f5faa40e5206e9eb8f39d3ebbdfe2d9457ff780e4946f9add61356012433082d

Resubmissions

05/08/2026, 12:29

260805-pn13gsssfy3

05/08/2026, 10:02

05/08/2026, 10:02

01/08/2026, 07:31

29/07/2026, 10:25

29/07/2026, 10:23

28/07/2026, 12:06

27/07/2026, 10:07

Analysis

user interaction
yes
max time kernel
899s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample
Size 22B
Sample260801-jcfdrafp4y
SHA256 f5faa40e5206e9eb8f39d3ebbdfe2d9457ff780e4946f9add61356012433082d
MD5 b487ade737155aaf1c3531da4fe0b5d6
SHA1 cda115d8405fa8c10961c0f1f8c2a253725d7f75
SHA512 a0f47e2db2e8729a11523c732cc8bae7fae9bc02398bc00dd3f028c286d4a56644ee4ca41c3ad86a14b104029afe0c9808076f8e1b589888e6c9ad8b1c9eda5a
MD5 SHA1 SHA512

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3480	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_657918727\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_640998303\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_875576658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_413327251\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1494844324\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_3335411\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_35481658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_2042174791\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_271415449\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_271415449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_223509783\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_945600138\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1274330360\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_543224502\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_1634866415\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_945600138\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_313849001\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_945600138\v1FieldTypes.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4824	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	chrome.exe
3812	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300432784690589"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{92B648C5-EE0F-49BB-9D5C-A6AD73D55EBD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
1244	chrome.exe
1244	chrome.exe
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
556	chrome.exe
556	chrome.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1428	556	chrome.exe	94
PID 556 wrote to memory of 5716	556	chrome.exe	95
PID 556 wrote to memory of 2876	556	chrome.exe	96
PID 556 wrote to memory of 5716	556	chrome.exe	95
PID 556 wrote to memory of 5860	556	chrome.exe	98
PID 556 wrote to memory of 5860	556	chrome.exe	98
PID 556 wrote to memory of 2292	556	chrome.exe	99
PID 556 wrote to memory of 2292	556	chrome.exe	99
PID 556 wrote to memory of 2572	556	chrome.exe	100
PID 556 wrote to memory of 2572	556	chrome.exe	100
PID 556 wrote to memory of 4256	556	chrome.exe	101
PID 556 wrote to memory of 4256	556	chrome.exe	101
PID 556 wrote to memory of 1972	556	chrome.exe	102
PID 556 wrote to memory of 3156	556	chrome.exe	103
PID 556 wrote to memory of 3156	556	chrome.exe	103
PID 556 wrote to memory of 5000	556	chrome.exe	104
PID 556 wrote to memory of 5000	556	chrome.exe	104
PID 556 wrote to memory of 5056	556	chrome.exe	105
PID 556 wrote to memory of 5056	556	chrome.exe	105
PID 556 wrote to memory of 3696	556	chrome.exe	109
PID 556 wrote to memory of 3716	556	chrome.exe	110
PID 556 wrote to memory of 3696	556	chrome.exe	109
PID 556 wrote to memory of 3716	556	chrome.exe	110
PID 556 wrote to memory of 4512	556	chrome.exe	111
PID 556 wrote to memory of 4512	556	chrome.exe	111
PID 556 wrote to memory of 1308	556	chrome.exe	112
PID 556 wrote to memory of 1308	556	chrome.exe	112
PID 556 wrote to memory of 5228	556	chrome.exe	113
PID 556 wrote to memory of 5228	556	chrome.exe	113
PID 3480 wrote to memory of 4868	3480	msedge.exe	115
PID 3480 wrote to memory of 3812	3480	msedge.exe	116
PID 3480 wrote to memory of 4724	3480	msedge.exe	117
PID 3480 wrote to memory of 4724	3480	msedge.exe	117
PID 3480 wrote to memory of 4724	3480	msedge.exe	117
PID 3480 wrote to memory of 2172	3480	msedge.exe	118
PID 3480 wrote to memory of 2172	3480	msedge.exe	118
PID 3480 wrote to memory of 5116	3480	msedge.exe	120
PID 3480 wrote to memory of 5116	3480	msedge.exe	120
PID 3480 wrote to memory of 5116	3480	msedge.exe	120
PID 3480 wrote to memory of 1184	3480	msedge.exe	121
PID 3480 wrote to memory of 1184	3480	msedge.exe	121
PID 3480 wrote to memory of 1184	3480	msedge.exe	121
PID 3480 wrote to memory of 416	3480	msedge.exe	122
PID 3480 wrote to memory of 416	3480	msedge.exe	122
PID 3480 wrote to memory of 416	3480	msedge.exe	122
PID 3480 wrote to memory of 468	3480	msedge.exe	123
PID 3480 wrote to memory of 468	3480	msedge.exe	123
PID 3480 wrote to memory of 468	3480	msedge.exe	123
PID 3480 wrote to memory of 4032	3480	msedge.exe	124
PID 3480 wrote to memory of 4032	3480	msedge.exe	124
PID 3480 wrote to memory of 1892	3480	msedge.exe	126
PID 3480 wrote to memory of 1892	3480	msedge.exe	126
PID 3480 wrote to memory of 1892	3480	msedge.exe	126
PID 3480 wrote to memory of 5152	3480	msedge.exe	127
PID 3480 wrote to memory of 1396	3480	msedge.exe	128
PID 3480 wrote to memory of 5152	3480	msedge.exe	127
PID 3480 wrote to memory of 1396	3480	msedge.exe	128
PID 3480 wrote to memory of 2024	3480	msedge.exe	130
PID 556 wrote to memory of 4204	556	chrome.exe	131
PID 556 wrote to memory of 4204	556	chrome.exe	131
PID 3480 wrote to memory of 4940	3480	msedge.exe	132
PID 3480 wrote to memory of 4940	3480	msedge.exe	132
PID 3480 wrote to memory of 252	3480	msedge.exe	133
PID 3480 wrote to memory of 252	3480	msedge.exe	133

