c1aba73ac9df1a2e6dd4b65936168b8aa3cc70b259462380534729730d8e487e

Analysis

user interaction
yes
max time kernel
43s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Insert MwIII.exe
Size 7.5MB
Sample260807-eaxg2azvev
SHA256 c1aba73ac9df1a2e6dd4b65936168b8aa3cc70b259462380534729730d8e487e
MD5 b8eb3c6c2be69ba15eb2e38ae35c2107
SHA1 ce98d68eb739660d21377aa7515b3c6fd6d736dc
SHA512 0040c39f8b036f8275fbacc956a1674677f108de645af42af37968bc048d6357307276a05026eae0ff9fec0a2603f864bbf8bb6f2a47d912022e79837f633263
SSDEEP 196608:/g2eX3gFSLXWYYAiMte6zeELd3/Yy8jqnZB:/ghgFIXW70te6Syd3/YyUqnZ
TLSH
T14A8623E962493B18C41B4CB0D033BE06B1B6561E0EE6D1BD35D6FED0BBEB815D942B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution vmprotect

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/4420-3-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp	vmprotect
behavioral1/memory/4420-929-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp	vmprotect
behavioral1/memory/4420-930-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp	vmprotect

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com
37	discord.com
43	discord.com
50	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4420	Insert MwIII.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5304	sc.exe
6112	sc.exe
4756	sc.exe
2380	sc.exe
5900	sc.exe
4924	sc.exe
1968	sc.exe
5680	sc.exe
4308	sc.exe
1644	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 62 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
356	cmd.exe
5544	cmd.exe
5400	cmd.exe
2200	cmd.exe
4292	cmd.exe
5828	cmd.exe
5540	cmd.exe
1580	cmd.exe
5116	cmd.exe
3844	cmd.exe
2924	cmd.exe
5928	cmd.exe
4920	cmd.exe
1676	cmd.exe
5796	cmd.exe
5504	cmd.exe
5560	cmd.exe
4372	cmd.exe
4352	cmd.exe
4964	cmd.exe
1364	cmd.exe
5940	cmd.exe
5564	cmd.exe
3772	cmd.exe
440	cmd.exe
3732	cmd.exe
3560	cmd.exe
5964	cmd.exe
3624	cmd.exe
356	cmd.exe
5904	cmd.exe
4404	cmd.exe
3308	cmd.exe
436	cmd.exe
4700	cmd.exe
576	cmd.exe
2092	cmd.exe
5944	cmd.exe
4012	cmd.exe
1324	cmd.exe
832	cmd.exe
5656	cmd.exe
5984	cmd.exe
5596	cmd.exe
5280	cmd.exe
1308	cmd.exe
4780	cmd.exe
2216	cmd.exe
2316	cmd.exe
4556	cmd.exe
5016	cmd.exe
1900	cmd.exe
1812	cmd.exe
5816	cmd.exe
5640	cmd.exe
3912	cmd.exe
5848	cmd.exe
4860	cmd.exe
5212	cmd.exe
2756	cmd.exe
3240	cmd.exe
6076	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 40 IoCs

