59a0bd73b5a416de25b2a00c5b23561fbcecb832a4043884da30a4b4682d7a25

Analysis

user interaction
yes
max time kernel
1048s
max time network
1055s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
builder+bin/Builder.exe
Size 920KB
Sample260730-tdy8csvxhx
SHA256 59a0bd73b5a416de25b2a00c5b23561fbcecb832a4043884da30a4b4682d7a25
MD5 395afe91137880f7a2e870f1c7c77349
SHA1 eec76065fc669a14c2d6a6b5e88147b5a1e68103
SHA512 72d1ed249ba704f5cc9e54203eb945ddaa7618a2cf0c11382bd280b60a8b67d9b4933fcfc8f4e1c349b32cbb6b3f45431a7bf173ca913290b17ddb2828adf9b8
SSDEEP 12288:4m/PJXlqGlWebjr0Yl5sDNfztYH6aTyxtjbtUjwXOwNw0toN48kMB0OGA:xBxl/bjr0YlGDNfztYHcHUMwC8dB0O
TLSH
T185155D31F6918437E177397AEC575299587CBB412E24AC0B3AEC2E4CAF797C13C26246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_316203703\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_2017891217\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1086402410\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1423132972\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_177345360\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1236646159\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_418506512\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1042125763\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1435128696\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_177345360\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_67984639\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1042125763\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1151747740\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1759035429\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1151747740\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1435128696\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_177345360\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1541215211\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1042125763\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1423132972\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1031267047\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1640520790\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe
4588	msedge.exe
4712	msedge.exe
2040	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299008350830553"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\1\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 040000000b00000001000000090000000a00000003000000080000000700000006000000050000000200000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\1 = 4a00310000000000fe5c317f100073706d00380009000400efbefe5c317ffe5c677f2e00000081c6010000000b000000000000000000000000000000d8345300730070006d00000012000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\1\1\NodeSlot = "22"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0\1\0\NodeSlot = "23"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\1\1\MRUListEx = ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0\0\NodeSlot = "19"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0 = 4e00310000000000fe5c1c81100054656d7000003a0009000400efbee95c2b72fe5c1c812e000000730000000000020000000000000000000000000000008400de00540065006d007000000014000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202020202020202	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\1\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0b0000000400000001000000090000000a00000003000000080000000700000006000000050000000200000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\0\0\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\11\MRUListEx = 00000000ffffffff	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
4300	msedge.exe
4300	msedge.exe
1352	msedge.exe
1352	msedge.exe
5144	msedge.exe
5144	msedge.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
3956	chrome.exe
3956	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5020	chrome.exe
2080	chrome.exe
6704	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	960	svchost.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe
Token: SeCreatePagefilePrivilege	6268	chrome.exe
Token: SeShutdownPrivilege	6268	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
5720	msedge.exe
5720	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe
6268	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5984	SecHealthUI.exe
5020	chrome.exe
5020	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
6704	chrome.exe
6704	chrome.exe
6704	chrome.exe
6704	chrome.exe
6704	chrome.exe
6704	chrome.exe
4080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 3324	5720	msedge.exe	94
PID 5720 wrote to memory of 2040	5720	msedge.exe	95
PID 5720 wrote to memory of 4204	5720	msedge.exe	97
PID 5720 wrote to memory of 2040	5720	msedge.exe	95
PID 5720 wrote to memory of 2040	5720	msedge.exe	95
PID 5720 wrote to memory of 204	5720	msedge.exe	98
PID 5720 wrote to memory of 204	5720	msedge.exe	98
PID 5720 wrote to memory of 3724	5720	msedge.exe	100
PID 5720 wrote to memory of 3384	5720	msedge.exe	101
PID 5720 wrote to memory of 3724	5720	msedge.exe	100
PID 5720 wrote to memory of 3724	5720	msedge.exe	100
PID 5720 wrote to memory of 3384	5720	msedge.exe	101
PID 5720 wrote to memory of 3384	5720	msedge.exe	101
PID 5720 wrote to memory of 5956	5720	msedge.exe	103
PID 5720 wrote to memory of 2292	5720	msedge.exe	102
PID 5720 wrote to memory of 5956	5720	msedge.exe	103
PID 5720 wrote to memory of 5956	5720	msedge.exe	103
PID 5720 wrote to memory of 2292	5720	msedge.exe	102
PID 5720 wrote to memory of 2292	5720	msedge.exe	102
PID 5720 wrote to memory of 4704	5720	msedge.exe	106
PID 5720 wrote to memory of 4704	5720	msedge.exe	106
PID 5720 wrote to memory of 5988	5720	msedge.exe	108
PID 5988 wrote to memory of 3428	5988	msedge.exe	109
PID 5988 wrote to memory of 4588	5988	msedge.exe	111
PID 5988 wrote to memory of 6100	5988	msedge.exe	112
PID 5988 wrote to memory of 6100	5988	msedge.exe	112
PID 5988 wrote to memory of 6100	5988	msedge.exe	112
PID 5988 wrote to memory of 1744	5988	msedge.exe	113
PID 5988 wrote to memory of 1744	5988	msedge.exe	113
PID 5988 wrote to memory of 5088	5988	msedge.exe	116
PID 5988 wrote to memory of 4380	5988	msedge.exe	117
PID 5988 wrote to memory of 4380	5988	msedge.exe	117
PID 5988 wrote to memory of 6000	5988	msedge.exe	118
PID 5988 wrote to memory of 6000	5988	msedge.exe	118
PID 5988 wrote to memory of 4076	5988	msedge.exe	119
PID 5988 wrote to memory of 4076	5988	msedge.exe	119
PID 5988 wrote to memory of 900	5988	msedge.exe	121
PID 5988 wrote to memory of 900	5988	msedge.exe	121
PID 5988 wrote to memory of 4348	5988	msedge.exe	122
PID 5988 wrote to memory of 4348	5988	msedge.exe	122
PID 5988 wrote to memory of 3472	5988	msedge.exe	123
PID 5988 wrote to memory of 6080	5988	msedge.exe	124
PID 5988 wrote to memory of 2952	5988	msedge.exe	125
PID 5988 wrote to memory of 2332	5988	msedge.exe	128
PID 5988 wrote to memory of 2332	5988	msedge.exe	128
PID 5988 wrote to memory of 4024	5988	msedge.exe	129
PID 5988 wrote to memory of 4024	5988	msedge.exe	129
PID 5988 wrote to memory of 4304	5988	msedge.exe	130
PID 5988 wrote to memory of 4304	5988	msedge.exe	130
PID 5988 wrote to memory of 4300	5988	msedge.exe	131
PID 5988 wrote to memory of 6288	5988	msedge.exe	148
PID 5988 wrote to memory of 6288	5988	msedge.exe	148
PID 5988 wrote to memory of 6544	5988	msedge.exe	149
PID 5988 wrote to memory of 6544	5988	msedge.exe	149
PID 5988 wrote to memory of 6728	5988	msedge.exe	150
PID 5988 wrote to memory of 6728	5988	msedge.exe	150
PID 5988 wrote to memory of 6736	5988	msedge.exe	151
PID 5988 wrote to memory of 6736	5988	msedge.exe	151
PID 5988 wrote to memory of 6804	5988	msedge.exe	152
PID 5988 wrote to memory of 6804	5988	msedge.exe	152
PID 5988 wrote to memory of 7032	5988	msedge.exe	153
PID 5988 wrote to memory of 7032	5988	msedge.exe	153
PID 5988 wrote to memory of 6388	5988	msedge.exe	155
PID 5988 wrote to memory of 6388	5988	msedge.exe	155

C:\Users\Admin\AppData\Local\Temp\builder+bin\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder+bin\Builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dist/
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2f8,0x2f4,0x394,0x7fffc793c188,0x7fffc793c194,0x7fffc793c1a0