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
- Executes a command shell one-liner
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa86abc728,0x7ffa86abc734,0x7ffa86abc740
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,7825677328724843133,18075580215815074745,262144 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,4845453207491402822,14934718527440724331,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,12786251076123402677,10182224333260019892,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,302249635139741683,11029048484410741176,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,204778358717581598,2574727713120761463,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,13590841438832562409,17152530886453602724,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,15757874916883178318,15138755138085684931,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5412,i,1125818018496816047,13660460094444046203,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,16122389227070414497,17784604484969475268,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5724,i,1844600741774248965,13247194663598315347,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5932,i,7362259195438370646,6170078649488458596,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6112,i,6069914303731216734,16497178929684767215,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,5590644762264641152,11811546689035476176,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5592,i,14825201494603658051,14358356609604026246,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5472,i,7510064093422762907,13062902714423129852,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,12594330535137240092,14680754775218652763,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,8467235965137050941,16278527135935514166,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,1327916600194180017,9472144814036691831,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,4385731986273512496,4328467896072410266,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4784,i,9914872363152987512,11296502219076054999,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:9
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5500,i,2979727483116180523,837754087557221184,2097152 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,5348331184081038442,105783527326113495,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,5094420628485338696,2416551391291697973,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:6612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,2193247624764331650,2800124361718343917,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6028,i,17312544147508141865,11701763627825023816,262144 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,17386400532947648986,17900008283041593659,524288 --field-trial-handle=1732,i,14855310712859445968,12510659012402780161,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:6288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=http%3A%2F%2Ffiledm.com%2FjpqCf&timestamp=1785569691709&source=WindowsSearchBox&medium=MSBLink
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa6730c188,0x7ffa6730c194,0x7ffa6730c1a0
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,15830180354955380710,16995974043070127408,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,12900731246359862185,6470386268130362342,262144 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10565126167208305562,5666265544573863794,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12469482897212905299,1312055380684279288,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,16298116501141946647,15450954935945703534,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,7222026509852505004,3627697123211764436,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,10887595073817249655,1235086509245832505,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16759290075298932094,1363765121625161436,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5284,i,12304027222221259169,15721254540743735021,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3291549927223865734,6426657514586237782,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14709998792363613375,6661991605619261783,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2881626253124852204,13341907702516057009,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2881626253124852204,13341907702516057009,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17829066037595807804,17016142332660467454,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2701722534743691037,6641681526393695555,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5529512838667647013,12725702377386080421,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,2101303078663814998,11442197981034964987,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,9164730539811249362,2013475824238958609,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,9164730539811249362,2013475824238958609,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7448442085384730218,3574949411285001941,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4924,i,13637187062533005924,15233205045632731511,2097152 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,6271901921131870445,13941865264230961167,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,4252960612842730433,15326126139456826680,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,906220294261070571,3618118898168029159,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16097675303699865139,2899973914584147124,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,323477773730958113,6510673535208975673,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,2947517742726453408,5921640698077747931,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,13685764128816344793,434337967838320726,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,8260769524915799759,9454027139282771023,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5780,i,7606770295113080827,3854979259173027566,262144 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,15650378528086086546,5205237960477657386,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,9850208008249350215,18362816746578028552,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4315086216950480341,14773137481559559602,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,2989375472481500244,4490427013753194040,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,5185340497796872058,11645336576931178943,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16716385315341873928,4157073822554028020,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,13082169970716778449,12141266908589714267,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=1132 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8698546981247493658,6604648756073816133,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9967392122971769238,9671700612159242295,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,918686982254795794,16956104427353138587,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,3069123493455429811,8313237962156348625,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,12830585077708062484,17321005460536840439,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16101136915709128010,17313596294606173986,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:7164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14060703759766565288,596126694252424044,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,17657061205902730117,11560614269448099287,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4802167275562502321,14257132007575285324,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15172939384720277143,15425444346256870434,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,18289510026444800574,11030383528389828671,524288 --field-trial-handle=2300,i,3870385408465150306,3279904016606458047,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3148