defense_evasion

pid	Process
5692	taskkill.exe
5300	taskkill.exe
5476	taskkill.exe
2396	taskkill.exe
1240	taskkill.exe
5284	taskkill.exe
1768	taskkill.exe
5368	taskkill.exe
5480	taskkill.exe
4916	taskkill.exe
6132	taskkill.exe
5032	taskkill.exe
5296	taskkill.exe
3120	taskkill.exe
5124	taskkill.exe
3884	taskkill.exe
4860	taskkill.exe
3412	taskkill.exe
2084	taskkill.exe
5312	taskkill.exe
5384	taskkill.exe
4456	taskkill.exe
2548	taskkill.exe
5600	taskkill.exe
5208	taskkill.exe
2348	taskkill.exe
5216	taskkill.exe
5868	taskkill.exe
5236	taskkill.exe
864	taskkill.exe
2392	taskkill.exe
3188	taskkill.exe
5704	taskkill.exe
5240	taskkill.exe
5412	taskkill.exe
5516	taskkill.exe
828	taskkill.exe
4416	taskkill.exe
5292	taskkill.exe
5660	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305479063685770"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{0F966A53-5088-4B58-BC9E-42A6990D44FB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{974333D5-5C2F-4584-B997-DA57D1996CC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	Insert MwIII.exe
4420	Insert MwIII.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4420	Insert MwIII.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	2396	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	5240	taskkill.exe
Token: SeDebugPrivilege	5312	taskkill.exe
Token: SeDebugPrivilege	5296	taskkill.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	5216	taskkill.exe
Token: SeDebugPrivilege	6132	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	5124	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	5292	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	5284	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	5208	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	864	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	5384	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5368	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 804	4420	Insert MwIII.exe	80
PID 4420 wrote to memory of 4780	4420	Insert MwIII.exe	81
PID 4420 wrote to memory of 4404	4420	Insert MwIII.exe	82
PID 4420 wrote to memory of 3308	4420	Insert MwIII.exe	84
PID 4420 wrote to memory of 4556	4420	Insert MwIII.exe	86
PID 4420 wrote to memory of 2924	4420	Insert MwIII.exe	89
PID 4420 wrote to memory of 1900	4420	Insert MwIII.exe	91
PID 4420 wrote to memory of 1324	4420	Insert MwIII.exe	92
PID 804 wrote to memory of 3220	804	msedge.exe	88
PID 804 wrote to memory of 4376	804	msedge.exe	97
PID 4780 wrote to memory of 2084	4780	cmd.exe	96
PID 804 wrote to memory of 4712	804	msedge.exe	98
PID 804 wrote to memory of 4712	804	msedge.exe	98
PID 804 wrote to memory of 4712	804	msedge.exe	98
PID 804 wrote to memory of 1468	804	msedge.exe	99
PID 804 wrote to memory of 1468	804	msedge.exe	99
PID 1324 wrote to memory of 1364	1324	cmd.exe	141
PID 804 wrote to memory of 880	804	msedge.exe	101
PID 804 wrote to memory of 880	804	msedge.exe	101
PID 804 wrote to memory of 880	804	msedge.exe	101
PID 804 wrote to memory of 4884	804	msedge.exe	102
PID 804 wrote to memory of 4884	804	msedge.exe	102
PID 804 wrote to memory of 4884	804	msedge.exe	102
PID 804 wrote to memory of 4656	804	msedge.exe	150
PID 804 wrote to memory of 4656	804	msedge.exe	150
PID 804 wrote to memory of 4656	804	msedge.exe	150
PID 804 wrote to memory of 4744	804	msedge.exe	104
PID 804 wrote to memory of 5096	804	msedge.exe	105
PID 804 wrote to memory of 4744	804	msedge.exe	104
PID 804 wrote to memory of 4744	804	msedge.exe	104
PID 804 wrote to memory of 1084	804	msedge.exe	106
PID 804 wrote to memory of 5096	804	msedge.exe	105
PID 804 wrote to memory of 5096	804	msedge.exe	105
PID 804 wrote to memory of 1084	804	msedge.exe	106
PID 804 wrote to memory of 1084	804	msedge.exe	106
PID 4556 wrote to memory of 1968	4556	cmd.exe	107
PID 804 wrote to memory of 2208	804	msedge.exe	133
PID 804 wrote to memory of 2208	804	msedge.exe	133
PID 4404 wrote to memory of 5032	4404	cmd.exe	111
PID 2924 wrote to memory of 2396	2924	cmd.exe	112
PID 3308 wrote to memory of 1240	3308	cmd.exe	113
PID 4420 wrote to memory of 3912	4420	Insert MwIII.exe	114
PID 4420 wrote to memory of 1580	4420	Insert MwIII.exe	115
PID 4420 wrote to memory of 4352	4420	Insert MwIII.exe	116
PID 4420 wrote to memory of 2092	4420	Insert MwIII.exe	117
PID 4420 wrote to memory of 436	4420	Insert MwIII.exe	119
PID 4420 wrote to memory of 5016	4420	Insert MwIII.exe	123
PID 4420 wrote to memory of 2200	4420	Insert MwIII.exe	126