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,11617673815112771295,12201255988783556064,262144 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3761470072972217447,11947995429919389734,524288 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,3430136019482642942,13344737821533938451,524288 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,12001602250220971092,11934673182077509686,2097152 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,9502992219872698116,4876319906479978232,2097152 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10955518498512051807,6122435521782809011,2097152 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,14690490923744112744,11194836279479520562,2097152 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,17644718503085264309,15224305543796356516,524288 --field-trial-handle=2392,i,4360114491753434097,6708742502815701131,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x270,0x7fffc793c188,0x7fffc793c194,0x7fffc793c1a0
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,6198150021654371813,10558053038139370892,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,16220181414635652440,10366508548958610453,262144 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,1716404598364162037,3798564883400500926,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,14168879224542899782,17993063009297128777,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,14168879224542899782,17993063009297128777,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,4095258971839406233,17029092061766422254,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,17109881547232468736,2105491265697549238,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,16997916861216475618,6476745617613021818,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,7367836562211700740,16471546236100635886,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,2182565106305883828,1530955638289729996,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15974812843191480819,12854476493533059897,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4176359295457729198,2113225419860393821,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:14
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,6719309997647321244,10166031273608218952,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8332236744004852946,13947949750540441738,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,1429824339854913031,6126082107833174641,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12281058926842074678,10524359217032596793,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5184,i,16848751388247924348,11135303842649532274,262144 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,16224119083415653285,7417518348270792032,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,2498864596846956499,15594985239641441822,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,2356666141720295328,6401712952608320935,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3021649720932160490,12116111910694530851,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,2014754005920346576,7764960384529336148,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7153459900454208964,17934755820732133129,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5508,i,16241678640445049428,12657364359230672184,2097152 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5076,i,11415877094691438481,10436583869504330418,2097152 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,9851957280822662179,8302327764082414305,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11453652765424173221,13580539785839888105,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5980,i,17296807729110648522,2822515993493019399,2097152 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4908,i,8791490919243309596,16428831855829724276,2097152 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,5289388836743665838,15713335049898929575,524288 --field-trial-handle=1784,i,17366911563510207489,12548064548913502686,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x284,0x7fffc793c188,0x7fffc793c194,0x7fffc793c1a0
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,10778598598083109648,10906119179848653545,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
      4⤵
      System Time Discovery
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14068758217495855113,14598790242000134301,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:13
      4⤵
      PID:6540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,14771363878899552517,11503977823421162433,262144 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,6641084253644248797,8374229015955866583,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,6641084253644248797,8374229015955866583,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,15565778033046253430,3678730193451682221,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:14
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,17020567300194197727,7828810810973083266,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,1811259647231959051,13344382627420203463,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,1346668195153641842,17317342642309848265,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9011172708428075606,14609810618458432127,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,11517849137410639327,9147221607586406103,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,16661277498352097235,1414285696886492464,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5096,i,8177691530144916271,17783114050555263424,262144 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10440190478447427920,12568680718427753909,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,7829177495394219909,16514464017095302829,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
      4⤵
      PID:6420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,8342214161226023399,18157989743454800481,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,14053488650682633420,17632892278660237930,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11651418220198944847,15889244640485640884,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7619071258028166450,10444525860789316645,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:6784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,16586524687558258936,17269841857246356349,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7808853745709200239,8322751625170014735,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,362082540856395834,10932951928682133570,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10838154041575175856,11070547972738284334,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,3181818407365325648,16052160338755563341,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,13723731757144420290,4967948499915809222,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,8658234895305589174,7943948988447536075,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4006294467461061328,4664262100317360744,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,2634039152654898793,11777902650904906885,524288 --field-trial-handle=2484,i,12868145850061402715,11713014503719291813,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5032

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4024

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://*exe/
1⤵
PID:6348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

C:\Users\Admin\AppData\Local\Temp\builder+bin\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder+bin\Builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffb683c728,0x7fffb683c734,0x7fffb683c740
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,11021131003732762925,2735601199194435623,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,2897804278856679291,15355827892338613427,262144 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,8240995189825427815,17454065918811640485,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:6904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3400,i,2013213763408419873,3568359254331904246,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:6932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,2657481880164988250,3601238026506289907,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,10217707695445303691,7119440912420356616,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,4558935325140618173,12439614525730671978,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,15445471198754474333,18107943658189438570,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5520,i,1906556305785314392,2402037881963594449,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:6400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,9022605694528755694,5665697924306715860,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5512,i,7496067155165238778,966294397290677836,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5928,i,8099603484080801127,3353684985816912078,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,10820968526703740694,17818668550864748714,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6108,i,8121260483246875505,17103075103682703548,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:6684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5572,i,1608533590994456676,18375736467738027865,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6280,i,10600938854754767689,18257358114307479238,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3260,i,15367014250675128980,8416106935699349777,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6876,i,870032117580694246,14506891600690917860,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,15109968808394565204,9718197284896596864,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,7886102215345915688,10571262469687550661,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3600,i,6425284972101008608,16729182356333488528,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3508,i,13387247301030336638,11694243109891858161,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5456,i,8734108303077058901,17203527147695881004,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3724,i,17170642418041336565,15755604154726906700,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:9