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

65d1f105-f434-4ec0-b953-b6a0600c62c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\65d1f105-f434-4ec0-b953-b6a0600c62c3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f8ccceba0763206125bf8ac3e24c053cad5d6082952f381c0bbd1543f1b05aab
MD5 98d2c2d5526e4e0a83f18d5229217666
SHA1 52e1c2faee6e8859453d8561f09bfd28ff2442cd
SHA512 3dd168f197bb2f3d28f72abfaf0d1b9d995ecb4e43bcf4bfcb4037d700161869f01241d1de9a10d9c27ac8f281c6675eb4bfffd6bc4c2359a1c241368bce4d91
TLSH
T118419CF7C7D4857E891152F4D7256E2BCD2D0A24422C3C62C8D4AE5B67E2872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 709d0db051dae0ab77c92687b8a3244849613b317c4baa01d0c8e06164244fd6
MD5 8ae466fd6a3cd3301748616ba918079b
SHA1 927c60d3ced71ecb00963892568cb95af0764ea8
SHA512 71b0842e17d056b9a38c3a02ea88d248cb94f936a8a5a9934a96442caaa7f33470e720b65402ef6874dc34c111a2a40cc2646706b7cd9cbac3e6d30ae3ebd077
TLSH
T1FC516CF7C7D8867E881156F4DB256E2BCD2E0A18522C3C66C8D4AE5B67E1872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45a10689023c2a319d0734dfba05132fff180b393561b3efed28051d89c582a1
MD5 bd85153acc795c2194b2dd3911525229
SHA1 142058736730df65fc9f005ca49c86430c83eb12
SHA512 2eada5ac7186140acbe58c26e81edbe6b6e1757531a4b16173f7eda749c249cdd1b6fc6627d358ef04de6ab6a0cbe2941616f332825993643f81a1829080a021
TLSH
T102519EF7C7D4857D891156F4E7256E2BCD2D0928432C3C62C8D4AE5F67E1872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f4d4196d38d6ee3f5f3f6429dea1d53e40c2b4edf934f7a3228124fa02e2dbfc
MD5 8879e4f8801fdeb17d3a974b47c2afe1
SHA1 cd637b71858469097b3e9b7cdec224470fd6c1a2
SHA512 c5335dc47b8c558b887298fa44d563a8ff8c0bec3f7fc73cbdc4600e1eff0c58976caf2ea74927efc0952660d7637b72a77d0a4313445d6b4908070d21c5554c
TLSH
T17BF050A7F66F74535079857E9D0AF806FCB2A835018128E4CE6A42BDE0815E71B02443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 850befd05697909350e4576ba20aec24f178df75083cbc54357ac6cb1d0b3d91
MD5 e05625d48be0c97dad882bb5beac69bb
SHA1 fc5b1075edfb3c62315b62dcf650d426bbde8a6f
SHA512 2cdbda3ba9c0a6d79830ec12a76f701e55df41279a4ddf09824ecb86c2af2f8310a61d7ff9729199911ffcc5f38a59caa01692af0f11c83ad4ecda10f61decbd
SSDEEP 192:aRBSfDDv7zAPRp2Q9NLHsb+WNn+N0MeSkwHVyIsnAUge:aRBSb7CXD3wE0wBe
TLSH
T11732C92DBE14783B5ECBD22AF9217B53DBF9102121952E84E6FC992C15D76CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 01ff995b7d5c9f0daa64a3e3915f5ae6fe1d7d05eb310ffd771311ef12d94509
MD5 983789d35b0f8df38076cb40e6c57445
SHA1 f23c481b833407a84cf2fe3d145691ccd1756ab1
SHA512 228749047da522cefd988f33165db7a5efd9b1c98a050a6fc181114dd52fc035723e134083fd3c1fc76b893fe4b47c8c70a2d31a8c992c60e9e271c96fb0ade8
SSDEEP 192:aRBSfDDv7zuPRp0Q9NLHsb+WNn+N00peSkweVyIsnAUgE:aRBSb7QXV3wE0Y2E
TLSH