PID 4420 wrote to memory of 1676	4420	Insert MwIII.exe	127
PID 4420 wrote to memory of 4700	4420	Insert MwIII.exe	129
PID 804 wrote to memory of 2460	804	msedge.exe	132
PID 804 wrote to memory of 2460	804	msedge.exe	132
PID 804 wrote to memory of 2460	804	msedge.exe	132
PID 4420 wrote to memory of 5116	4420	Insert MwIII.exe	131
PID 4420 wrote to memory of 4964	4420	Insert MwIII.exe	134
PID 4420 wrote to memory of 3732	4420	Insert MwIII.exe	226
PID 4420 wrote to memory of 4292	4420	Insert MwIII.exe	137
PID 4420 wrote to memory of 3560	4420	Insert MwIII.exe	138
PID 4420 wrote to memory of 832	4420	Insert MwIII.exe	139
PID 4420 wrote to memory of 1812	4420	Insert MwIII.exe	140
PID 4420 wrote to memory of 1364	4420	Insert MwIII.exe	141
PID 4420 wrote to memory of 356	4420	Insert MwIII.exe	142
PID 4420 wrote to memory of 3844	4420	Insert MwIII.exe	143
PID 4352 wrote to memory of 5240	4352	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe
"C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/n7n
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9f4d0c188,0x7ff9f4d0c194,0x7ff9f4d0c1a0
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,17254495295313341904,16421484836790935268,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,4559555619418466435,13744606799336890562,262144 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,1160000098009717591,15709879785918030127,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,12050394271334229467,15547253018163122269,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3348,i,18417873361324243327,7039854022910477822,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11100381659333982285,18171123405446764290,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5275156125492061950,4021796719242427230,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,6476821529217524195,914467560250735990,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4356,i,12851812600104583688,13943643276964411849,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,3752679602476896707,6426244090690520940,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5312,i,763944796032835124,16024449504414084916,2097152 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,14353188421093455662,6984081368285190087,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,10857096885715635971,13197361145637361658,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10917786437942006647,1819749821885998246,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,7400138456501542510,17142655245729936580,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,15231595942854006219,1118056883384174226,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1112
      4⤵
      PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9276473445858925409,4992488048888793960,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9276473445858925409,4992488048888793960,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,785752839370424293,1083257627669375870,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,16210161727373437414,7136277888649035766,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,8308841957089376246,14441626561722431897,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,7054289241256013047,14332279908291824156,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,18305083680780424898,1971565373685618468,524288 --field-trial-handle=2012,i,4150153895543262141,8907140522195454269,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe" MD5
    3⤵
    PID:1364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1580
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2092
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:436
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2200
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1676
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2208
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5116
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4964
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3560
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:832
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1812
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:6112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1364
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe" MD5
  2⤵
  - Executes a command shell one-liner
  PID:3844