  2⤵
  PID:6676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7048,i,13477127608698560245,14409022653053597713,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6888,i,7344287248962069353,15366799727163765801,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,10508920427724041316,11530623293251126392,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,2289787930867162579,9889346891629716285,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7012,i,12120838916347076053,5426995491570590298,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3632,i,11505050831874440624,4400848634981586470,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5792,i,3162311426132400147,3644722572360631544,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,8381607999590568717,4789527599011991430,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3720,i,10387008867831138885,3976025933103620384,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:12
  2⤵
  PID:6148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6888,i,16362215399407059750,17702833392748211708,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6440,i,5436950273202001920,15938904351537603829,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6716,i,4227603802859089185,12807576600524748122,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5744,i,3278547684960623354,14972255380944828218,2097152 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6288,i,2159970046935306056,3992479779041012389,262144 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6432,i,17298069965412856245,4582905122070863529,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:14
  2⤵
  PID:6944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6488,i,6389776168512212192,14138951643456755113,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,9374635814143852548,10843576871092546279,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,2730822230413523283,11910587288734423655,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,7965381178787113386,3216327884834221740,524288 --field-trial-handle=2108,i,6300220613924599700,12849057799959280990,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5144

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 24KB
SHA256 add8e62fcb0d994834a6dfe1d6ede21392365b9da1633648e5e8ec0e565ab06a
MD5 6c91bb09d3d9e35404ef95b0c4f14a3f
SHA1 54b8216d94af9c17a8dc310d8f64c04b2165d4e0
SHA512 c105128f51e12af87b2654d7c0683fb1045be29f4f7c5b6ae22394b1b0e1e1050b4e8c173ab70138f33fe2e0953fa36f4632db814806457228c5e6cfd616b4e0
SSDEEP 768:N8JJcJnZi6iE2CJSRpvELLgfkySZB2bRgBcQZ:ePcHivEvSDYkffdG2QZ
TLSH
T134B2E1AF9DE8BDD0548C8DEB3874EB08EA1768430873642FD6095F70919E5C61146A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
Size 53KB
SHA256 f0b81264284699a914d6524e00d1eeb0ce5f647656823d4bad6cc0784bb4790a
MD5 8b94954d1f0d04047c06229614a5d1b7
SHA1 2268b3f9619867b403baac6b9a2c9c2076ce2517
SHA512 a9a455a41380c3170dcbf6e2954d06fb4b907c357629242aba88b141fd5760d72d55738b1adda6391b12a4ee9b746d602e4d949fc736f9d1805b16cf97258957
SSDEEP 1536:qqOLRy5/lzVcakMP5lHOTtXc9iB/4QeY6wAvdIXWC:qqOLs5/RVkMP5lHGtXckBD6wScWC
TLSH
T19F43026ABDDEF03E22B36D0150570E39BDBDF41E0CA0467AE80AC5AB243568E4545E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 18KB
SHA256 804f661848b3590509c9bf6b72bd588b0deec00d072912be6c68243d9d7d1a3a
MD5 6db7798f16e65a457b96cba629989f87
SHA1 164d72a2fa47c1594d601234c14e2dde1a1f9c74
SHA512 3777e905a1753a5cd68b4023c6e1d5d9ad31c1cbf42bb90546b743f2f3e5ad1dbd8aabeeea2b61a4454810e7c498b5b857236f69fd4b54c6e394fb1de4e9b91e
SSDEEP 384:RKB6c1tmrg4etTL+8KZgxhsoj/Jsn1OMgopiSQTiQB5VxK9D6:RKsc154etTLQZ+s4/mn1VNgSQTvB5Vxh
TLSH
T14182E12FA4B6101B6B6B3F51AD8AC09D0054CFF4DFC6E6E66F87403AA50B5A65F041F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 ea50bc0a11b2c27b923b95daed57558140cd5efad6c5e91da4b9f4dd0388e6e7
MD5 596dca4ae5327a007701038f49e1a529
SHA1 4d0d4f1121ef3c3bae17cf7353e883961d83792c
SHA512 477100652ec37ce20f526c680ad573eead57950779cf812b7b284771c06ba02a98a25fb6120f3313c4e404b1c032011451b0424a45f0554029d94f8926fe776c
SSDEEP 96:0/KFDAN/uu6+etkMNnyMkUul2Zj6Zc9X2StcIr:0/1lJ6+ukgulBw
TLSH
T1E19181446001BEB8DBA5E5FF58D549A9F4B0A3DB1F1B7ED6B0A41BB0384A3D50DB3428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 e0f5656e7e023db5d8820e269d09e3576a1d801e65b85995fa6d71db4995053c
MD5 bc990641eb42087a25cd37d7027ba369
SHA1 1970f42f1348d1dc62382a8a3a6dc70d3c072c6a
SHA512 377c00fc5eedea842e88d20ff1f82ac2039eb16565e4591d8f8e87be5976c5128ae84e18c68a1a08838543f57e40536666e2ed6532eb53be9afe6d694d279575
SSDEEP 96:j5bGd3UUT8ouPKca6ThyqLjeTz80c/phEhV/6tBEwHBo+gk371bNRgJpzXdHFl4V:j1PRPKD6pXUqRhAVStXiu3RsxlxG
TLSH
T1FE221A047203ECB8D7688DFB98D10EDBF9B4468FBE1B5EC2746416B834863ED48B2501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 79d6b082c9a2548b978ccfc1cf1bce4274e8d4ee2cb52bb0c33ab82c9d05ef6c
MD5 b76bfa9015a1db7c4dd3e96c8e404a0e
SHA1 a7a650669d8e0f4382abf3564247bbb4392a618b
SHA512 178eb8817e277f4570d571eb141b5e307562a8881c00133d2f9dc6594c02b60d6257b62df1a363c234fa71f9f2735d42fde92f65b0c7449d08e0ca2ca58fc978
SSDEEP 96:piGX3UUQ0ouPKca6ThyqLneTz8Ac/phwhVfntBEmXowEkj1PR5JpO/dHFl4IXUl2:pimRPKD6pzU+RhkVvtpeiVRF4lk2
TLSH
T17F120A047203ECB8C7698DFB98D50ADBF9B0568FAE1B5EC6B46407B834877ED48B2511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 c8e82f95184b79ed560d98de2067a1e3ac748f704efe24898d1da4f14f616548
MD5 a809be7552cbb6166ddb83647ddec452
SHA1 7ede685698fec4a3382e3a2b3d5cefb3912cb42a
SHA512 b75e9075318a5df0c417005e500874fcd2cfc4a968e2ebbf272033eaf9beea271f05d7d6969074353a2938ba1ec0f13ebc51cf08cc698998a12551c869da944f
TLSH
T1F901A2052002F57DEFFD00F568649E4ED080FACD1F420AC775500D6661EF3B451B212D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 3767b57c6220e6f3c33660badde7ba4c6e0bd12fa1cf45f6b3fe4c15b5ce9d7e
MD5 005b6393bc1ece60b9199d0c0e54b545
SHA1 53d70e7bfb516c83df92b21a6ca45d06df393290
SHA512 f3a62bcc886ee39a48835dfc2d7a94bf4f43d36e7245f03f1dac83bea8aca1254917be06365aa8f5fb4811f0880197c2d170226dfb21c5f418a6dcc7c5359755
SSDEEP 96:1+Gq3UUQrouPKca6ThyqLneTz8Vc/ph3hV/6tBEUXo+gk371PRgJpz/dHFl4TXUQ:1+IRPKD6pzUfRhxVStvIuVRs5lx+
TLSH
T1C722FA047203ECB4D76889FB98D10EDBF9B0568FAE1B5EC6B46417B834867ED48B2511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 99b0fdcd81998422641ddd0de9ab66e5618e6677a6fd95352fccf5e6f5ee5dc3
MD5 078d162598855e42397a868ff9516986
SHA1 b14fcd58e060210d39f38846db0f8f910926e1d1
SHA512 f6b56cc622ccc1ae95efcce527cd0ad977190f312702a2c25515fc58b339273af013a4adce473e29a4decb38aab10db6757e30026a89da49e7c9f3f77553a0b5
SSDEEP 96:isKFDANxuu6+etkMNnyMfUul2Zj6Zc9X2StcIj:is1TJ6+ukgvlBU
TLSH
T178A191446001BEB8DBA4E5FF68D54999F4B0A3DB0F0B7ED6B0A41BB0384A3D50DB3428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 643c0deac21a3f3360bf6956f755538a9b07fc80f282a7c9c76d6f678d7d7982
MD5 b28252b4e0479b7048453ea5267a9514
SHA1 e9ef60e1f66a8f97ea4aef248265264e34b69d7a
SHA512 0dbc004262c229bd99282607a33f7ff790b209883d0576a123470f1c4760f64739de1f0db13243f53310d3356513db0106863555e0e2c7214701581482bbb779
SSDEEP 192:DzS4rK1jJQHpJqJ4GBkte2Anzm4nXF1Lzs/IHzaPQvgrpfPlZDrO1SwNPbGVEmmj:DzS4rK1jJQHpJqJ4GBkte2Anzm4nXF1X
TLSH
T17032BFF7C3D8D52DC94156F89716AF1FCE2A0A28431D3C26C8D9AE4B93F2831D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 3a6c3d838f8a5077593671d3636ab64bfb7ac04c37065f131fb83d26c7f44a4b
MD5 96de1515aabd2b758cc21c1374e9f6f0
SHA1 3e2e84851ba64f5ef1941e798ae65e1e90c06ad1