T1CD42CA2DB914783B6ECAD62AF9217B53DBF5102121A52E84E7FC8A2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 511ea5139438d1398477f8bce07db11398fbdc9498bf827a2f2740194256f876
MD5 fe2c047e570f7ce80609ed097c39ae91
SHA1 ebbaf7243c667986606ac550d211e6081412c01b
SHA512 81f91f81e9a94c3a034df5853abf769fc8402892932f83d5f322a317bbdeb98114d3b5c5c200444c3b3e6f806337172e43b15f4ba5830addb08c5474930455b4
TLSH
T1B6A0025645D55811FE148270A26245C52795CD191951631355D10445996F1D16152B00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cad2f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5cad2f.TMP
Size 48B
SHA256 5e8d2834209b18a7851aaa071cd37ae9719fbd6c33e4a9a8851b8ebd7524a353
MD5 a1b7731e787568506141aa92df4ac2aa
SHA1 db1bf57e654696ab35ad937aac116e3300656862
SHA512 5a890159c2a9d78b32e5c77ae07084f00278df61d27c8e2df55c63d1db42650c8f52dd421a8520140e033245ebb3dd48d3800e8eeb8f0a80dd5125fd66609f31
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b4c9d047-e868-4cd2-8be4-33cfec69cba5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4c9d047-e868-4cd2-8be4-33cfec69cba5.tmp
Size 12KB
SHA256 dad526f0d1853911fa2869408108388fea7b11910c577e2c4d741b23f8c58027
MD5 ca81c8657c4a06c1289bbf47d31652ef
SHA1 477e2408c703ae32b8fcb429332b1dd320985600
SHA512 21c03d24f3d914c3de8ec998c58d4edb1364b9644191147793f6258ce341c161ad6e5117e0e6ba1e4e26dbcf31ddda76b29901b12c8a1f49318c9029e20a1153
SSDEEP 192:aRBS9DDv7zuPRp0Q9NLHsb+WNn+N00peSkweVyIsnAUgE:aRBS17QXV3wE0Y2E
TLSH
T19D42DA2DB914783B6ECBD62AF9217B53DBF5102121A52E84E7FC8A2C15E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5bb5abb608cf2c547284a7e03c8fb337676bba58899df56d2e0a50d2945ca40b
MD5 54aa7678bd628c72c455e8e88a79ef89
SHA1 fef9f5973535e617e5bd0fd9577bbedc8bd7abc2
SHA512 19fd8cb2f541551b20b8f177b7d0d476857e249902c1694a5ab26f49445537ab9894e578c3ebcf2111087bfafdf910cbb53752b98438c7fde4d20415d27451c5
SSDEEP 3072:ofYcQcRwuGRMWGRZ7vby6eyybtB2SU/+Z5t:ofYmRwTDGRZ7W6exKGz
TLSH
T1F4C312120BBE6FD286E49C6CF45F3E4A1CF9E853C76E592C44DC588C01861B87E1B5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 23a6e637a81dcd959e33d4ea06952a946932c9fadd762606a22ea55fbe0b96f9
MD5 728796ae18ed6933eaea612f5b16d80a
SHA1 f4a5f6eb3509cf88cdaf3366d77dc02f4c217b36
SHA512 99b13013b246dbd9c74d277a6653cb41dc3a5f9d2c731b05913e6a6ee278462639c32201b24d1b521ad17bcbd5d21215910e52d2e1323d41941483589bbc104c
SSDEEP 3072:7KcQcRwuGRMWGRZ7vby6eyybtB2SU/+Z5t:7KmRwTDGRZ7W6exKGz
TLSH
T18EC312010BFDAFE28294996DF45F1F8E2CFAE453C3AA163841D9985D01812B87E1B56F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 d871b99e34ab7c77e2be8380c4a810f3faccdfda52f00df97a262063396e15d4
MD5 85e0ca1979c4de93b247d3c4b51c4f21
SHA1 20a65830482b498f0453dcba538ce226a5111386
SHA512 ebee3f37d3b6c2dbb92c807e042a53867396ff960ce8f83becf687979f33e5483f96f1dbb79f163fbdf1e91d2ea0807a9b7c11c3e553e0b25aacca9195c6b273
