9504565eafc5fff1a030d37fa8c8219da85f34d1ba0b19745180e7a1fe932d8e

Analysis

user interaction
yes
max time kernel
374s
max time network
379s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RiseLauncher-NewUI.jar
Size 207KB
Sample260814-ajprbs1epd
SHA256 9504565eafc5fff1a030d37fa8c8219da85f34d1ba0b19745180e7a1fe932d8e
MD5 8f79fd0cd9ad1eeeba92e56837fe4978
SHA1 89f2df128d5aa0c01e1715aec4195807b59af98f
SHA512 bbb792244501c6bdaff13dcd1ed59f1e51a6c3495e0681f2356c730fc7f1eeb3034f114194e707442e8b6996fb0857d88823bd2c2db6513e97e8debbbc38e12e
SSDEEP 3072:IZwBlxtCC0yXiYeO6WB+OTBNCK9lc+xdmM2gCb39yr+LsC0s4gWhceku:IZMlWCPV6kGKjR/R2n9yFC0s4Tcet
TLSH
T18524F115BE96D819C08B713A10318693E268959CCA5CFB2F59F292C5CDE058F3B427EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
139	3988	msedge.exe
138	3988	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
260	api.gofile.io
262	api.gofile.io
259	api.gofile.io

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_1111592903\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_1738169056\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_202993611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_202993611\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3476_1111592903\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2380	chrome.exe
3988	msedge.exe
4456	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311402367749786"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{3ACB09AD-E9F4-4B89-AD16-D18292B61449}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
984	chrome.exe
984	chrome.exe
5264	msedge.exe
5264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
2864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3900	2864	chrome.exe	92
PID 2864 wrote to memory of 3012	2864	chrome.exe	93
PID 2864 wrote to memory of 3012	2864	chrome.exe	93
PID 2864 wrote to memory of 2380	2864	chrome.exe	94
PID 2864 wrote to memory of 2820	2864	chrome.exe	96
PID 2864 wrote to memory of 2820	2864	chrome.exe	96
PID 2864 wrote to memory of 2616	2864	chrome.exe	98
PID 2864 wrote to memory of 3552	2864	chrome.exe	97
PID 2864 wrote to memory of 2616	2864	chrome.exe	98
PID 2864 wrote to memory of 3552	2864	chrome.exe	97
PID 2864 wrote to memory of 5644	2864	chrome.exe	99
PID 2864 wrote to memory of 5644	2864	chrome.exe	99
PID 2864 wrote to memory of 4268	2864	chrome.exe	100
PID 2864 wrote to memory of 4268	2864	chrome.exe	100
PID 2864 wrote to memory of 4940	2864	chrome.exe	101
PID 2864 wrote to memory of 4964	2864	chrome.exe	102
PID 2864 wrote to memory of 5880	2864	chrome.exe	103
PID 2864 wrote to memory of 4964	2864	chrome.exe	102
PID 2864 wrote to memory of 5880	2864	chrome.exe	103
PID 2864 wrote to memory of 2788	2864	chrome.exe	104
PID 2864 wrote to memory of 2788	2864	chrome.exe	104
PID 2864 wrote to memory of 4716	2864	chrome.exe	106
PID 2864 wrote to memory of 4716	2864	chrome.exe	106
PID 2864 wrote to memory of 480	2864	chrome.exe	107
PID 2864 wrote to memory of 480	2864	chrome.exe	107
PID 2864 wrote to memory of 5272	2864	chrome.exe	108
PID 2864 wrote to memory of 5272	2864	chrome.exe	108
PID 2864 wrote to memory of 5320	2864	chrome.exe	109
PID 2864 wrote to memory of 5320	2864	chrome.exe	109
PID 2864 wrote to memory of 4316	2864	chrome.exe	110
PID 2864 wrote to memory of 4316	2864	chrome.exe	110
PID 2864 wrote to memory of 5072	2864	chrome.exe	111
PID 2864 wrote to memory of 5072	2864	chrome.exe	111
PID 2864 wrote to memory of 6084	2864	chrome.exe	114