SHA512 80f34bf28653348055ec2b1b4399088fb813bd8c60480e0a8c1364c069f45b57fcbcc9ebcf2f76da4daf67101451d04196e378fc43d6cf732d85ac0d5817b7f5
SSDEEP 192:DaO0umlWtHGJJ5JA+kd7exmjEQmNAnaEdnUtHkqZ/I/zaPQvqTmfPlZDrR1SCNPQ:DaO0umlWtHGJJ5JA+kd7exmjEQmNAnad
TLSH
T15F32CBF783E5D62D8A0196F4AB15AF1FCE290624032C3C7689D4BE4AD3F2832E15575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 ef959583f89fa9d1695b52dfb266b870a0e03e551a5a93762774240d60681abd
MD5 e89e733bb5ab813fc493966038f51854
SHA1 6a5661cbe9919712c58429e4e9576e4d18886ff9
SHA512 b7ddb5fb9b5a7f08ec1d7dc316caf962e067b85868d48a0ec957f8bb22cb7b02235a672f80290987a3ab19c887469e3423d17556117aebee59d8d4d5bf68f033
SSDEEP 384:DzS4rK1jJQHpJqJ4GBkteVmCm1KAnzm4nXF1Lzs/IHza4IrpfdZDrO1SwNzUKmyO:rw2zXOZvisjLdXX8S0u
TLSH
T12D42CEF7C3D9D52D890156F4AB15AF1FCE2A0A28432D3C2688D9BE4BD3F2831D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 4c1116c4313eb643dddbf4d67f67222c219f2aad378d3d8a2b2fa67a76f6e457
MD5 a34ba32445c8144c34cbc676f35f1434
SHA1 a471c357198b32104e04adc762e617bd54c41feb
SHA512 2f7bdf83c3f507f1ed2a449dfd538cc0e74c2913e1da86fcdcec8dee76006beb7594b8e9ae0cc44176b252c6d85086628640671b05821f03596eff67ccc566ca
SSDEEP 384:DzS4rK1jJQHpJqJ4GBkteVmCm1ZbAnzm4nXF1Lzs/IHza4IrpfdZDrO1SwNzUKm4:rw2zEOZvisjLdC3zqbiBXH
TLSH
T19462DFF7C3D9D52D890156F4AB15AF1FCE2A0A24432D3C2688D9BE4BD3F2831D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 795daf8d306c22f9b8255d16c9162c45855c099690453cdb2879c478dfb8b708
MD5 c04f97a8c5e5f63ef7eed0df360e602b
SHA1 2d033c9f0cb231395dc49906c6230c3651c84ce7
SHA512 6981e7a8184726a945463d66844f14e75fe2a1ee0398e1a048bf779ecdeabb1389dd6b05cff65956dc04ddebf78a0254acf3903a1a03bb09e8f4442e595e5dd3
SSDEEP 192:gRKAk8YpYv7DAPRp2YRy9rHsb+WNnMtBjk2o82Zz4kwSPVyIsnAUge:gRDk8kESX25w0u292aype
TLSH
T1D242D62EAD21697B5DDBC22AF96577A3D7F6102171D42E84E7FC8A2C10E75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 910941b05543b9cad3da8b1bdb399d6754c88f05577cf728e6c92a5140be1a27
MD5 d52d7775aba484cf1bc53a959f752de0
SHA1 bbeb777e4b35b1f52b8f6438c01d12ce62146c09
SHA512 86410d93cab3e899537a500fff134e6168aa7a2d1ffdc481f697d1c56ac32da9d2cb4b495526c6a3ec4310eb781d24303ba326a9ed37ba4208623dcc26d5bfab
SSDEEP 192:gRKA0cBz8YOpv7tsPRpSA3ScJq9rHsb+WNJMMtB/AsW82Zz4kwNPVyIsnAUgE:gRD0mz8zpcXo5wHus32atpE
TLSH
T11E52B52FA920297B9DEBC22EF9557766D6F5102176D02E84E7FC8E2C14E75CC221B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8110a31dca22eaf547909d6ce2816ce13b8c367fcb5211665885652885b6f0d0
MD5 84c33b2364dcfaf5112ada5064ce5ad6
SHA1 f596c82ca1d2ee53d804167ebdc1d057b577a030
SHA512 0b0db3f3a1e6c2f3f1a780745eeacb571414d819bab2b1942cfe974f4dadf9a1329c054be6462d58e9e3fedd88e604c9a55268312d0838a4602cd79f27361fda
SSDEEP 192:gRKA0cBz8YOYv7tAPRp2Ycuq9rHsb+WNJMMtB/Asv82Zz4kwRPVyIsnAUgE:gRD0mz8zEMXq5wHusU2axpE
TLSH
T17A42B52FA921297B9DDBC22EF9557766E6F5102172D42E84E7FC8E2C10E75CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 912206f29d12836693aa2fc471d8e0f270e702b5ed4fca9e66e26a18025f8a22
MD5 47878dccf0f1c200a63affdbcc2a93ca
SHA1 6448056c890541f14b267a3f8176833b55c807c1
SHA512 346efd0800a4ac45bc8000f198bc417842b8b2eb84d0a55fe755261e151603338f977453a378af0b58a27189a1f4ee26d5ca53d50f0090674b8355a26ac1ea3d
SSDEEP 192:gRKADcBz8YJbv7tsPRpRA3QcRq9rHsb+WNJMMt+SH+/AsT82Zz4kwNPVyIsnAUgE:gRDDmz8UjcXV5wHL3so2atpE
TLSH
T11352B62FA820297B9DEAC22EF9557766D7F5102172D02E84E7FD8E2C14E75CC221B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aac83ec2dc0b3c274b53c5cec186c4cba2ce08abd3360ee84630b4a523ce6a69
MD5 7b0d477e90b7c4fe0aa51a88f2185321
SHA1 2a47a6c9bd9f0c2b4e7c0541954044f1f4bea0fa
SHA512 940b4ff4542c967b2601a026fb64610e91dce56aef48691be0a09943383028c9765579b9d25cb5c1cb7b4e905ceb1e4a7803aa30e788e5dc3f164479b19d8d69
SSDEEP 192:gRKADcBz8oJxv7tsPRpRA3QcPq9rHsb+WNJMMt+NaG/Asc82Zz4kwNP8yIsnAUgY:gRDDmz8EhcXv5wHVPsh2atUY
TLSH
T1B652B51FA820297B9DEAC22EF9517766D6F51021B6D02E84E7FD8E2C10E75CC231B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4ab86f4074e469c1404168474a0bc58b037777ff98af2e8d36342b81557a7423
MD5 73f8b1e0cbdd3f12efd5f527af29792e
SHA1 d02d4458bf8f217d0c0a6426238ba10fd9b1615c
SHA512 5894bfbf919a767df4cd705b4ca4b8043f4c257fc09217a7cdd4f9f126576feebdf8e834544cbf0d28f246b022b492d2b27af18cb43067e223812c031e9bdbb9
SSDEEP 192:gRKA0cBz8YOYv7DAPRp2Y169rHsb+WNnMtBYZWs82Zz4kwSPVyIsnAUge:gRD0mz8zESXq5w0GWx2aype
TLSH
T15542D62EA921297B5DDBC22AF9657763E7F6102171D42E84E7FC8A2C11E75CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 122ca388174b364a3b6096deddfa87ac439adef4e34631229299af222824d246
MD5 5f31821e63c4217bf217d1d7e8ff65ff
SHA1 97168908263bbac4a4bfc678a34128e3de8ae165
SHA512 3c2c6842c012745f0274c63d01c5c3b33fd092205916dde568d27cfda882745f5d442eff34702c4eba4099253865f1c9489c8b4b924406b984b7862087c5e87e
SSDEEP 192:gRKADcBz8oJlv7tsPRpRA3QcOq9rHsb+WNJMMt+yuo/Asr82Zz4kwmP8yIsnAUgY:gRDDmz8EVcX45wHmVsw2aGUY
TLSH
T19462C61FA820297B9DDAC22EF9557766D2F51021B6D02E84E7FD8E2C14E75CC231B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7c7a51d9185cc9bf29d3d6bad1a94567af54fd6168c6f5077071da64f54c5b60
MD5 564b0f4d53c423a1e1e159c089f50b8b
SHA1 eb7c82d00ac94cba36969b9b4e5d2a187f7bf603
SHA512 41bc2f731ea19e7febcde6ff63779fde03105ed0e0bd04a5e68fe7f49e896c62c2de6b42dfad04b6db85377d7afed8d70afe49638cae74caab90f6ad5a8eb1ee
SSDEEP 192:gRKA0cBz8YOSv7tsPRpSA3Sc4q9rHsb+WNJMMtB/AsW82Zz4kwNPVyIsnAUgE:gRD0mz8z+cXv5wHus32atpE
TLSH
T13452C62FA920297B9DEBC22EF9557766D6F5102176D02E84E7FC8A2C14E75CC231B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a2d9bfb6899813d4846d518de5f91981abc3876813d226fef8b07b35595aa74f
MD5 fa66241dcbc06d14a231e5fa7b1ef923
SHA1 ecd66167033694535acbda17f7018e1f7012a403
SHA512 7dce4328ad9b4d108a73b0fd1090fca8634f6cb722c9519ce72624e23a4535b073e24210f29fd1985997e02cfa823fb2278d5ad05ded936b2537f19ef6f5441d
SSDEEP 192:gRKADcBz8oJGv7tsPRpRA3Qc0q9rHsb+WNJMMt+GWe/Asr82Zz4kwNP8yIsnAUgY:gRDDmz8EycXm5wHSXsw2atUY
TLSH
T10952B61FA820297B9DEAC22AF9557766D7F51021B6D02E84E7FC8E2C14E75CC231B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27cacd051523c55f82d41dd6f5ea558fc2f0d65bb351bc0f035d7081f2be8b32
MD5 9fdfe90e9c41aa4f669f52574a6db216
SHA1 a65f30d59b8cc1f119155dff6a31a3010a321ab4
SHA512 9bf2621862046e598e2ca099dbd63bbbfae7c3faa6ad05469cc405f10d1ec2908dd665350356c1cf07fa7407e3e109b3a52d58a58a2fe96d691de5c4e6cc2add
SSDEEP 192:gRKADcBz8oJNv7tsPRpRA3Qc0q9rHsb+WNJMMt++uM/Asj82Zz4kwNP8yIsnAUgE:gRDDmz8EtcXm5wHm5s42atUE
TLSH
T1A952C61FA820297B9DEBC22EF9557766E2F5102176D02E84E7FD8E2C14E75CC221B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d15f5d74a876ed0eda9ab8d805a2a04fc1f819877883abc66bc4c1b587b76e57
MD5 71eea903395ddd7c932c8516e1d43243
SHA1 8ec392c9d7a80b5778cfbb0e5e186f0c7e039533
SHA512 f179de28b10e1f8e921b794d8f5be987fde435dfc95b9c8d75cf0aec5380e903b352cd0e914dbbe69002f44cd725f977035c58fec16f0e9aac22e8ce8f88c0a2
SSDEEP 192:gRKA0cBz8YJSv7tsPRpSA3ScIq9rHsb+WNJMMt+UXYH+/Asq082Zz4kwNPVyIsnv:gRD0mz8U+cXX5wHjoH3sqJ2atpE
TLSH
T1DF52B62FA920297B5DEBC22EF9557766E6F5102176D02E84E7FD8A2C10E75CC231B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 9b4d6507e3e84af7025f481996c12dee8749119c9e2b1c33f374b5086c552670
MD5 1b1b10689fc35da61d45f1cde4a7354e
SHA1 0fa6cde675851ecc8c1bc55f476b47c776f2ba0e
SHA512 6bdb2c7ad915978aca453430df4c072cf16356af8cde228363befe223c9311aa5407f21d58f50884062adf8f6ccb462238de2ceafeb2da4baaa219a615288b2a
SSDEEP 384:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsXODzi+ErU3dHHGm2mTk:vVzm7KxkXqKf/pUZNCgVLH2Hfgsr+OXS
TLSH
T1BF520967644D9A7B0FD8D64CE852BF8FADF5014662A40D2893FB9C0903957CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 20KB
SHA256 a489944fae9470ba75bac53ba6bee38c34006fbdf83db77ac69ab1dabc580a46
MD5 0ec0f1bbf3780e7cf206486fac9d60c7
SHA1 d66ff3f7be70260fdcf82a04cc8ac7756c4dd9ab
SHA512 929f1348aa32d474b2f460cadcad543659b766f5891c97423293a0a29d30b0e76e051a8f98d0c13d06d88abd2f420439bf0b453edcd2dcb26ebc06e48b02eba5
SSDEEP 384:nGm6eNvarCdKbf+27VcskDA3Pw4+W67a0hWZ9AF/Wv0Cyf94gbFTrQ7KwTyhlB:nGPe9arGKbf+2rkDA3Pw4D6O0h+WF/Wm
TLSH
T139923CE53782B43643EE6069A42A0101A33D15D6545F0454F2AEDECF3CA188AE7FBF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 6KB
SHA256 1f8ee7c88b98a863ac0a9c61cd7a30c40e5600d458b16cff29c1d87b1313550d
MD5 348ff00dc8db396bd906486f7bb7c5b8
SHA1 bba42e6ca1b5e03f832185d7df1eabfa567d1e95
SHA512 8032e04ac448228fcbcb166e0cb264c80fa17ce8328c808cf02c7bb5e6197efce13efbc19278357100a6008b2e25b4d89b1aae1bc32a1305b04da1d3b04522c3
SSDEEP 48:RjPs0ZO+5iSAEejt3ZYtc3QGQsZ47iV3EHuBViH0aEG74dXGwTOBepQkTDTGCZ7E:VPsGQj9+W4mmcqx9sP4LS677ceF
TLSH
T12FE184C1A532299C87334D21E5AA73D52E309079D584ECDF8430E9AED9A132733863BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 0b0641c3f7b1d8ee8461bc5086bcc2ce90903bd9e167135464732598c7dba78b
MD5 7a6eea9aa101a415ec83995dc5e7a53c