SSDEEP 3072:oKcQcRwuGRMWGRZ7vby6eyybtB2SU/+Z5t:oKmRwTDGRZ7W6exKGz
TLSH
T131C312010BFEAFA28294996DF45F1F8E2CFAE453C3AE153841D9985D01812B87E1B56F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a20692d85c18c9f8973ee6baf9989e394b3aee8853ed3d28b9137a9ce99b3525
MD5 9dadf3216e9593faf32792d7351b3fba
SHA1 80aaf7a5df449c24e17857a5342092f497059276
SHA512 45f8d6522d86b01f5797f12016371e46b27424fb70a0cd1d3def5e47c83e26b9dd9b133ed59ac7eb62a4be6d45842a0686ac37cd012e164e61ea98b16fa17c14
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5qqDuZB6WGyvUU+MsbL/Mmv4a:BC0qDHUgvIdaDUDzu/CI+MsbL/N
TLSH
T149A11932A46D4D775A76D909F9662E43CEB4702BE932BF84D9DE0E0C12E70EC1302A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 460d0fce9c4bb4f6f38023c3776e5ac9427360df93f3290eda12012bbfee9a08
MD5 8abfdac4ccc037f0953b6031012affb5
SHA1 e7edfe921ee9965f1672cf933ee5b5e19cfb6c3d
SHA512 6443d320259a9088cec1f670fd3804e1ef4e5f47cc9630dec136bd841fba07f171fb0e38a5b79bcc56d74c1cb5db37d5841b3e571de6d31a8cb9fe4f86b584bf
SSDEEP 3072:YfYcQcRwuGRMWGRZ7vby6eyybtB2SU/+Z5t:YfYmRwTDGRZ7W6exKGz
TLSH
T160C312120BBE6FD286E49C6CF45F3E4A1CF9E853C76E592C44DC588C01861B87E1B5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6a7431429b8a92d58ef0fbd759558ac949ef854095e058fc454cf5ba48d7e69c
MD5 7d2929b45c238f964d4c1aa7fc78c877
SHA1 f24fa536ae0e2379eab869be59a5270a91e2f538
SHA512 7292b80d5c71d70a3939dd3b7165c150f2dfea42b5ce0ae19a9453968b47f39a1a5bb33769a46f6d9e1920c905cfc6a24f4b33fe152a5b37e60d943988728153
TLSH
T1A8E026D444C8C23EA762B4C7E168638ED2C0371BDACCE90E970498C97882584A2A7AA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d67f83ae7aa62e8233688ff4322b0f60ce7cbf69464d37ba9e152a24c5f399d9
MD5 176153952a596a204d2a6af068ea3157
SHA1 30f1570b58cc8c37738a84538147887ea3a61a7c
SHA512 022d22d27ef7339431c23aab4b754dfd5a49d86cce44d27659b59e1fc95df0ac30f6afcc7505e55112e1d960863864510b7c24d1d4a9fddff8b1af9b7b161670
TLSH
T1C5E020C896C4D32F5505698F9159574CC1C0370FB6C4ED0F1704C8CC7581648A3969A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6d38255cc2fe8e01c7ab385aa3cf9bcce4b25f24c6dfd79c6adf2a171a08d20d
MD5 cf3310dac8901ec47b9fde7a4b809c42
SHA1 dfb103ee7c68f482d16722817bcde017cef4093e
SHA512 6e29c754d4de052503d46aacd3448f737a44a90b0896cd7fc3c6d0da66809af97c882864df57becf5dd0f1d90557cb579c42f9a31cc888488fdd9b98db00af84
TLSH
T1B0E0268444DCC2BFA701E487D268930CC2C0370BDBC8F94E2708848D7802166B3ABAA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2d365a48626ebabe0d625aacd08fb3f27e1adcc29a2b74b15b7012e22c40f82
MD5 9f0fe21dd85dc2f0e3a5f61ed4c01838
SHA1 9fa4c1f117995dfbc25c4df01f894f28aa48aaa7
SHA512 2efacb6096005756fd85e817777fc8939df22465edad91938805ca773a0bdbaab2317dac08d40ae74ef6f48316bf4ad558bbe6cfd8ee3292bcc3da07bf01588c
TLSH