PID 2864 wrote to memory of 6084	2864	chrome.exe	114
PID 2864 wrote to memory of 2940	2864	chrome.exe	115
PID 2864 wrote to memory of 2940	2864	chrome.exe	115
PID 2864 wrote to memory of 812	2864	chrome.exe	117
PID 2864 wrote to memory of 5472	2864	chrome.exe	116
PID 2864 wrote to memory of 812	2864	chrome.exe	117
PID 2864 wrote to memory of 5472	2864	chrome.exe	116
PID 2864 wrote to memory of 5852	2864	chrome.exe	118
PID 2864 wrote to memory of 624	2864	chrome.exe	119
PID 2864 wrote to memory of 5896	2864	chrome.exe	120
PID 3476 wrote to memory of 2740	3476	msedge.exe	124
PID 3476 wrote to memory of 3988	3476	msedge.exe	125
PID 3476 wrote to memory of 3980	3476	msedge.exe	126
PID 3476 wrote to memory of 3980	3476	msedge.exe	126
PID 3476 wrote to memory of 3980	3476	msedge.exe	126
PID 3476 wrote to memory of 6068	3476	msedge.exe	128
PID 3476 wrote to memory of 6068	3476	msedge.exe	128
PID 3476 wrote to memory of 2764	3476	msedge.exe	129
PID 3476 wrote to memory of 2764	3476	msedge.exe	129
PID 3476 wrote to memory of 2764	3476	msedge.exe	129
PID 3476 wrote to memory of 2904	3476	msedge.exe	130
PID 3476 wrote to memory of 2904	3476	msedge.exe	130
PID 3476 wrote to memory of 2904	3476	msedge.exe	130
PID 3476 wrote to memory of 3484	3476	msedge.exe	131
PID 3476 wrote to memory of 4468	3476	msedge.exe	132
PID 3476 wrote to memory of 3484	3476	msedge.exe	131
PID 3476 wrote to memory of 3484	3476	msedge.exe	131
PID 3476 wrote to memory of 4468	3476	msedge.exe	132
PID 3476 wrote to memory of 4468	3476	msedge.exe	132
PID 3476 wrote to memory of 1380	3476	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\RiseLauncher-NewUI.jar
1⤵
PID:2692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc8886c728,0x7ffc8886c734,0x7ffc8886c740
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,16405798702433495804,10555942125669971471,262144 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,2721399233566417188,4911778484867044703,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,16403977290404658168,3157304743046240287,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,13750916049113323931,8442070306311201419,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,12617560070039728673,17582473146701387718,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,6034873680526483192,14362072667735373682,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,8763533527420459593,10276395992384518666,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,16238741547191813083,17291007045265914128,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,14350065506242104317,472592531540010493,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5460,i,2795431226330518354,145630956409667319,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5792,i,3736786696269171389,16231906810282720337,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5804,i,8851371887360860872,1173699819511020380,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5864,i,14364868162772355085,16580215483897366952,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6164,i,5553442357308743857,12070029921047947484,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,5796057904130599804,1629597617998729259,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6488,i,10671443406123827299,17273794215034296047,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,11921237568350767508,16449707270767867957,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,14456840555844462912,6302137300607845585,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6792,i,187357353699886437,3155604054302131652,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5996,i,5155645775492431292,1412228141190424222,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6244,i,7370480660488584330,15035234404458111717,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:9
