909165a55a138f373300d97d6a8ed3b76820
TLSH
T17451DD07A7E8466BE4770B31ADF3471A73BCF8549F73635E58804218AC653645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3AA4D5FE40D649BCAC6E60857376F156.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wblzsd0p\CSC3AA4D5FE40D649BCAC6E60857376F156.TMP
Size 652B
SHA256 4d44ee3855a4e4179d90ba705ac846ef72a8aa410215979eeb67f079fac79958
MD5 4b051a73b7859985013367a81e113d40
SHA1 4b3f48270d0eac3d9f02cdb1b8251cc60823bad1
SHA512 59d3f5f867a4cf5ba419f6f5ec323234691f0c9d4e96d8b4c2155b03a648fa9cbbe9d0d016fafaf28c4af48a6e44d6a9f95812d62ab93618484540a2f2553ecd
TLSH
T15EF0300A63F8020AF0F34B31BDF553A7D16CBC65DE3253ED184003191C645208561F71
MD5 SHA1 SHA512 TLSH

Submit Download

wblzsd0p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wblzsd0p\wblzsd0p.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

wblzsd0p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wblzsd0p\wblzsd0p.cmdline
Size 369B
SHA256 e1e3f537fad3b3f38d184ce04d59e619901cbc9c7d6cf22090f6d90d10ba612b
MD5 da22bc8a7b31b0b1d4b7457c29f6383f
SHA1 5d3c2ece02d7ca1c1ba10fd187cad4201d074b3c
SHA512 2fa48cdacb1de8c4838487166bb5b4ee446d91445cbeb9442eefdcbce8af6d9f20bca1a3d2e1e2ef69b7f3d6a9f2b7380b48f810ce14ccbe6a98d59599942ec5
TLSH
T1CBE0C02B5256C27D01FD1117217FD8ACC672074329403F84588C880DD01701067D17E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2796-788-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-787-0x0000017B24080000-0x0000017B24242000-memory.dmp

Download

memory/2796-805-0x0000017B0B670000-0x0000017B0B678000-memory.dmp

Download

memory/2796-790-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-807-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-789-0x0000017B24780000-0x0000017B24CA8000-memory.dmp

Download

memory/2796-792-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-791-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-786-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-785-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-784-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-783-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-782-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/2796-781-0x0000017B0B6E0000-0x0000017B0B702000-memory.dmp

Download

memory/2796-778-0x00007FFDE2D4F000-0x00007FFDE2D50000-memory.dmp

Download