T1F361C9A5537309C1E7334771D9F09B653EF6AAAF0A833FED0C7431B4A996F286011564
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb260.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5cb260.TMP
Size 2KB
SHA256 9221bf3c3b71f9a6d62ffe24c2cc69aa8ed637e63fbd15a9171b270f090ff326
MD5 a5f6e374576a38301325917c18851664
SHA1 9a4941fd88dc3fc4464618953caafad9e1d24e1f
SHA512 6c60739fd4652ec05cd6607e6418f71c938ed028641a8742454068e43627a6a9384f69592f80f41bede6ed1bb68d9cc0753940cdd57c8c69594f7c7cbcbbb250
TLSH
T1A451C694037709C1D73347B2D8F09B6A3EFAAAEF09472FCD0C3835B0A8A6F685002160
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a3871a3232e90e7636fe8ee9c782e1679951d67dfdc864d02639993713b19455
MD5 6b65da85c952b233d54e78feadae6ee4
SHA1 afcddf644cc3daf6d244ec4de27b6a7f1c4dbf6c
SHA512 ea18cc0c4c3fe0dc80f3157b5c9431b4ece62affff241b8358617c39d57c6f32242fbf80b0f25d1bde568091ca490de31553ef5d8a16ea9a850280be0d78f90b
SSDEEP 48:YALlNzOfRcQgw+gggy8PgWWCsJFVaCCAsRzEsR/QzsO4foKsNaGCKs6Wgmzsbksv:D1OPMXiPuaZpzJ3ES8HClGdxwQ
TLSH
T1C99171F7C7D8862DCD1166F4A7146E2BCE2D0954431C3D2AC8E8AF5BA3F2471E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 498087b018ca988007157175ea286566ef957c94295916d700ee8319d9e7f374
MD5 7821d6261783ad301e29647434ccd5a2
SHA1 80b02e2d98b4606c3f865f34576cc6c972a20c99
SHA512 a14e0248572f1e150506e32e01f6f19c241640224dad33770136f91d5747f3f353c555cc4fa9432a0e4f750fc5f36b0f6c576123aa806d27af011259e6bde12a
TLSH
T1DD81B0F787E4862DD90166F0E614AE2BCE1D0514432C3D6AC9E4AE17E3E2071E142B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 886b6535957d119620a1e357d5a93ca1bfcc226cd00ef0e0110d25d63a69dbf1
MD5 cf82c73417c272585183b22830b03e5c
SHA1 9b234dc3706eb67c6505c6801f73307bb815b663
SHA512 654253ee074ba525449756999a636d8fbdc77af0abeb9883790fb2d9425cba88058d8f9c31ea5351990e63be32ae18668f750c480b63dfdf86f9fe749774b70a
SSDEEP 192:sxRgR4TM/fKsrDNHZ5JJ7uzoA8pmY/g6+WNosNgmXPcD9KF6StGphIgD5Y47J:sxRgYM/fKsPN55JJ3b/5pSmXHkSGH
TLSH
T15942C616AA28A93B9CC7E219BB15BF53D3F8503261D12F54A7FC8A1C01E76DD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8b1a1c8041da6b218d9c6d85453f0fb46fd8873b699256be9ad2ad35938969b4
MD5 436038ca13391b3939487aa899582b24
SHA1 836e10a2da1a9d9b9d1af8c1a925e270693bdf85
SHA512 8d4917259f476bf18c4a862149c96bf8d083af890d9a1152a1e0cf42be8fb47c187a420fe8a7e5809c2b3fd8ae51bbe9cea4bfd0f8c564d2d5b166ff768a498a
SSDEEP 192:sxR7R4CM/fKsYD3HZ5JJ7ezoA8pm9/g6+WNoFC/PSD9n6StGphIgVY47J:sxR7VM/fKsu355JJ32/59/BSGv
TLSH
T1B242B5566A28A93B9CC7D219BB15BF53D3F9502261D02F58E6FC8A1C00E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 81e0601b125a5399a1896432dea7c50cf59d9ca32413cb9e9c3ccbdf3089a445
MD5 8293725174f74441acb02a885029a314
SHA1 7e3941c8d48e0e301847dac499160fedb14ae8f6