SHA1 f0407762cd3cd316087d52f3245857ed0d9c801b
SHA512 5715e6254aa5feb73bd67fafce7febe3892a3744c7e45fb1ad17e8e884fd7b3b5c194d539d762dc5edd0d7efa5c42e55ee21dfb7003362335909c4fec0eebae8
TLSH
T13DC01211C05B1943D880C2709445144D35304F358900A906A2F0BFE9E8D70B01236228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e64020c9e61247def952f2316ea8ff15287dea94856e8bf89c9f21fa6b0263a8
MD5 b5d6df39ec61e0f2a4f563f44b251b2f
SHA1 70093953dde9176eaa24afe837c12f24cd6e2183
SHA512 bd96813f84b440d4cacefe28f4703adaa7ef5468068639526c96e04931978fe4e474b794c4dc291e6486e512b12c0ee3ce6a66fde7055438fc64a918971bcee6
TLSH
T1D6A0029103686132E04A077071854150622069224D81068250954CDC8CA06406631E12
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f5a5031ce7ad85a1ae1055d3fd3708219b766c78dd652a9b442cf5e16ca58b56
MD5 b585e95d13092638ab21ba81631c12ef
SHA1 0c435859f3c255b70696975c52c595e46a12d6b8
SHA512 0d5889814450357c59e581e4b2bf715312073627fe4e84014f0d708ee7863802c62da45f45f552cde924690220dea73444fa2d4923cfb4a02725ecba5e9a7894
TLSH
T158B0220832000023C8800B30A3C080E2333F8C3003C3A082A2E202EC8AE23CAB382320
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3b816725916b0e81b43e111928426dd762f4ab0e9b9affb5e2086b25ac8b83ad
MD5 6781946576d804990b731193af11b6b9
SHA1 3d16e288555a5e24c55030e504deb88e88935d1e
SHA512 b6c58f164a8d2bf793904e6be43604245dd2e9f493158b2857ed643daa94c5a69e321561b0049159268fac1caf48c85f912f97d596de5a245300cdb140d33b5d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7da1049466e2279c098d82e647ce359c4d099221b87bbab4ea3c64774164847e
MD5 805c1d316ee06887ba3b6bf4712229db
SHA1 9c982061885440889bc46de9c3562919e059517e
SHA512 4811e1c433fde3a7bf4141d3df878eb19b36f8b97e69f242eeb4151b834f322c7e98815f38a62dbc564655f593c8995a4cfccf2ab95dc3936816c6a43e8089ba
TLSH
T1FAA0025051C10811CE12B2F1A1E509426299882D1E7283037496445EEA7F9D87507601
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 63ea51789a874867a4d6e1811aec9729abc3d8a35ab45ae6ef24966f202ac260
MD5 a4ecb84af94910e86902eca49d97ef05
SHA1 41dc7b64ff60df711ef1a358fd1e145d2b7e1a4e
SHA512 c067e7b3ae98ab93a59871235a68c62d1ab759b171df70dbfaa946359de555f7fadacd7acc3d70e0d047e5aef3d8114a76fb017c28968895aa2777cb973c0b72
TLSH
T1CBC04CE35A508A8B5A70EDDC242C722DD517864C8CD5CDEC984854431078E334402AB9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe62e70f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe62e70f.TMP
Size 157B
SHA256 d7da65630b00abe4dd1af74b6a3d9a834d7e438538af144879d04dac01fb3d6d
MD5 7d2c9d1338080e42e3a8f57ed2d10d65
SHA1 318070ab59de1e7782db5f960f452e03f0189381
SHA512 2cd1a8e3b87a7f6efd080474d965ac155c53632e5b268c2dac6fcc26df99b3a60e115727a9b3bebfd20280e14bb807f3133854a70bc65480b23984909a252770
TLSH
T1FEC04CF31A504B8B4B71E9D9242C761DD5178D488CC5CDEC944974832078E334506AB9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9f2298b75a0647b3ebcec2a29f786c557212c93b9a68a31c8758b249956287be
MD5 977624808ef104e820f6da2b62b13864
SHA1 32288e3ff895c4af01922e409d18f450d5692eb9
SHA512 f8ec999632d7a43adaca22566fec1defccb9c21bf95421ba7cd57875ffe94eb59301a06e522df1f199fa84dcf1753da9445549d4748b8c7914fae14bfa172cfe
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5dFADiB6xGyv4YR5gRObETev4a:TC0cTkJaRZi/CF2lIDUDf2iZIR5gRObV
TLSH
T101A13B3264658DB76976D98AB4423A43CFB9722BB950BF84E9DE0F0C15FB0EC1342423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 01c82aed46e784dc4a79b7c0327231fff3d0a498f85ffe3d7a485760926f77b2
MD5 6e8b9abfd16bba67553ef8c31fbc8858
SHA1 7e7acfd0de9887fcdbbde892212d9e8e61bb01ff
SHA512 85bf8b39c8abcb5a16cc025e0ff845e329f8a14bcae7bbce4ce4d0ea7d7e6dd74a9e7b40ded2819f675637cd6e07c8d7fe8260af5a0b61d81033eabb061df06b
SSDEEP 3072:p8SXbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pO:p8ybhck6sr0vF191xGSD/itJVXYD5U18
TLSH
T164D312657C201D565AB101883143344ABEF0DA37EBC964E9B1DE7F4E18AF16C8E0B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 e6eca9c1035726ac9c3c40a134679a067296bc66bd6e8ea126612d11fd556412
MD5 540ca45cea495a525b1b25b81098bc62
SHA1 9844ef9e1468bec37870e766d0f6aa2d740e2423
SHA512 3a2b8488d7461a355e812e0bc01108b10808ec5ff5705f08903337f112d8211c3bfd3d8dcaf6c1de462ec51e93fb336102ceeb76da43abd455837e3852396226
SSDEEP 3072:g6XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pO:gqbhck6sr0vF191xGSD/itJVXYD5U18
TLSH
T176C312117D346D6666B402843187354ABBB08937EBC524E5B2EBAF4E1CAF15C4F0EA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 244KB
SHA256 700d3664ca85e13b9e5ddc584cf2d3f21c067a922876b9a45bc245383441980c
MD5 855ea40f84a663eb8ff37c8b8eb9e76b
SHA1 dd82209acf9f3ef1fb6d7fee217a67dcb79a2ac7
SHA512 3a2035cb2b734294241033915cfbd09890a92ec5753f72fdeb945c8e4c4c4690be837f96b80282c2047ee06a39ea0c9b42eaab4dfcf1abd4fbc8c85c649dbaed
SSDEEP 6144:dcEUCbUErMOH0CK/zWn1+CuslObhck6sr0vF191xGSD/itJVXYD5U18:35Ag0u1VcmtF19rrD/KJNY618
TLSH
T1853423651E34AC659A79865430F339293FA0CDB3DBC5989770EEAECE106F2244B0F535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 7123c4c342aef3490e7c5466432e335f761db936feb3f627d0df36e3537b8eaf
MD5 27b62eb61c16a13f1892dba3d09e78a1
SHA1 a5570819930caeb0821a1214db35fd747c03efcf
SHA512 76f94337f28c7871b2ab8a32bea7cf7d412e7243e52b5a51a01637c2577dd542670e889c6ef0c987149d1442e9d5dd20bc1e84726199765574ed65a43a60e181
SSDEEP 3072:d6XbqhY98Tkalsr0vFiS91xILSacIQitL9vdrjYai5bQ1pO:dqbhck6sr0vF191xGSD/itJVXYD5U18
TLSH
T187C312117D346D6666B402843187354AFBB08937EBC524E5B2EBAF4E1CAF15C4F0EA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 153f42cf16282cfc6643904183968d7734d8b4bf9b3c750e218604963a024c83
MD5 1c63f111a2709fc5b01440763085c73b
SHA1 50f54fa4095af611ebc37313a306dd58e4338f55
SHA512 e40326dd938f082b91fc4bb04b878536abcb015ed0a55db92657fd12b90afbece44996046dc19794a8a93c805835bc91c921c14028828a7608752afbf760e198
TLSH
T1DED023307E5CFAD9DA5471359550DB15F2250677795253899100E41ECC740C31BD7CDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61962bb0c4fc46a9cda32f814880539db385180b1fd9695fe56b97e16f1d845
MD5 d8bd6b588c29cd8ae6bacf461237a6d6
SHA1 ae666162790fdd30e7f881bcf8373bdd7a03542c
SHA512 f8c11935775435213a01aaafa926cb64d1fcc6a00c0760369e95831e57f4ed00e744701f07b0c5b8b67b1075180f62b28c93c27bea69fd8c3b766078176cb8e9
TLSH
T1ECD02330BD39A3E0DE2C40388010DE106226037736C323C29041580E89B004057D7CD7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9aa13ceb2f254b99e4e6db829c5a087fdd771b503b5c190dfbe88ef468e958bb
MD5 9352d79fcec2f70da7a27ba5d8c70ae2
SHA1 e23727e0e4f21585e7f65d688c6244d349264b2f
SHA512 bbaeb7e6beb82b7a4a03522f762b6e30921a8af154c3e2e5123946ee3b488de31d2562ce3c61f8f340e5d0669327cad3efd2baec1ac040920e9ba7e332f3ba4f
TLSH
T1DEE020D446C9C35ED20F658F41D8B79C8FB0375B96C86925670085A4700354463B15D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7e94034d9db47472a8e9cc134a2a858755817d67133754875fc5cda9ef085eda
MD5 66a2c1d1946108e7cbec300137efcd94
SHA1 8906aa585afedb53a542cbbba15f12392ffeb929
SHA512 fd500f4647bf4cd2575b5d74cf6900ff8ef7410d1ab99824c63392c62b8c1156cfd8c083c72412d84a96926f4510dd461f57f2d9f04951bd2835d5676054302f
TLSH
T136E026D445C8C3AEE60C649782B8638DD3B1370B96C8AA5A2700868571438C4A782ED2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 52df1fc8589cb6b9818cc659e1b4bb6eb8ef202445711a924a11dcb05119deb0
MD5 c12037da56a914be2d7cac8ac1c7b39e
SHA1 03b678b01a08dab73c5f1ca333cd46a9d0599563
SHA512 8da53ac83ca18421e7c73f2c30a751f68f453f8f8bc8fae5ae796d875cb83e251d24b700a53e0307e4d1a8ca23137f04151bda2d53e0fbaa14e874cae11e64e7
TLSH
T184E0268984C9C32EF21C648B4168678C83E0370B92C87D2A670385847002B80F7927D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0c62b2a9f6386d6cc003850b4425627018ad34916eacf0175658d0d1807af0ce
MD5 823fc8ece4c18a54c61e666d50457010
SHA1 4aa7c8fb3a3f09b764db1cad1d59dcba1d57d6ab
SHA512 2dda721467214155336320dc027dc5c361f70ab380d60173f6aecc02015c54b4917fd407d02ac8ee0f04abce53e0496027b6353a4961a2fc3b220cd9ea57abf5
SSDEEP 384:ZXGqss8AN/T9TkNH9M/01Yl2M7vrBbJd4:vr/T9TkJ9MalM7vr6
TLSH
T11F134CBEFA946D52CAC3503EE2139B369334C818C2DA05137636B154266EF855DCF5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9cda6709324623d68b1911ff360f96dc0946737cda8803255bef92d9cde98868
MD5 f03957d4ec30af0152a5a9b4ccdb9d5a
SHA1 1a1a8c8997e51f510dcaebb27866c75f3543efbc
SHA512 8d69f3f8c8addaa272bff668ef20bcaa3efaa99e68a2ae9b2db50441c38f04a9f503b96209d1ae2725c5d7bdb7039366c754907505ebb63c389eabd93a426c04
SSDEEP 1536:+U6SL/K6L/rs4Wko/VVTyxYXrhxL/4L/zL/:4SL/1L/YJBjbhxL/4L/zL/
TLSH
T169442DFB5951A00BCBA852F5E2033E3EC177450E6CD1E9E9E5784C812829F35B6F8E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 1cba767822ee6fe716d3ce0711b3958560dd8d5a49c2f8b6b089afced2faf27b
MD5 0e8316bbd8e95d431df03cf88315b74f
SHA1 93ac806873801e4daa6088a84f74b74769c88456
SHA512 b994160ba78319e5ebf4705af5b603803824b705d761947d92210423adad695d732d0dce4171d800dfeb1d3cc18959fbc3199c5c966d24fcc7052a3d632774f6