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Insert MwIII.exe" MD5
    3⤵
    PID:700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5848
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5828
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5816
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5796
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5940
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5400
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5212
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2216
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5560
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5544
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5540
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5504
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5928
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5984
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:356
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4012
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:576
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3624
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5280
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5964
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6076
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:440
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3240
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1308
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26dd1f3d0ab043de72fae51763871d83ab00be2991f140d635b1c9d6bafd6c11
MD5 8c5db2e8326b80eb6e689716e36b2f44
SHA1 947126db98c083bce94d4f10ef3ce102e691fc6c
SHA512 3e335be7f40c19bd365715d1326c12d5ce5ddb190807c27edc2173088dd69014914c583764798e142b00baf59f12df024db4eba0e0b58c7ea6074cfb29490335
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb2092aac65238f5c99a5041af4953f8df51484d0a523a06aaae064a4d1a8d8a
MD5 af65f1c9855ae2782507fa1daccd541e
SHA1 5392700bc0ec9624591499a538382cfc2ceba4eb
SHA512 8cbc9270f956100bcbaf414b1e907e92e012fc02f78de428360dd6c7b0c95d06de275470c8505a7b078f6ac12e8dca1fbf876ba7278a4f4b1bde7ed100e3d323
TLSH
T1FDD0A771B9A9DAA0C17A003680206610526901E5656B5A85A1E4882E9976050A6DE9DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 0ffed3f18540b3c8fce75f7ddcaacc46ffcff56630abb31282e808a53b355012
MD5 cefaa0a882ff529c0e8f35dca5e3b98a
SHA1 c5a1f97ec7dd89b84b861789f247d068570161b8
SHA512 1e0c61323ee0fba865cef965a45a99a3e3c06f3287aae1c2b2549e06256e6c87d670618d298aab7695f5478cbc8ca80863dd51c21bbc436c928555649d7f75c4
SSDEEP 96:m/ojelXBpFHwd2807CqIdbHG7ohuPbws6CzIZGKDIEQlGkIip9VcKvmyZ:K/lot07ybHWV6CzIZvDCLFWyZ
TLSH
T1DDF15F9045A28C61FB92DDBDC8E5B1A5B031CCC942CB1EAA47284F7DB1CFF6B4521D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3318d1a2b6482f942a837cf7b40ab0fc77d4ebd11b1b9c555beb8f4d78d21887
MD5 2e56a9cd2f13c60079a447e562080d19
SHA1 da5f1b538c51ff8d5c12d26bd2b820fc870bb3c0
SHA512 508bd56d84e17327f883ac43cd38c3494029bd554c2e5142a51248d449634a3a9ccc4d1002f91024ad34d99b33f2db6015f912a7e9d91c0ccf58e99972bf131f
TLSH
T1B6517AF3C7E8862E8A0156F4AB147E1ACE2C0914531C3C6AC4D4AE6BA7E2571F141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c112f85c55fb21aa67c4c99aded93369d0fe870fd6ac8a1f44a28e8ba7c0c409
MD5 1d05b7b4c493e3314e26b6b231aff1f1
SHA1 af4f6ab92a3b4615c796c0c39420019990052ae7
SHA512 521b59ebf430442ee29c4b7a74fcf45b47285886bab200e987d73fa23f219cfb3da722cb45c34f01a7ef8836b053a9a41f80adbfca57672de8bd12323ce4f7a5
SSDEEP 192:sxZPR8yM/jK1Ml8zc0/f3sQWpV0TgiJPkIdpnZ/W6+WN9Dka/eBa0wv7cUTIgyJ:sxZPe50/f3sQWv0sulZ/bf/e16O
TLSH
T15D62F841AA34AD77CCDBD21DFA457F63D6F8542291950E54AAFCDA1C00E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 9068293055248e2530fc5a1467a8b2dbf1a3d34fcefd5d2745a39c63cc65c38c
MD5 d9b4bff72f4b27b954abb8fae8a33728
SHA1 2cecc22e13609b3abc7cdf8bb84b04c3ed07e95e
SHA512 807ac5f894d10bafa005a40c9a3ff9d6caba6ba0be90f72396f688f3eed30ced925c11154aeda62557173ff888cf08ff682f24e1cac8e8cacb302a95b2e7dc6d
SSDEEP 768:Vql1j83r2627pLuLfemWRmeKQDC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3uewALlR:Vql1j83r26WEfemWRmeKQDCu1jaKuewa
TLSH
T117032D3B780CCB7A4F844E9CEC267F9A6DE8018BAA98895447FA444C03C67EF55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1732b06d963afa7ebc5aa18bbb6390c3e07cc3d5d0f577434c27e6d87ae0a462
MD5 4e31cdd1d0f9066e205a785619749498
SHA1 322198955303102071ec5a961fbb901ac2d40063