SHA512 de881970b5d7b6857b38a0ff68f906c8bbbef56580370973ae572259680cd44dab787db0df6949725d6b0a44b52ef814af7b366498f2ec61bc04aefb864816df
SSDEEP 384:sxRgYM/fKsP/66s8qMpRiYnazAW8pZS15posJWeT+055JJ3p/5pSmXHkSGH:s0YM/f1/4Mnc7WeT+0V/5HESy
TLSH
T187C20805A924C8379FC39D28693D7E33DAEC506222C5DFDA56ECCA1C019E1F9AB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4c4e29e8d7c51cdeecd6f436b468fceb6ef7c38d79fa9fbfb28105dede6acaae
MD5 f28b66200a6354e64fc56e3c6d55d1d3
SHA1 e757d49485092aa3eb6090407c7582996ff1c175
SHA512 13eb3826fd40823a8f1f1e5efa46c713ec6ffd6554baff61d1c9b41ee9e5dd860109a31f26c64fd2e66525fecc4ddf8ece2f6e2473471cfacaaef8d00b444f09
SSDEEP 192:sxRgR4CM/fKsrD3HZ5JJ7lzoA8pmE/g6+WNoFC/PKD9n6StGphIgDrY47J:sxRgVM/fKsP355JJMn/59/5SG1
TLSH
T15C42C656AA28993B9CC7D219BB15BF53D3F8503261D56F58E6FC8A1C00E76DD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c3b7aafe35df898d61e0db76091a43b29ffdb3b5f69a37a406390258518e0af6
MD5 ddaf0a5481f5f7375f198e676b6b4d41
SHA1 3c71152dbc53ba964e04d749a7907712bb2d11c2
SHA512 908dd006be3b16c445d0d83f62f3eaa80786a1599d8fbea3a2bb62a5158e8171db8db63353266686f91cf6552f1a42611b9e56de39806aac72e03111a2458b1c
SSDEEP 768:azfWI/7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVboYc16xropmfGp:azfWI5Ef30Wg/XfHfu1ja0oYy6Kpmfm
TLSH
T1B4D2DB7B640CCE7F4F800ADDAD197E9B6DA802CB9698CD5047FD941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5f9e27ee-352a-4983-96ae-a1cc954ee1dc\index-dir\the-real-index
Size 120B
SHA256 44963cafef3c3ce0564ac8b3b7e630b1afe5f4d56cb196ea01c641653ba0aae8
MD5 e32df2378c81c73937414b3cba6d783c
SHA1 314c95385d7b71cb1cf158d9dd702890ebc2b998
SHA512 dab46da0356131477c7697cbf47f3c1eb756b2c690418d87581fcf36dbdb2c61155d9c2b0c2bc489f787eb47df0532e371bb7e0f7d83aff498be77eb1e879709
TLSH
T127B012008C5908A7CD0703B105B73164373D0BDC0A2207A760CC28469C910E9C107404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60e8ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5f9e27ee-352a-4983-96ae-a1cc954ee1dc\index-dir\the-real-index~RFe60e8ed.TMP
Size 120B
SHA256 bf11a82739edfc01a3d1fd8cdfab9b37999e99fbd38b4f1f1e1168e204c532f9
MD5 65554ff8b6a65722ebc42dace5eacdb8
SHA1 a2acff02ae6e770c3f3c115e2020d876441e9204
SHA512 5ef9f8393995d228dc151a7d0b180431c8a6c4f6df1bdd5d1b9cecc02f426a34eee35c4383061b7a9ef52544e032b3abfa5064cd8dd71f80a6c1f4d2d29121c9
TLSH
T1E1B0121101984C61CC0A02B01063925437660C140461835331D9584B4C614C8904A404
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 915e3161b9d53fb29e6c9178e157a29b807a1fd5fe52dc8ec39a072ffbd61472
MD5 ced9d2918c49695bd806643db5db7930
SHA1 4577bf26efb0d330db772086d4e453807f9bf7b2
SHA512 fed0541cced0bc7d030121759f7edf3d180cbbfaa2974d943807a475c66aa7175b2e58ba1eef472cdad67f2fbfbacd958285e19ff4dd7807c7d2fe3ec6dc3465
TLSH
T1EFE0C0772EE71850EDFF93E62030A8B80105BC54C145FC4F006BDA87C0E13001817C26
MD5 SHA1 SHA512 TLSH