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6632,i,6016784184065123649,9431980656180583695,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,6884941046408743105,9971598105504598512,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,4080473483488961531,16543533536151785812,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6168,i,12244718215392380492,4391463011637178002,262144 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,7592195350947892428,10343527539363928419,524288 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=1544 /prefetch:14
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6616,i,10313749647161603407,12995157479791935685,2097152 --field-trial-handle=1936,i,214063813053763965,4448262611620771427,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://java.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x324,0x7ffc697cc188,0x7ffc697cc194,0x7ffc697cc1a0
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,16620947755691823846,5374036597788074430,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,4374906149355707223,13048124637696484736,262144 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,18237031594522864459,1395730161850893944,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,6605091039430591615,6590704439343817088,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,13452298910328538191,15457696901201710697,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,7989368371901075960,18264735569251065026,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,8330356550673123548,14504675908934248395,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6413680089898492584,4636992917950456469,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8928559816362608168,17210899251786612475,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7055283427403178929,9509410353056886903,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,18272405366085733056,1029519279485939354,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,18272405366085733056,1029519279485939354,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5126077785800805864,6304802663865958477,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,111285928545002115,9306110404407856871,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6692,i,304990774940383349,16547419928954012711,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17762510741827199666,5267947155126323809,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6876,i,14863612490324205850,1441324584272438991,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7204,i,2522148059587879690,6596046978840675166,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7172,i,9497984820630517383,6361450328622813676,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,730501431960980420,11840031330228081179,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8687181207531932401,16339822588056741427,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3452550724020919142,638804878520480472,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,15349276072704412871,5231365766057276773,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,17518885747530312876,12080922538441202548,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=1368 