SSDEEP 24576:CHz4ZSg5ofWqUw4BXPBlxZdExiGZUx0iaPg4:CT4koo9UnBXPTdaoBYg
TLSH
T1AC167DEDCA6858C3CD639A30B4F0E9477C7413C3F994C1D6889CC594026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 07d73a1103857b096ec2e5b9907bd61188e3e673050f93b6e1a3014662ed4d81
MD5 37bb5430861d7aad4192cd25d5fa2c43
SHA1 dfbf4ca0e65508654dd142f5dfe37383aad9bcf0
SHA512 641856f72348e25cd45f9c0d34e8d93c04ea8d28f598161e05b7dee90851246d8e0c84562c895d9d84fe48ef0a9ac72a985fe836917d74a6f03d8b489f2a98c7
TLSH
T1E9512C85C3232DE2DB1ACC7AD4F0642932F3948E61031ED2B1985FB4875EF1499D8A5B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c4fae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c4fae.TMP
Size 2KB
SHA256 f9dec398b42020d58c80b8a1af05f33778617634e47a21a1641fd9d7c7b97068
MD5 67c4ec5a8210ec2695013e6e3bc0e50a
SHA1 7b83eb1e6c748b36b0fe4e3a52596df7fb3b2c66
SHA512 da521b2d666af8723e4ced13ca5aa7fb0bf42f4b0ff3e14f4e42bb97eb0a412edea9f9145dac90de2be3df950c2ae0326226b3def82074411ca977e705f1f88e
TLSH
T142512C86C3132DE2DB1BCC7AD4F0652A32F3848E61031ED2B4985FB4875EF1499C8A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c7ed72fb339a1df3812df3e74a583d602366e03bfb1dc3eb8a51ef567d01f929
MD5 13637730ad247326bfaa16f53f85297d
SHA1 ba13fa28da1ec3e4769745ed3ccbcee54c7102c4
SHA512 1a33c31e3005b4174dc7de0108a47517c46fc0d68791f8cd0555223df763e6ccb298dad1b808ea961a438d9f75c80ee0721e16971cb9bceeb39c277246dc7e10
TLSH
T18FE0D8A599D6C31DD51C34875124AB5882DC3683D6D56E031740C8D47A07401F741997
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 395c4f3d8e71f8743fe9e22a0c2f7524193159862deef176036713b1c7d22a70
MD5 4f53d6477af5a23899168f63bb8dfd4f
SHA1 c5e1aee39a4dfd88efc1e5a476e205e116e58b56
SHA512 1c2d308f8c98c063cf53fdfbfbba0030e222af98985473a665b278e3e1a752eef215143c1d4d77adac506cceda9a2c9566b534742f472bb2458e01e9b68977a7
TLSH
T1D4E04F5654EAD22ED01D78A797A4936DC7A2744FABC83D1227098C91B501554B3A62C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 ea6bc513bec7c40f04461609c8331d49fa20c7775c4cd1728c530893475b1ad6
MD5 c3f266c6b58b9200544eb001fa088507
SHA1 9876c20f055f9b4826daa6c6e196e499d9ee8855
SHA512 64adadbc707f550196ee656f89aac37939a020334156562ac7950a1d8b14147909ecdf90b62a4179eb188717aac01e618a3f52974a5b5db0d6bfa6b8b5bab8dd
TLSH
T1FEE0865898EBC23DD02D68B79375A36DC7E2785BA6CC7D521709CD90E101654A3F26C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0e1afb64142b388759c6565aa75fc6f225b4f358ea2a7d0c816308a2fcdd1042
MD5 1148963c9bfdf3b1b74fb7ec3ad65e4a
SHA1 94c822fe2324fb1a39c329a3da5577951f113025
SHA512 886076a805e4090f6a5b105aa02b86c09de384f0072d931bd040f2225a500055761e8b18b55a3524a1327344a40bbf1bfb3a23c850ee0b44b6d1432b20ab81a4
TLSH
T1F9E0865544D9C32AD55C68A782BC635883E17987B6CC7E22170E8C507102A99E3966D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 1b8e69d754f22581aa375d04422fbd51316fb49b5076af6ccc78c63352e849ca
MD5 d3d33c2d449f24d9a935917641458369
SHA1 ae0bd225fbe02a03d1a9d158ead1d0eb8aa27d44
SHA512 9b9e60ae2275b6b289ba6cd12caa750d11f304a06db8b3e8940552b9dfed76a3853e872f4421e4fdf33b59c55dc53d7ec34e620e8239a653eecf9a8e19ae5e43
TLSH
T1ECE026A186EDC36EE20C208B8238776DD3F03A47E6CC3F461B0DAD40B042504A7D22DB
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 eacf9f850d285641aa4d7f2b09e323772606f5b52436327265ee433933ecd99a
MD5 90ca21518053c8983ce1c4230a848d8a
SHA1 6ea7db524a7167c8a716355f97ad5f022b268ea0
SHA512 03504f5c43d483322f9f48150449ae8d52a57a10b43ef29a80ae966d12ec3a73631ffdd61dccc35d93845b3bac286fa6feb24fd6fa9396e52fb96cf669ae6104
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAwn+o2VwzutyhdGsGI3:qDeMatha9RAJ0ugl
TLSH
T134B2004E2F347211C1F05B76EED088622E7C101DC7673A869A1460B3DDA265BF90946A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f2484638391b9807a94eb9aa9ad6ffec3255549e9f4e326d719454ada236eb1
MD5 b125d5a8642aaa0bfc09361377f4640a
SHA1 4e045ae54e4d8b07d7e3ad39dad6cdafeefbc3e3
SHA512 642e24def82e9bcb8871a4b2ba602141d2f86fa80e1d8110d82a376314bbe5b3faa2115d5c4e81f7a19d474b698d677850a97b5fbf1cc1adab40cf19e6513299
TLSH
T14D31C0F7C3F8953D890196F4AB146E1BCE2D0915532C7D5AC8E4AE2B93E3471E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b0edcc1775a4bfd1b88f77bde72464a514b54800fbc12ca8723f569b0f903d4c
MD5 4c5b08a75337f4f8c6f75b21dca60c53
SHA1 f8c517ea0979b1616631ba04e7986ddc21a7b4b2
SHA512 85ecd2be025c8b3e36b017f943312a15ca0eac6a48a9f8f087680b429e061e22f5fb0fd611f786ddd0e19f471f131247b77c7758c746b8a69935372024c8e43b
TLSH
T113519DF7C3E8952D890196F4AA147E1FCE2D0954932C3D5AC8E4AF1BA3E3471E18195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 edb33eb836350f047bd6be77be8ba2be4a906e70cd8ef87baf4ca2fcca790697
MD5 7c214a0effb6f2e82e7129921354ef04
SHA1 158c61ddc92eb126cac7c0e7117773cc7d556c24
SHA512 19536ca4961905912240614dcb999bbb63f406539347d94b81592190ce576f369d162a91d624677861a3d22c7a5500020ac7f70094921a006255e57fd6a3ec57
TLSH
T1E3519DF7C3E8952D890196F4AA147E1FCE2D0954932C3D5AC8E4AF1BA3E3471E18195E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 75ead8518ed8726df8674b81ac885959af78e9eb4bebe9bce0e9848360607552
MD5 15f4db4522271ead842b807657b62098
SHA1 c9e7096281f8e24438cfb09aa38bdd8009ad4ecc
SHA512 304c10877af9b93977220165c9b9c64f5969c5caae0b787f8931799646d017b588b0e1165aa4b0ca6a12c2598493f4d6d174ad8eb54f6489030fe9e92506969b
SSDEEP 96:eIEumQv8m1ccnvS6vHVyywWVJif5nFXKAHq4g:eIEumQv8m1ccnvS6vHfMKP
TLSH
T12DF2EEFA07276205D99484B0E4009FCEAF16004B47B6B7EC76D447E3F7A20E2B5B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 01afa4f6fcd55f8c0abee8fe8618e663ca285ec560688b088ebce4908271c599
MD5 2eaac8c27b813d1ebc2cbc3fe9797048
SHA1 47c452711cf6446e2f99e84b048a806891221cd0
SHA512 1c9511668ee60b7f1a5dfd7a42e11a46da55b2c4c4836d26344dfddfc7a99fc784dd7d1e8123f8dbf1b3e10405dafed252e3d127ba59df4ce3adca58922a0fce
TLSH
T12CC02252C0B9F0B31038053D5E80A880B736DC300042C4E4C898D2FCA0800FB7B1507A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 863629f1f18bbb1be41a2c3910863c182e1c7ad186725abf85a783573069239e
MD5 027596c2f6439b1693e7753ed58ab638
SHA1 1d1a119a408b32ab70b9774a3797c4204f2e4908
SHA512 ce49a18c7f192eb7674a8787d0f71d905ecb333d3f927052f672c51efff88a5f1910b43bfd3f75d97393983ec33df9c627287a60f2e95482127fcb42442220bb
SSDEEP 192:sxRMR1Ct/flscWpVxUsZ/afaOdzoD8pi/g6+WNIY3bzG3Igv+qFHJ:sxRMet/flscWvxUS/aCmi/5I/P
TLSH
T17042B816AA28993B9CC7D21DFA667F53D6F95033A1D51E08A7FC871C01EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eb3a47c63a54b2938a2de982dc2cc0142553cbb67554abf256b5253838f3d304
MD5 328f0652c113b72b212825a65c314d3c
SHA1 58154cce5f4cdb5ea747ebe8a1687e6e780c0c65
SHA512 d139996821248f3c4a08eb9102d837833a362a9ab834acc165fdc7e9b37963988b3a144a52a757165073e6c0a4126be741453e7781fe73f0a6b0a2c229ef8db7
SSDEEP 192:sxRbR1Ct/flsmWpVxZ9Hm2Sm7aSdzoD8pi/g6+WNIY398Eg3IgV7+J:sxRbet/flsmWvxD2ci/5IOuFK
TLSH
T19F42A716AE28993B9CCBD21DFA667F53D6F9103361D16E48A6FC861C00EA6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 844f8678d6affb523150a8b4d175f66cbe5f669094ddc90ff8400c4729fff233
MD5 71828a4719d2352f1f10fbb99626a8fa
SHA1 b22829567a9aa301ba0b5aacb708572d0342dfe8
SHA512 bcaae6a2ff2dfde6de3afb60b99bda8cc75c5e0353477471eaeef77871fd9d000d55a61ddf8056ef7e8da38d66069bf4e81610610956fe7cd220c0a290126f0c
SSDEEP 192:sxRMRVbt/fls4IWpVUYsZ/afaUTSldzoD8pXCa/g6+WNIY389G3Igv+qFHJ:sxRMPt/fls4IWvUYS/aCUW37/5IaP
TLSH
T19452B71AA968993B9CC7D21DFA567F63D7FD1023A1915E08A7FC871C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c5d959f9082b3027e4309aefb8c15229ddedea693dca46a13fabc167aae31ff
MD5 8aad59268117073acab2ec1261386b72
SHA1 d22214c6e10731938a6da0d7d18f8de0e8fe8435
SHA512 963bf4ad23a1fdc2d7f2093504b4ca8ad949dd28c46fd2234f7dc25d7a54ad2535678224f107bfc26245788dbb440b09775c4b8c17d931b52575e231eacf3503
SSDEEP 192:sxRMR1Ct/flscWpVxHsZ/afaOdzoD8pi/g6+WNIY398zG3IgV+qFHJ:sxRMet/flscWvxHS/aCmi/5IOjB
TLSH
T1C142B816AA28993B9CC7D21DFA667F53D6F91023A1D55E08A7FC871C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4e53379e162c0dcc957715fd426c2f9742f86cf18d32bac05e68f10ee77c9b42
MD5 5f563e2d273d866a369ce4435abb09da
SHA1 87e80d7f7b9539796431f44baad08fcccfdb2e9d
SHA512 d9160c2f6524b139d2f9a813b39faba58eb6ce0d4ab3bf1f7f690cdeaa2d3cdbd91ed2357177a33c2a6429a5c1979a0b301e5d8cba5838209394066177b6e268
SSDEEP 192:sxRbR1Ct/flsWWpVxHsZ/afaOdzoD8pi/g6+WNIY398zG3IgV+qFHJ:sxRbet/flsWWvxHS/aCmi/5IOjB
TLSH
T15342B816AA28993B9CC7D21DFA667F53D6F91023A1911E08A7FC861C00EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0088aeaf343c5ca19ee2d154518b9b6fba0a3398b7665fa06a676e6b7d2d098d
MD5 f4f521891f06f77b4c6891fb992a049c
SHA1 e5ec867ee3d2f4cdb15caaa7218adff2ad553c4e
SHA512 a26d5c316eee99db3157fee235569a0bd937b071db5b9a8333689d2262e82f53162ea0fc10506911c70a9007777e330185bd65c969daa36b80924495ad300dca