Submit Download

3340a80f-2e85-4602-a5da-7177a0da77b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3340a80f-2e85-4602-a5da-7177a0da77b2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a9280433b336f76b239c30aedf63e20f0dc6af897544ec979b5887d60b5745d2
MD5 711c5935b3d7c2f7ae368c381a1dba6d
SHA1 7cc2e3b602a4e90887eaa0a7cffb83d89f6387d2
SHA512 a6554354fd01daf20abb4f08b2fdb302773ae6a17bf17ea06d40a130cb053f803d04dc34f01b1a1c58f34e40b5d3d67f4812b655e4a98c671519f148c3d87b0d
SSDEEP 768:bFQv3mwgvLOsXBrEnjN3Gac1FW2ewBKZOur:uv3IXRQnjMat2evZnr
TLSH
T1271318F598E78976D8EE9347A73D6D429EBCC1A3B4844994B7C86D0CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5da4ca4076e1ce0b2ca1c66ae2feef3c86193716d9d06aa07495a26f7148bba1
MD5 fbdb7d4b34b2e4717bd12d594a36fa2e
SHA1 20e60d0a6611b3af0b203d8b06644af694c1396c
SHA512 872e051abd9311d0dff7d1303fb61cfaf83a1eca6094b0aabf1b45e0442953b353563aab1890601500aa37c0500af5a7f440632d3f79ace68947e73ef6eda93c
SSDEEP 384:nQSZcIL38Nb88EYTfYWZlf8hyEGunG77nIy2rEoajo4cdR8eHhVODjYPNDUMW2Tk:lL3q55i0X4rEnjN3Gac1FW2ewBKZOur
TLSH
T1CCF2BFB068759DB38CEAE245B6437643AFE016B394D50F64DADDBB0D11836D8270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4c8508038273988277455681946c33b04f05c628c8a199a3b7d8b536f85132dc
MD5 86973a63af5a75188d37582a9b32eff1
SHA1 dd3c8721d218411017c8e48e9f9d07fa7cd68b52
SHA512 66c7b83ffa04a7e85ce2c85d9ee86a59920b8b85e74844592955b2ae6bf4c2c03c0779600419a648289e6acd07745c1b93a96bf8ee7a3e82cab3fdce7eb31fec
SSDEEP 384:n5ZcIk38Nbx8EYPfYWZlf8hyEGunG77nty2rEoajo4cdR8eHhVODjYPNDUMW2TK5:Rk3z95i0XvrEnjN3Gac1FW2ewBKZOur
TLSH
T142F2BF7068759DB38CEAE245B6437643AEE016B394D40F64DADDBB0D11836D8270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c7fc2174e4774016554c477df60cbf6406541420945c0c4df36d1a5aaf54559f
MD5 26b49187ae9cf80897f44a383f9c36e1
SHA1 5a1ba50a635b4a0e1186a00139bb6351b8a1db0c
SHA512 f8f4ee02b409a685028caa41aac93d6736fdc619a0a13b4105c85ab53db2889da19e79badb8b965a47fce2adaf0d35a61dbbbba54ea73ae73f4b340951e19922
SSDEEP 768:rrv+4UNbdS3Gmi0XSrEnjN3Gac1ZxeVH1SCz:rbsbg3FCQnjMaSEH1V
TLSH
T16603CF3269A89EB38CEBE38571477A037FB4525385940BA0C6DD7B0D029B9EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ce857bf-dadc-4aa4-8535-14254963a78b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1ce857bf-dadc-4aa4-8535-14254963a78b.tmp
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a81a4eee729978393cff7718a9d8a74fd3f6f122297e9c12a11b4658834411e
MD5 fa6015a8dc98e735976dc38a0990672b
SHA1 5f2e6427fd32691058b5ae21d18f6695efe6fe87
SHA512 d3f3db3b730235d6df3b555174dbedf1b51d5b0f5b0dba88e7a6cd2e8de59ade2baabb191a30d0a6b914411256972c8663b48057a0b017df2de09a08c241d930
TLSH
T1FD313EE158391EC2C4BE0DAFB04B2AFC84E8C326F5A434382898ED58563E55E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e56e2e8c12c30aeb3647379105e6cc00fb874ae60db91a7e65912c81acd272cb
MD5 4fd39e59059f75a9ced12b25de6be901
SHA1 d942bc4fe9fe1f73e1bbe6647bfa093ce7449556
SHA512 23ee132546b4ee2a51fa5a3c985b815d25beaa211114e7bf11bd3d405e3225c8d2f048f8c898338119b29d18f39f785fc26810ae2e4fc11137d14bf0526a1121
TLSH
T12C3122E1583D1EC2D57E0DEFB44B2AEC90E89216F5D434382898FCA4567E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4064f883ab03274d942d9669bcd8d2fb6cdbe53cae07e7c3c45eedb4fa0ce127
MD5 3d7f13d024e13960d589424710ae35af
SHA1 84cec1f45f7181378af3169fa664f2ef1630e695
SHA512 7fc51183bc0811cce4f00965b6c8a3874b0fc32432865df5d92b419cc72889a834c7d01b69720d627448553d9bf07e1f20998b00e93d2170e102da3db578bf2f
TLSH
T1443120E158391EC1D47E0DEFB05B29FC84E8C226F5A434392898ED98567E55E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8bbdde884f76a239161544bdc5dd38be45fcd38b4172bbe8630dd3f69056c302
MD5 bc4b668c701adc7329247ed782c1bd46
SHA1 ebe3892787b431850782dd1a2d4b5638859a4845
SHA512 23913959b3ba221f4eb9dd87ce08a8dd49eff4e204107e1b5ec8a1119d6c33a533fdece0909b21f80ec9f35299d0ceaa0c3f040332f3101b6a955189a380ac25
TLSH
T179311DE058391AC2D4BE0DAFB48B39FC84D8D326F5A430386898E968563E65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

794c9ef0-2584-470d-800e-7ffc092aee40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\794c9ef0-2584-470d-800e-7ffc092aee40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5e333a7f-d5da-4df3-a7f3-e9fd3045b697.tmp

Path C:\Users\Admin\AppData\Local\Temp\5e333a7f-d5da-4df3-a7f3-e9fd3045b697.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3480_234153396\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir556_994651409\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_543224502\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3480_985399366\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download