SHA512 3772438cd072c99e4eb9bcde7b3b82e3cf5bf1037b973451ee45134455f3e2d65173358746e8e8d3c26f88374b695b296925ed56d7a25bc5c55af86c634f1139
TLSH
T14CD0A76FF1590491E7BA4AD62E72519AC7102C8C28CD6089D013346D8CF4B4B9321E52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 fbf492189f49df1889262b31315b06895b77fe2905eb1311cde2dc96cd277c4e
MD5 48bf513f8a80065b1334b3705b388a29
SHA1 b4e7a17c870bae131963f644713e34fe57bee5bd
SHA512 84e5d44d61d0dd339fe53b3d40e10821ce027408f77ffe4ebdfce54fa3b836934ed9a5d0a4bea26511df93ac5eff437f4af39c2c449b5c9d882c67660fe0869a
TLSH
T12AD0A76FF1990591E6BA8FD52F72519A87102C8828CD6089D013046D8CD4B5B9222E52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589621.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe589621.TMP
Size 138B
SHA256 cd22266b1b67058a072e9b49f70266aee9763e8b06f54d581486b9e63ab52852
MD5 1c77e807dc9635876648c77158121325
SHA1 673d87fdedfc094901fa43909a5f67fe43bc4eca
SHA512 f0154b8fb7af30459b5c0b140d0a9e16f683c976010c95e537be43ceb6c92a328b3994642cca3b775fa2642b2d44a13adb6cb872f029ffe82c759dcfa52ce4d3
TLSH
T1DAC02BBFF00D0412EB1806C50733415D87002CCC188F948EE02330BC20B4F2B6301ED2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1ddb5a6b0f82454878defeb7aded04563360ffffa54bd2d6202a4922ac9de0a2
MD5 60b5a81fc484e86938278733faaa00c0
SHA1 1b1161c2b4b3ffb8cd8deff1bc37f1fa44122b75
SHA512 02f97260a2f864f643023603938d050ebf13c86f37627835e56998882a58e14d9e82266d186984eb51e98475081326663aecdce9ba333a1c3fa0236333620d8c
SSDEEP 96:KkUgKtem4Ap62AKqxrWbsRuxK54RgxdYwTuqS2hKKSoieBuKSIl:6v4Ap62AKqdWb6uc4RgDYwTuqS1BF0
TLSH
T16FC1B40731BB02B63C3D290DA39587364B4276633058E86B3BA994B64E67E351DFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ec13be325063b2b8dc751f0ae66d21405622b6102b6426574af3b93913689a7
MD5 449c3477f614bb1552d019ce005333d5
SHA1 b5e30691939f815f16bed36db952319be1acd33e
SHA512 64b2d648c2ba4e3b160c98e2abb207e0272eda6959e8629b0489b6454168623af32b7c7229e1abeffe75bbeac9302bde3f512f18f82e50e8c17ae45f1f9fac1e
SSDEEP 192:ZGNX6i5zQmiUyHN17X5zPr2PjzormU8opyEX5s3SJr2GQEWq0zU6:ZGNX62lA17X532X8mUHtX55JrYE8U6
TLSH
T1C912F835A568EC275ED3E585B08636639EE820779D896F54E6F81F1C008B79C170EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0dc7d37d89007ecb3efde806c5ff260b714b2af598b9c4bb852b626d5e6e543e
MD5 7f1d68ba9d8980e2f6a319531e6799a0
SHA1 b1515309deda8259f7b5c2694354906a43f2bb91
SHA512 b0c88d96eef2cafc77ebb3f5afe43622f95b003005efebd399c474dd74300cfafc0df7c45135a1e60c242f0b64353dbd645b7af89cfc0382654ac56feb5980ed
SSDEEP 192:6GNX6i5fQmiUyfdNO7X5zPr2PjzormU8opylajpY22U6:6GNX62hwXO7X532X8mUHBCDU6
TLSH
T11102E835B968AC778FE39E46B58637235FE4102BD9992F84DAFC1B1C008769C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3f8d60103b488bafc9f6cac7c0bb759ef62466433005669e248e4c82d2a1be48
MD5 aa7c76704f4d14782279f852f0b7fa1e
SHA1 c6b31c06a1fbe394344a8a325944e4ac8767c25a
SHA512 bd38b9d49552bd6362a7dfb35a9b3f9fd2864790a4c0d6de0afb2f03eddf4d19ee0fca72483811dff2d8ab4ac6b1623a77b2424a53c73b0db930a72f60db2252
SSDEEP 384:nsZcIV8Nmd1NYARrLHgX532X8mUHtX55JrAxSqftZ9Lks5f5UrzWWo:6V5GAtwVd55hALftZ9x5SWWo
TLSH
T1A4C26A7C9D249C3F45EEB749768D26264EB8013BD9B95AACE7EC0B0CC03555DFB0281A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

785e4623-ca73-4ac4-a9bb-4b77fed6559b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\785e4623-ca73-4ac4-a9bb-4b77fed6559b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

b2df8689-7614-4075-93d9-aefc23b93fb7.tmp

Path C:\Users\Admin\AppData\Local\Temp\b2df8689-7614-4075-93d9-aefc23b93fb7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec30c934-a9bd-4ea2-a022-1380433cb1f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec30c934-a9bd-4ea2-a022-1380433cb1f7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir804_418142443\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14ff7244-0b4d-481d-928e-332a7a5fb97e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir804_917181869\14ff7244-0b4d-481d-928e-332a7a5fb97e.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-3-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp

Download

memory/4420-0-0x00007FF77F273000-0x00007FF77F765000-memory.dmp

Download

memory/4420-2-0x00007FFA145E0000-0x00007FFA145E2000-memory.dmp

Download

memory/4420-754-0x00007FF77F273000-0x00007FF77F765000-memory.dmp

Download

memory/4420-1-0x00007FFA145D0000-0x00007FFA145D2000-memory.dmp

Download

memory/4420-929-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp

Download

memory/4420-930-0x00007FF77F0F0000-0x00007FF77FEEA000-memory.dmp

Download