SSDEEP 192:sxRMRVbt/flscWpVxUsZ/afa2dzoD8pXCa/g6+WNIY38/g3Igv+qFHJ:sxRMPt/flscWvxUS/aCu7/5IqP
TLSH
T1E842B816A928993B9CC7D21DFA667F63D6F95033A1915E08A7FC871C01EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e95e57973c87f3dc4555c777ccc82db9dcb6136bda36a28551a1f6bb65bb41dc
MD5 2d8e55d852d2ce0eb18035212dfba00f
SHA1 e08e8d859b28da193d93d603368bf0213d1f8e36
SHA512 b1ff0f4f8414e28db882fce428dc2796b6efa8f3862fb3667c3e790ae8084737ce4433b0967855e41a552dc01b9c4cdf85c513c3ce6634f64edb440255feefe4
SSDEEP 768:GTEbGo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRMWcjroSAil:GTEbGUE7lkWg0CfKsu1jaiFcQSPl
TLSH
T1EAC2EA7B640DCB7E4F804ADDA819BF9B6D6802CB5A98CD8047FE851C02C6BFE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 dc1d7ff58e329b54cf460af4544929621cccfb7636fed5592b6d64384c6a9238
MD5 7e16c5c3fe82a909dc9b11c8a706ec28
SHA1 ebbc4fe5fa661d1299c529015ae8f92a4d7baab2
SHA512 9892aa339f212451abcef4d96e17a093c5796746e78901522722121a585c2492d6bf0c8d845c2a47d7a3b5c76c4b952ea91a3fefd9a609e654a784c6d13fb3cb
TLSH
T1D3E0201045D6D27DE11E204703689368C3F4B85BD2CC3E123F03E950964694872F31C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 98da0ecc3e778e3b552f9d94a7f9c91e55994dc0672dbc50e106b47fb3282c9b
MD5 23cdf8e8489b130ee1301caba8ec54ff
SHA1 394b1e9b95dac2851185f0b043b95b3c2dbce535
SHA512 11e6dcd4188037f80a9ccbd35fdf42c72219b82d0cfed717bd9c60b9677b0923066b156adb117543154c204980223fbec9de0b9e406075a4a2498505f8fb78fb
TLSH
T18DE0D83055DAC73EE14F308F4315E758C6B2B456D6CC2D212F0AA554A2065407393182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0c5ca458316d5fd08b25584ef15dbcb4f973220f3b7cdc9cff5d59114d81b7b6
MD5 95a7055082b229a0c5deae8ef8f1eb02
SHA1 22b949510a30676cc83958b82438d8c3bcc7c029
SHA512 bc92cd6c53fcb685ac06878481c3c8547a15933ef549e34cb70cb7cce3617397a6c22caa5a2bc9e7c26aeb911a62f46ff0c05cf575bec2e4fea7a3d77db1ac5e
TLSH
T1C5E04FB0C5EAC33DE049A0C74364A76AC3B4B88BD7C87E6657084891A605544B7B65C1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fb7ed37e82696bb1b930e23a102bfe512b60641076cb77478091e931bc2ec82f
MD5 76addc78a233cc95f113ae8df3c430e7
SHA1 5394721d2a9c3bf9fdf3b2f282a8e6185efb05ae
SHA512 bc3beba5bee57bb29b6e55948b1c649026f9f55d6eec9afa3444cea656d17cd8ee1b4aece5ba6bc5dc4f181affe2d95497e715c978e77713fcf2740b53573dfd
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHlyLf1vz3W7gugn3K4Wg53cdF4LDca0wK7:C1i7PF/DWrwfX9mgpct1o7zsHlyLf1vQ
TLSH
T1D2912146713B0380383E695DC5A5D86F86C274A33018B92B3BE805E95F67E474DFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 cc1a50d7292cbd620bd52a630e56e0a123dce882639faa27e15132c14549eff8
MD5 059b92c01c11d96bb48fdf26d7e1ae3c
SHA1 35c7eee2991306a9e46780322c535914b07e6851
SHA512 7f51f3294c8a55d2d5513a8a4b5f70c7bd824e799c9f240b9a175831f1d21a20df6529c97dcab5a632a7102ac0f8e2bbbb1f6eabc6445bdfce3cdf152837f8f4
SSDEEP 384:DNrRZyCSDnxTICnMEhIKyll7svbFKfk7:xFZJSDniFyI1l7svbF9
TLSH
T1A544840A7B747001EDE6D9721CB080771E3C716E8F22A6D16DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad320a7d-9646-4607-a974-d580e8fd317e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad320a7d-9646-4607-a974-d580e8fd317e.tmp
Size 414B
SHA256 b4375d7e877d9fb2d7550d270aef94c5c848a99b1511d98a92d9d19509a6e749
MD5 36f2721c0341022097633ec2824378e2
SHA1 dd584add8dcb6eaf648a4a8d5a5a8721d5dc9e97
SHA512 c61ed580d738a1f0a5a9d69c4e7926f6ff3434e60daeeacc67bbe91bead1fffcf34a6257d645580c3605f66bf7dff303da53c998602fea342d4b98c0ab892a6c
TLSH
T1ABE02BF5C861DC271DFD0F6960650686D74413272780860F3A7DD6088FB0B374596D5C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 466B
SHA256 76539135a44d3f29fb29842e1909ceee8b2c72e51062ff06dffc8e76a1842f8e
MD5 828897a925e9231471e2f8f2556ccb1f
SHA1 08c119f80d32329ae89672e8e97cac6b1f6e75d8
SHA512 ed5ecc5ce8bfbdc2d62bea6ab3e58bf9e06d0b07da18a3a1c2522979566c807947d9c8dedcfe0481202682af5d3a043269646ec1b4a1519c40de60aeb2c485a7
TLSH
T14DF07E55E6E1CF7DC40BB5F58121BB813761B70144245457790524683AFF27FD678C53
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3b9d89be4ac729e871c78f70508a5672ce17476fae1f63742cc53b2d5df7bb95
MD5 4be49d6bafba23ad34e07dca256691cf
SHA1 c4763694e6460d389fae061f2dd5e4a8005ef312
SHA512 313a5ec899e2addfa1687cef7fdb90c848853519d57ec6e329c03f6c08d1bb15c988a9f0f28d6843d8e918a18275f1ccc420dcef876a57c36fb923ef53d3fd69
TLSH
T187E04F51AAEAC3AFE11C7087027853A8D3A17A87FBD83E5A1B098458A102D49B396182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 933c06f57c72b717f280152048dcbfc1078aae8b7ce12cab66b685dd8117cf18
MD5 4b84c578bc35c0bfaa1630b65dfa09da
SHA1 cd1a45cd8c725149cb39073b40d80aaf50ffac73
SHA512 5150b8ecc4fb1abae13331089aaf91fa38be6ee7cc6a62ca5e1808f11a6e21996d221c1d0201c524712acb73f3d303c467d25e1c1dbe72d9888a680b727e2e99
TLSH
T11621B15AF330C008E14A827E647FAB291738D8168FBCED0F54B920656E76B440E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 5057026701b43d7517bf835aef07f7810546cab5b83cd943f47cb249447edd6e
MD5 e37a19194f7f305b56105780a57b1682
SHA1 0580530b01253c6d9787c3f22f31e8cf9beb9712
SHA512 67330cc8351160ee8f3b21d34f5b6a03ae6d197a9d2fc049e4c1621bef457699f9e7f354e06d3ed7b1378ff9386b098da3ca7c772424decd822f86fc2aa1889c
TLSH
T194E0D810A5E4C35FE01C70C301749388C3B63D83FAC47F011F0189495506D457756582
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5d4067.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5d4067.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b9b933dc73ded69fe2e46caf8ec69d1be9c07af508db7d0acc06e8210754d902
MD5 b0a0e77f113fffa94b887a65a817c798
SHA1 2ad3925bc4f78e958f34f492052430114cdca02b
SHA512 9e17cd6f37ade5e9e418eecd2cf2a9f04d877aabeac3ab0680e946321a46fa5170156d7febc37391b44a3bf57bc6411f29a681c1202a339fd5a3a3e6acf5f214
SSDEEP 3:MsEllllkEthXllkl2zEflkH+t:/M/xT02zc
TLSH
T11E4404047FC0040FC500107140F1C3703370D414451157C374D114335CCF5400C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f1b5569a9eb489c1b340f82b455613319242ba667d4fd6667d91229f8ce65dc5
MD5 66ae24ee8f9e68a0bc115af0fa162568
SHA1 c53e0fc65c37a2b41604e572178171a0725df7d6
SHA512 0815d0a6bef3d8332fc0c8a86aac579a0c8ee680a6f1a17d56f8dfd49aceb5dc99afd015aa32bb90e8ffac6a70e7c566864d4e8c4a33ecb534be48064cd3e85b
SSDEEP 384:nOpZcIQ38NzO7iF04UcHGfd+UJfRXOVyS5PfsXhfsX066DOivShCiDBTayppFJl4:oQ3Y5c+wfZO9fkhfk066vvShCQahv
TLSH
T161E2AE71EC74193399F69749B60A7B12BEA56123D5C80A48DDDD9F0C01837AE171BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 54299888eec15e1610b36e2ff0c7b8fa1a8aa67f91086448a9c55eda31972928
MD5 6941f4d43c381f8990a2414a7f53d5a0
SHA1 f7db70b62582443d2537f4ea3633991ecbd9c557
SHA512 50e48179f7c4384e5fff5cf74d618fd5564659ef83e816508747d9eb38672a6ab397a186cae082875c9ac4da0ec2ffa5a9a3293c3f474d89fa55e323bc6b64e1
SSDEEP 768:CFPQ3SwgnhAwvShCQG0MyOUgC47jHZ3yHGuSG55ZVpFDYbVjhu:IQ3AvSJM2uj5KbrZfhiVNu
TLSH
T1AB43BF3AECA4893BADEA7B8677097A06ADE41273C1D859D4EBD94F0C00D36EE1347C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 5df70acea971ce606e4bc44fce62448cde47fb26f4bcb9d636a375e3d6b01d8c
MD5 2ea146a05628a0c7e292d957bf45d1f4
SHA1 1bf3bc77c8d9be290ff6df7f50e146d494b89a15
SHA512 1c6052f8b0899efd150fa23f7570b4ddfdae8496d4ec4c3bde7f51acc21b29dc35ba094ae6232aaf4403c137271d2b1a46ddb0e869fa32e63b1638de61a2b9d9
SSDEEP 384:n2aiF2ZcIq8Nz8TUNTUlIRQ+iFJKUZu3fBLwSGkf7z6kIGHwwA7MSgEN9355KbVV:CFkqywgbh5ck47MSgENrcbVjh7
TLSH
T1EDE2283D9C648A7FA8EEBF85670D7A0A9DE40177C1B84998DBD94F0C80B359DA307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7adc7cca73e3b89f239c0f877d42894ca9fed2b28a9bde16e2397b3e75280b4d
MD5 1dbbd708d3069e30fd78e2ba8ea63ba0
SHA1 a9f19aae6e47a7ed2074dc5d6b990a417798cdbc
SHA512 84fcb20ac672e2a81a89d6fb971f80b144f5df9bf24e7d1ac9199f47dc2a40467cf54863014d9b414ef98de4081310c81382c491b5c136d787f99401186e2505
SSDEEP 384:n2dZcIQ38NzO7iF04UcHGfd+UJfRXOVyS5PfsXM9vShCiDBTayppFJlmqJrYn53e:AQ3Y5c+wfZO9fkWvShCQaDYbVjhL
TLSH
T1A4F2AF39DC751D3B88FEBB49770A6B126DA45137D1D80A58CBDD4F0D40A3AAD630BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 777a5b6a4b46ae9b45721bc97e981442f78cd530bbc09d3e57f8a7fe231e635c
MD5 94ff7b48d2d1f7317f5deeb126a5136c
SHA1 640b6763845449a0f6d194f8c59c4072eb368dde
SHA512 40d714c38e30d6c73f1612d704aae5b4f093073e06302bef7ff4cac056a93a204d95b88a29738e8fa3385146524af2e44b6a7228f3fd8d62199fd52f221ec2d5
SSDEEP 384:nZZcIQ38NzP7iF04UcHGfd+UJfRXOVyS5PfsXhfsX066DOivShCiDBTayppFJlmh:xQ3/5c+wfZO9fkhfk066vvShCQahv
TLSH
T129E2AE71EC7419339DF69B49B60A7B12BEA56233D5C80A48DDDD9F0C01837AE171BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ecc5a18c7dc2b908ffd46f771d0d8ab43fac1ade322184fab57162ca7d03047f
MD5 b4c7b16ae4b4675d8fffddc2329a4ece
SHA1 3ebf2cd9c228493e3b00c0e5ef7ffe8596218932
SHA512 e4684db9cc7ca562ebfbaf71398589669834904b3a0eaa848e1461383fe48e5d8f40483f154e9498413bb170b0c22cd44d2b85b585f1f3f16376784745facedb
SSDEEP 768:Rrv+4UNbd43IQkc+wfZO9fkuvShCQt02bwWV:RbsbO3IFwfWfvvSg0wO