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,17715258380577357332,5915039930564356438,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,16185590247316772360,1152625147581930136,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,15140904479548081458,5266677789369621712,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:6544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,2362377066324087762,6776901760178291410,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4880,i,3369329839600657160,16973312857366546626,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,12991981853643589595,6677621057409946912,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,12040002812676222794,16934335185733249700,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7644,i,8826572399974011216,6590731111240880779,262144 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7608,i,14803327722664675007,17752927964749724189,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5580,i,11712831614369747528,13481773266009789928,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3844,i,4863441639034899334,5329726027734381971,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5396,i,7925814805035963750,5135260279909026191,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,13321093621914076558,8233670965916346603,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7612,i,14645084387367408695,12311845357118168631,2097152 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,8420958509893524706,1153214366806079396,524288 --field-trial-handle=2516,i,3636540791315308580,6970829485545739876,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:7020
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\RiseLauncher-NewUI.jar"
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffc697cc188,0x7ffc697cc194,0x7ffc697cc1a0
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,14024099968853339256,3456682533618142542,262144 --field-trial-handle=2244,i,13538374778528041730,2686535644480689292,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,1844410785641387719,7897315023539510959,524288 --field-trial-handle=2244,i,13538374778528041730,2686535644480689292,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,3333038606607347454,2327851562107740500,524288 --field-trial-handle=2244,i,13538374778528041730,2686535644480689292,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:13
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14514052095684968495,14584252658329287351,524288 --field-trial-handle=2244,i,13538374778528041730,2686535644480689292,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14514052095684968495,14584252658329287351,524288 --field-trial-handle=2244,i,13538374778528041730,2686535644480689292,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b92a8136c703e9a3b7410e8e9beb41a5091e59fa520baab7924ed7618256dda6
MD5 f86233637c5706f59bbbeb2a02ec5228
SHA1 f70b20293d49635381afcd95efb14bf19e0902a5
SHA512 4d392570252a0ad131ac8d71deb10c24b3ff53808ef4dbc3f03389bb451f17ba2996d70c6346ed842db0fef07f9cace28bd23f43eff2c4ae14c1d940c554cef6
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5bb44e2d11c38a26992fc7771aadfea3c8f868d183a8fdabbbf47134033286f4
MD5 6ae3cf337adbedb0100f80362bf25ee7
SHA1 d384ed990dd84d7cb87e81916fafda80b9f859fb