TLSH
T10C03CF36E86899339DE692487646BB637EB96173C8C54B44DACD4F0D028269F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8d9613edbf8ef8626eb5db0fd7c2f9128c1580a7b267d29567426ead9e47bbca
MD5 9f655fc08662297f0da04f4657607ccd
SHA1 998db206c3f1978bbc1434c8593733558cf769ae
SHA512 cd63af715be3c39bc0a28efecb11fa8165c7104dbffa81d377b0aa531a0ef72d0b1113891f39f8ab47a2736be6d508383f398b7d9f7e0163369c9dd08365d9f7
SSDEEP 768:Rrv+4UNbd/3D5c+wfZO9fkhfk066dvShCQRBhMbGtX:Rbsbt33wfWfQfq6dvS1heGtX
TLSH
T10B13AF3DEC24593F89EEB348724E2A237D685177D4A40A98DBC94B0CC1725ADF70BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 6bb912d22fad75c0ede7281e54fce6367053c8595f7156253cbf48ccf24bab13
MD5 83f2dcae0863030a8f34550a772b041b
SHA1 3c86de9d82680bb8a3ba4e3cb7e0a5803f29d391
SHA512 849150d477395258b066ceaea8bad08a4a6af0571c1235cdcbd304e1e60422f5c37b283f994e7a7fa94789634c134733f28aa0c5007d52ced589696effc87022
SSDEEP 384:n2HiF2ZcIq8Nj8TUNTUlIRQ+iFJlUZu3fBLw2Gkf7z6kIGHwwA7MSgE+hzYbVjhA:1FkqqwgMh5gk47MSgE+lYbVjhA
TLSH
T119D24A39DC64CA7BECFAAF8567097A0A9EE40167C1A849D8DBD99F0C00A35ED5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1fdc4bfde70c6f4c2674aa95477b3c9ddf62bb66c828f0071f959d874753d61c
MD5 aa4e5dac4f358d1cf1054fa89320254c
SHA1 ccf08766cf4a7d4f5455941eee8637950e45c6e6
SHA512 d4159921bfd8d7debd2c503504947b66173fc413748dabb0742dac7a588f73d29e080d04ee1b3d6b8933312b32f4efe671293f33f7e5edacd0940d50233dbbcc
SSDEEP 3:MsEllllkEthXllkl2zEflS6/:/M/xT02zz
TLSH
T129440404FFC0050DC53450304471D3D41371D510051157C334D114375CCFDC00C01050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e96abd35191e8495ea46ed70e47028c69ce30960e3f41300ef36241d6a84a227
MD5 fbb8a4dcd6c00b69ded0df6b1ef0a01a
SHA1 37398870db626cb7549dfb07e69403630d50a50a
SHA512 de5dc826787f122b7baaa6ede499f23c6adb7a2b0620e86a5e5520a0a161e8aafb5475bc7bef8802b9fe3ed5994cd0f17968cbeb1dab3f761e9c8c5c5de1b69b
TLSH
T1D33122E0483D0ED1D0BE0DAFB44B29FC80ECD612F49434382898ED98967E51E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5e4d8a2df373bd8e89903f55bf15b1640a7bfd49ac2957e8a321afaffa9d6242
MD5 c77b050f8bb002910371f2bb82e83616
SHA1 88bf8374d00d82cba9d451742ce218210e24865c
SHA512 7efd6c2313e9b811cd9d616667679251b975fdccef946d13def7a90f6300f24006a3cd63f9c655c3a16f9f724d5240f2f16473adc2fd493b8b4fc6f642c645d0
TLSH
T15D21E191593E1AC2D1BE0DAFA44B2AEC90E89611F494343828DCF9A8957E51D255087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4a11be03905d0cdff23283c1367c03e614fe1e6b1bc720adea145520e4b14d07
MD5 e532684cd18db4d77a3faf9a72a612cf
SHA1 871f681a33e88aa1c01b6735884493183490e6b2
SHA512 3a8bd96ec7eca0fdb6e85648ea40647352a9cb7b5ef5cada7400e1a02ac8073c863c1a2ad7b81d7ed9be8fc5127220ee6228380a83f0334b6606e3d56f4b6641
TLSH
T18F21F1A0593E1AC2D1BD0DAFB4472AEC90D89612F4D434382899FD68953E519255087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 877dc259da6146f2261a7922af4371ba6828cb54be541c7b3c467543534e22fe
MD5 96ca52d72d721a37a423e1f8e0a016ad
SHA1 3eb504d2857392e1f582bedb566eacf9f397b648
SHA512 aab8c9a56b023cea5fcba96a9ea843fdec317aedb46540d8f621063cef56e54c93c60afdb3a0302d0e7206665ebf8308a87784880f14fe0de5600761b1921448
TLSH
T11511F0D1193A1AC2D1BE0EAFE4872AED50D89616F4D4343818C8FD68963E41E255187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 51104b16ba74cea75702b12e815697af396261073e95f753bd2f8dd83f248bba
MD5 cf28b45fcd1a5c47a55edc382eadc348
SHA1 e54cbe6574e48ed0589d1665d5e45e7a94b052a1
SHA512 5f781c57b90294701a9defc2e6be09cb92c3f185dd92d2eead2edb2cf82ae2feb14d0d0c5ac84b95deb7286c2220caa7d7016b3aeeb14c2f5359ddcb0b090daf
TLSH
T163310FE04C3D1AD1D4FD0DBFB48B29FC84D8D722F594343868A8E968967E65E254483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3f5022a415e32d4b994aac4128738aefbfbe4d100f9b717ced417c17785252f9
MD5 ad65cdddef08d78e6afe9db6091743b8
SHA1 f8fd80bc496acd94aa96deb713364d249c1ec51f
SHA512 1e43c78a03d21cf14fc738d33e597ac04ebdb0ce2af362fde4c756242b4a563075a094340fdd53028b4ceb273d01881465b80d8713b301c63499587c60115c93
TLSH
T1023120E05C3D1EC2C4BE0DAFB44B2AFC94ECD722F59474386898ED98962E51E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f99a42a7472a5a9304cef21dec777e7557c0c50004e7ef0862e19ff284977736
MD5 12f71432b785e80f0b4d23ad86a5dd3a
SHA1 851aa70f72a9c3cadbe25f48b176b6d7332f48b3
SHA512 a3c8bc8a439b3b1be8be7a89266468bb867ec45b12a3022cace429ac933acf8412f1853d2231a49736638f15e3d3508d2ac76e540a3bea7eb65e100860ea0aad
TLSH
T1F14110E04C3D1AD1D4BD0DAFB49B39FC80E8D726F4A434386899EA98567E65D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7ff31c876184e61d50407f3a566f742daae01d6c4813cd6f8f3fc60e0d8a3732
MD5 c2cdff5efb939de2ae98175a22798c2e
SHA1 430432d31557a15b5e16f32c573323f04df65851
SHA512 5792fd8a55bcac64c6ff67f94553bbb817e150724a796fd416a2ad5af4fb605b405dbef485849423f921b0a712154159da838b9e0e2cb0f64d36258c6feae337
TLSH
T13D4111E04C3D1AD1D5BD0E6FB49B29FC80E8D726F4A4343C6898EA58567D61D354443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 893a31b5b1b67177b2725de2bb2dea0fa695f8da9994f05f6876cad7e01d28e7
MD5 c599ff80f9f9bf6314e8c96dfda7efb7
SHA1 441c23cb3343808418c2615fee973008fafc6551
SHA512 d3c729154119d8b6ca56bee91049a658e9572a839247f3205861748d00c67aae9645e589e7f11a608809c0178b24843ee8369b88ba21ffe4436d7fe4dc9c65a5
TLSH
T16F4131D04C395AD1D0BD0D6FB49B29FC80DCD722F4A4343C68A8EA58567E65D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 704b76484c7ea37469eb54c614061242ae55cb18f843047628b4b12d831d9ead
MD5 0c881dc859ffd4c47607a4dec91fc109
SHA1 ee8ce37cd58a326bc700b087bb1d4dbdfac81e88
SHA512 9b17b29d022b46eed3a5df631cdc0241d7ad2caf8e5e1190312cb36d181b4a1cec85cd51b8fc113ab8a06d997a3312d47b0e9f9e6307f2496131184432abb2e3
TLSH
T1133122E05C3D0AD1D4BD0DAFB48B39FC84D8D722F49434386898E968563E65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b58903f10776ff2191ba3303ddc72d0843a97ea6703b9c68a6944d9c56060b24
MD5 f7fd31273d170df1a4b3aaf63e7adf8d
SHA1 0e6a46e2e889f066f0052fd8397cba18c19bdd3c
SHA512 f29976dec2da0d5c3850dd18bc21b369ec42019c2bdd1bcd18137517fbac20bd122640132029bcc6154b92e6f4fe1e847a2fbf650b74a3ba79f061903b762f21
TLSH
T1974120E04C385AC1D1BD0A7EB48B34ECC1E8D726F49034386898EA58597E61D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae470e5b2dd60f04ad8b450ee7ff58f75f01ad8d8f0a41623c134a1513264e57
MD5 ec76a5ec4cacdce69b2c46e4d4951a68
SHA1 f2abd29e8eda5640a010aa423da0f44adc2788d1
SHA512 a1c54475f251649adc9a68cb00237b8a3ad7f3bd476b03820d0d86f1987dfdbd291bed2ec3ef2b2321d34c522a042353f6fde26fe6a4cc6758ffadad36e76209
TLSH
T1114122E04C3D1AC1D4FD0DAFB48B25FC84D8D722F594343868A8EA58963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a176fb4d798d54acfb611c3cbb7264243739c761d163d5142933b48bc27397e2
MD5 761222fb29f019d13d178485041a8087
SHA1 45f3b4a5b902f9bb3a97fc1262b741bb63da1064
SHA512 33cd9357f1f5b385854380cb62676dfbb7023eabd00c3ae59852b9cb650acd5b37e3d5fc1855279ba25b070ef84e5d20cc4d3cea1d6920e95ac06982cbe073a8
TLSH
T1475130E04C385AD1D1BD097FB48B35ECC0ECC726F490343978A8EA585A7E65D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 dc74eb4ebf05a6f3010c4ceac32fffb15ecd402b168de409bc3dbf2782aec647
MD5 8c8582e583177e158266122c5b9cab7b
SHA1 05b0e95af9750f12e2147298ccfce4ddee878e41
SHA512 74b96fdafc0f12abec3f1e1714badd42e645ad7a749ed9e665ae00ee538ddd0061aac14eb2ddb58a131ada91cb1826df785871adef646e68a4cce3dcfb3b6b64
TLSH
T1BD1110D10D3E1AC2D1BE0E6FE4872AFD40D89612F1E8343818C8E964917951E255186F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4ef51ece-7319-4aa1-8fda-615daf3c151e.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ef51ece-7319-4aa1-8fda-615daf3c151e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8db4198-2f5c-4681-8c87-9d08c745c8e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\e8db4198-2f5c-4681-8c87-9d08c745c8e4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_1354423145\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6268_668383202\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_1427888924\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1352_653353010\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1086402410\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2736-696-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-1182-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-658-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-10-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-657-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-0-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

memory/2736-3-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2736-2-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

memory/2736-1-0x00000000004BA000-0x00000000004BB000-memory.dmp

Download

memory/2928-1269-0x0000000000400000-0x00000000004EC000-memory.dmp

Download