SHA512 c6831beb8694c930b1fc9e488714a642feea7d906442fe306209d9ed68ff6a1c57110e488b82d236818549adabb7d8422ba62cb87c851d157fb82e1696347efd
TLSH
T1B9519BB7D7D49A7DC81152F4EB216E1FCE2A0A18121C3C63C8E4AE5B53E2872D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 be3fc4c4e1d0c5c317b7c03392c0bd33f9b890d5f985c43ef10d6822261cff9f
MD5 18bc459fae44887e2e9f4992d1abcffb
SHA1 2aa35328bffd879cf65a998f3fdf943896b5b2d5
SHA512 c61bc503afc7136cafc9d40f65389c792666dc8535f4fb223709f0c3508456c74697541cab58edc1479576accd145575dfda8540a83fc36c4e8b366d7de440f4
TLSH
T18B519CB7D7D49A7DC41152F4EB216E1FCD3A0A18121C3C62C9E4AE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1c08e405737f9b0597b44fbdd8726a6db22afffbaac5397f34df0284afc1a24e
MD5 9441d2421ab1f40e589ae06d33845152
SHA1 77fa2ef6377f9f2acc0da1c000f3af75111311b1
SHA512 4b717705caf2fae874df879180afad29b48ba5960dcbde2af93284196553161ff58df1d20f55b778803826145fbce3ccf22699d04b8675f26a4a17de666edbcf
SSDEEP 192:qR4KC7cv7d9PRpll98Hsb+WNnic0Qy4+8tmWQOMAiVyIsnAUgE:qR4KuITXjuwf04XiE
TLSH
T15F42B81ABA14797B6CCBD62AF9217F53E7F5206261D42E84E7FC8A2C15E76CC112700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e5c53d864cc17279535dd9cbe2cec0777f33ec28ea21d93544ea9ebe171cb10a
MD5 f485f4e06b18ab76b6b82ac17f38fbbb
SHA1 589023a70670cf74487384ada2ada329eda9853d
SHA512 ccd89efd8511c2752f04ecb088b1728e135cb80f33d37ccf31dea084c8f70167f4c693ed2166e7163bf81ce7b8449532c21c7fb8528bbfa87d27a91896f7a183
SSDEEP 192:qROKC7cv7hAPRp2l98Hsb+WNnic0K4+8tmWQOMPiVyIsnAUge:qROKuIAXauwf03Kie
TLSH
T15F32C82DBA54797B6CCBD62AF9217B53E7F5102661D42E84E7FC862C14E79CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ba0c279b1a177667d898d7289a0c999960c1649235dcc32b7630454d633c932d
MD5 d4772044600902981f133bbdabb07ff3
SHA1 ada107b842842a19e4ab8d6dc70e5594a7cf1adf
SHA512 00c1f130bf7d1ca0cb4cbffc6fe9f926023e583174a5fe7fe41afc7cc72fed3feeba339013329a0f3df10c8a2eea22d63d20da73466bd0b21ecba7061918d520
SSDEEP 192:qROKC7cv7h9PRpll98Hsb+WNnic0Qy4+8tmWQOMAiVyIsnAUgE:qROKuIXXjuwf04XiE
TLSH
T13642C82ABA14797B6CCBD62AF9217F53E7F4106261D42E84E7FC8A2C14E76CC112700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 41c307b0af27335b35782b7ef48cd18bbd115d5dd2660ac1732ff24c571075bd
MD5 6139a983f42fd7b002e6e18f1acdafdb
SHA1 e0ded5221bad383e188f2f28e028d6e187d072c3
SHA512 ee499b01455a3babb60ac71de448c0e811ade57731a6c6598de852804435e9ceaeee2a4ffca21190a2167f85fb375439c4e55ab2c1e013dee947fed7d8aa91b6
SSDEEP 192:qROKC7cv7hAPRp2l98Hsb+WNnic0dZ4+8tmWQOMmiVyIsnAUgE:qROKuIAXauwf0obiE
TLSH
T1EE42C82DBA14797B6CCBD62AF9217B43E7F5102661D42E84E7FC8A2C15E79CC212700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 63dd9aa0628908e2eb44eb983dec54de69abb1c4a528ad1ef1af05d87fe4b2a5
MD5 93266ae9246f7eb7ffcafb1276b17ab7
SHA1 f4c47e5e79abdd888915de749daa4c21a578c00f
SHA512 88e2235c588301887818487f90c304908fdcce1e50315a69b0d01822445be305f9eb404377031f3413fe8eb1afef9986eb378cf97d44f65e280acea6d8f2a96c
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3g+HG8t2rKgj3:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqL
TLSH
T14A520867684D9A3B0F98C98CDC176F8FACB6025762780D2852FB5D0803A57CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d12e270671b864a9a43cfbec900ea629092ac95d15edbc4645b3f7097cd565c9
MD5 049f4c62396e677ac4eab0c5a0b64902
SHA1 c14de6512091d311705ed8a055aafeb23e010305
SHA512 4531574a0e609b489a733df744e318f64a5d69966c3a351803bc1d42c5321b6e8bc307a882e080d6f9b480ad691d5a2e1dc53d48c0c6f302df8d078d03ed2fe2
TLSH
T1B7A0029247C10415DD068A747276A7B1B7D558161A91C353A4D54D84CC5B5C45561110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bba63.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5bba63.TMP
Size 48B
SHA256 033ee6e3ceb4a9456f452ac5931a7fb53630614b3e69b60d60b3a20d96c7dafe
MD5 d9e3f5923e7d96d6ee290f410cb40243
SHA1 a7535fdb3677ecb264f4a09977addce007f7f3dc
SHA512 4816c6bcb4f70bdaaa0f6635e513d333348134bbcad3e80ff1a178fdc482aaeb6d0d56b2dbf9e0e760a45aaa7689b9bdb1cb130e41d425ff088ef2395d129671
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 79c0c803a0620b0c6271d95397a8784e418fba49a71e0faa5271ef37156961fa
MD5 b0fbdc4fa513d5fb65316090854b1487
SHA1 ec6e21fba6fd06a9f7559b57b62ab9a0ac4ab575
SHA512 497349fa027526a1a3e81ecf1d4fc1c2bb2a26114d35a8cf74956b38ceb6b9180a70964ba5ba3efe0adf619b059f014db1291f3422c38f3a8b543ced74778bfb
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok564HD6ZB6eGyvkonQob1v4a:MC0HJm5FHuPgXDUD9KW8nQobZ
TLSH
T1D8A13AB1A4A94CB719B7D645F9823E83DEA4A22B69A1EF80D9DD0F0C00F71D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 270b4a067be81020ece22355737c23f34d266dc4969e7c0928a24a68326c1537
MD5 3bf6c422216fe34ebaf6d2d22c3d1d34
SHA1 e0ba7acf0275c49374c29e51adb4477c38a6d4ef
SHA512 16b2b722aa377605f1925623a5efc580f120a0a0dbd160b81ab9d5850a59e07c3953a57cb6132c81724e02ece09696bb2ea5954aa677b2fe291d33c94a68f0ce
SSDEEP 3072:g8CbwNMYR5fjQAhw3c+CbNHJoSUhftLaVkzrPh3rCL:gzbwNMcfd+M+CbzoS4LaVkZ3rCL
TLSH
T118D30272799572E90CF5344FB28AAC8B2CC89D228F845E63D18E6F17387539C6203F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 057cf01d82b14a5fd6769c7fdb515da59117d6c1105fb417814727df588722d1
MD5 87e6f0c4151706913de9c72954dfe498
SHA1 3bf9bc0adcea3ec3bd1f13462f301feb7f8453ca
SHA512 4730ed9466b2887fc1cc896b0fb298dcf450141caa72244d17e4c71c05dd8dae62f1a57d57a8e0d5dc3a5c870c7c258f6d866070c23afabd02932d54064aad85
SSDEEP 96:5giKC0d+oJm4V0FH+pqf+HBKyoc5utWSl8h4otop564oD6ZB6OZGyvkfFl65zrt8:SC0HJm5FHuPgKiU2wK6zFl6hfnGQcUO
TLSH
T188C10AB0A86CAC735DF7E752F4426983CEA4626B5950AF50CAE90F1D41E71D8234262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 6533b7f355fbc646cdcff2a12b19b99578bdd2b2511a082f0a818c14d1848ef7
MD5 1861d85163cb1ecfc229ad4f72b6d623
SHA1 1a02d7d9b370acde6a723878890d5dddabf34412
SHA512 b658bde87248944db273405d6430ec11fa62224e095cd7ad5bd6b3e01b694b713b276cea434328d1d7e95889625a9fee49a3c4bf06a1c633bac95fd17fbbc5aa
SSDEEP 3072:K8CbwNMYR5fjQAhw3c+CbNHJoSUhftLaVkzrPh3rCL:KzbwNMcfd+M+CbzoS4LaVkZ3rCL
TLSH
T1BAD31272799476F90CF5310FB68AAC8B6D889D318B844D73D1CE6F2338763986202F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 3121c81bd83e28bbb1478e5f9266f29a24030296b71cbfc01092ea83e3f10b58
MD5 c07be2e26fdac75a892869e402e60e11
SHA1 3cf9deb35ac260bb0b18cf6569c178ff04663be6
SHA512 c4f97f4f4e59e41a81312317b326cf173947deae36c91ff84df168de24e2581e6932356315a740e64a874c071a54a4653980e4b2ccb1f233e79e6e99dc56ab28
SSDEEP 3072:k8CbwNMYR5fjQAhw3c+CbNHJoSUhftLaVkzrPh3rCL:kzbwNMcfd+M+CbzoS4LaVkZ3rCL
TLSH
T13BD30272799572E90CF5344FB28AAC8B2CC89D238F845E63D18E6F1738753986203F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
MD5 15b32961d6a7ecf7cfd3ed499d358e3e
SHA1 589fb245bb41b29e13242bd8947dc01c5b630829
SHA512 3a094a8184c961e25b25654d47755c2deb772e3e1b40c8e2d156493c5e3abf0dc6eed344ee5135af14f7c22f3d3e81b8799bc96aef8baa0b1a851cef7f08b753
TLSH
T183D09734A536AA91E01A813504A0360021260133359BAB8321A0840C89B000092F6DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85a1433fcdbb27a208904c84be795a4cb9b8d73f1289521f1e2d6e1b09cd28d2
MD5 705e56e35a897c2ba46189ebd819e6cc
SHA1 08b32e471a6b948cd1c888e40bc3f603873cd6bf
SHA512 6541c42b52dd461d53211e17229a22e809bcff94ecb21c4f8c407f593adc46b885109cc2e77ce21b5fc256f2df7354cec352aaa9fb2d29c72499a6daaea2b880
TLSH
T186D0A77DB5169602D946817254C537503333043138EEEE63A1EAA40C5AA011463FA5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

7fe58fce-4866-4061-85df-c6fe97b9b32d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fe58fce-4866-4061-85df-c6fe97b9b32d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 ef5cff04f1f83dc09c76aa3021e68c5c44f6cbcff7f701f0368baf509b1592fc
MD5 0fe63fd95cc5c7e99183f9e8cfd2ac44
SHA1 89b95d0a77e149c27512f3878aaebe77a8ccdbe9
SHA512 fd063d108db2b5bc894fa976b341ba6178643bbfe5d40ae6904d2bbb586bb8946182f4b1bcd9a52e11bbcb721d0a89cc6fbe6d3212d278755617b2b414519dff
SSDEEP 192:/OixmKlaLm3Z/EmNS6oV0Y3jYrfNAGQRSl4PNXXGUmiz6hORXzsnGIPQh:WSj8CZ/EmNSSEjYreGQR6gXWriz6QRXr
TLSH
T1E3020BA4B5A68BE8CB64447D05D07A9931F6815F8063AE7FEF111CB6C8B2FC068C5397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82a035a3a35fe94a6795a98876edb553de2b694069247112c49064f856eed2a4
MD5 88158d7cecb1645375b1848ddc09f457
SHA1 a2f4254cdb1879ef169d80accac388ab7aea7d82
SHA512 d97b77274ad1f99c4559b39c21e00b66871cb8f9f82b935ed06c4aeb148d0c1a00927d90933f0b4f835ff90abb77be143c429c10a059b06fdec9f918c26aa792
TLSH
T1DD7141C233551781C7E814BE45E1B75E32F7425EC593EA6E82A0ADB68CB6FC01CD219B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d2f02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5d2f02.TMP
Size 3KB
SHA256 e7f35180fb83ab18fa38c87aaf8533af8624903e901e4c2af40f6572dc1a0faf
MD5 5eb788864889e2cf9ac2a49b6f5161ea
SHA1 87810baf1c3b231059ac9a546ca34a6bd489bfd2
SHA512 ea7d8595fda2d2833126f456110a40ed719e7f8619f4d07c0cc081f13a800a2fb267e8f9c785de0f784c7fe786ead882c32ec986e898dd587924632194136747
TLSH
T1BF611CC233611780C7A918BD86E5B74D32F6429ECA87E95E8090ADB64CB2FC12CD21D7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 afedf9d6476771fdf7886a4fa241107120dd29942a766817d10a0ca2986566cf
MD5 a1a045b9134d9de95952dd84699adf55
SHA1 398c1f5507729be86d4fd2f356045b39f3c3cecf
SHA512 48508580d575b14044c774fd66ddac80f21371cb904b2754f6fff5d38799b86799b34d49fe58948ff92dbe6fd844362d48ad0e1d0412d0c8d95561562bf9d070
TLSH
T1A46190F747B49A6EDA1196F4EA086F2F8F180421435C789A85D0AE27D3F3461E141B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 117d34cafd46a04ca5562b6b3350a20fa55448da65884d6ae1dce4ac188f6ba8
MD5 1633a5034d7e577561101e3caa40b94d
SHA1 cd1c98cfbd2561d6631a4d18e562f66ae0ceae92
SHA512 ce17720ab04fcd727cc6d7c458094b5bb87c0a76ebee67d3ac8b22820df5ec8412cbe9ed2dfefd6490a98a4a9db1ceae1afb86393d2fbe7852fab14cec917ab0
SSDEEP 192:DBZatyuhaVaZjhN51yIxiJa1uMlkO57HCT/3ttwAiGg4GShC:DBZatyuhaVaZ751yIxiJa1uMlkO57HCK
TLSH
T152E19CF783F5866EDA1192F0EA186F1FCF1C0452436C785A85E4AE1793F2471E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 fc4bfb25059b269e13f99f2ebd324b0c6ba44adb68b9cec37fb666c5034cff51
MD5 f38ffecaa2d6fc95ebec6f92c52cacdc
SHA1 780a13ed19047be4bc4fc7b3e73dba691d40a910
SHA512 07b47ea37c8b83cadd19f577cbbb0ad45a1fe3cd9438a2a7613d59e864b087cc566e36abc603bed610165cafa05501ee529fd73aa95de5b6407e043cd027b317
SSDEEP 384:sxRKtLm4H/fhsIWvKd8nPq/5CZDAQCXWqjNB:s2Lm4H/fvYKd5/5CZiWQB
TLSH
T11A82E8526424997B9CC7E619FE25BF22E7F9106398D15E49EBFCC91C00EF6ED2202847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f75d6bd0a6e847eb9904423cc7b283e3e29d310816be96054f78013ce5b6ea05
MD5 1b7a41bc2485996ffc9467efe3731cce
SHA1 edf7e4d873c4bc9f80ecf7dd85a2a9444140e7ac
SHA512 ef45593026a9921972c64527f56b070b51e4548f0f4515a1309bae22a4c9a4125a18227d933dd3b18b8386366f4f66d0412f0766fe0f79de0471e9d9ba338773
SSDEEP 192:sxRKERvbH/fhsvIqZ9zoD8pfa/g6+WN6JO/UE6qMCifuOxGGIgV+J:sxRKEdH/fhsvI8Zy/5r/ubM
TLSH
T17842E8166978A93B5CC7E61DBA15BF63D3F91032A1D11E44EBFC8A1C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c3612c82f3d1b19510eb1d89117019238dff7e43f963766d5c3578f7b868fdbd
MD5 50433b0ad427b8d3321440ce223f4de1
SHA1 aea5cf5872c311f615dfaeba180dbf12e3410f68
SHA512 95dcd0232c8ed7e4fcb85864497836c3fbfea031213577ee67b11220368083a24c49c687a2ca66537c8671bfaef5d3431e28746012dfc286f98403533af35786
SSDEEP 192:sxRKtRvGPH/fhsQdqZNb3coD8pXPa/g6+WNPUKJCfXUE6qMCR1uOxGGIgDL+J:sxRKtEPH/fhsQd8BeS/5ZCXXbS
TLSH
T11D62E8166964593F5CC7E66ABA15FF63E7F8103290911E49EBFCCA1C04EB6DD2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6ef69f77dfcb746055830bc1bb0f7203e30d0d16729df330537fe693091257f3
MD5 ec706fb3e759eea2d93d7158211bec32
SHA1 939094a125f0188e8cb66d71229a10da6ebf4ec8
SHA512 67bdc67028b90e0f9726de054c4eaae2e149c596a1d61af19e246f80956b5a1d593d74a410db9164b5357a9dc721c6fbb24e8f57bfb85b8a471b5c14a3777331
SSDEEP 192:sxRKtRvHcB4H/fhsQdqZib3hVoD8pXYm/a/g6+WN7umUKHnwJCfXUE6qMCLW1uOD:sxRKtBm4H/fhsQd8IPM/57XQCX9IbjNB
TLSH
T18D72E8526524997B5CC7EA19BE25FF22E7F8103298915E4DEBFCC91C04EA6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e964aa475fd92300a60faa9d797ee1a94b30f5819d6a13318e94f58dadb0566
MD5 c5f81e7efc13f5e01d901c98fdea1ef0
SHA1 dedd460d2bfb2198dd15941e241a73bf03721537
SHA512 47a80c854e4c2c69432274df1ba8b459b8dca0c659cffd62b2e2f125389e6438b917bda1f7f31a7dff397bcf3881facccd295818c52c0c673e4935d7a71262a9
SSDEEP 192:sxRKHRvOH/fhsQIqZ9zoD8pfa/g6+WN6JO/UE6qMCifuOxGGIgDh+J:sxRKHQH/fhsQI8Zy/5r/ubc
TLSH
T1D642E8166974A93B4CCBE21DBA15BF63E3F91032A1D11E44EBFC8A1C00EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d23e0564faf107fa8cb32eaab828e7c31250ef31c0bf27b14a60dfbfedb6f48
MD5 74fca530611b2ccf20713591d770b48b
SHA1 d32f5ff857aa59ebafc5c7c7fa3fee58633f765c
SHA512 3b81cea15334d7459e84c7f3e4d5e8c84bc5eb88c3700eb775003e85cd5a8f6a998aad2b279c34401ba1e8646211913c7f991484a2de5e3599b2937689559f8c
SSDEEP 192:sxRKHRvOH/fhsQdqZ9zoD8pfa/g6+WN6CfXUE6qMCD1uOxGGIgDL+J:sxRKHQH/fhsQd8Zy/5vXtbS
TLSH
T17F42D8166974A97B5CC7E61DBA15BF63E3F9103291D11E44EBFC8A1C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 cd63fac6ba4c1ac1eb3efedcd9c3336dcbaf98aac20eae94372567724ec6da3a
MD5 6d15ea082e8ca50d7933008d504a90fe
SHA1 b49ade2c61308eda9c8c3c8c8161c7e72ed43341
SHA512 389f7dff3af46af0d3a5862169635189938c7c0e7f5b9e2e682e4c108540e48a5de1bf0ef4b271e31ad290efe470abbeaa0a947ae410a85a89aa16658f65b02f
SSDEEP 768:jC+v6N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgw0QqcnroZb:jC+v67E7JQWgQ+f4+u1ja/w0Vc0N
TLSH
T1DDD2EB7B640DCB7F4F804ADDED197E9E6DA802CB5698CD4047FA841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\15a892f5-34fc-4b2a-b5b4-e7bebd2e6f36\index-dir\the-real-index
Size 360B
SHA256 e70400e0897b3e9ef62aa3eaac061df2d8ae366192d0d5e9413528c10791b493
MD5 efd88312c4479569f9b294d8adba251d
SHA1 ac14648bd5b22888264cb77b9f954d673204cd93
SHA512 f600c60b139a9ffe5869ed2c72c236d59d2fbc781c1cde379d9634a2238f0c2cbb221044074b6e82bc6b994c6c1678f0f0d544d3efe364834b6ca0e5a6d184b8
TLSH
T107E02B8A9CD24907C9373C7A0A77642E333B05FD2905AF6760FE502AA655A7C4642609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\15a892f5-34fc-4b2a-b5b4-e7bebd2e6f36\index-dir\the-real-index
Size 3KB
SHA256 3451634def791510c95e1ce511b0d08ce50debfa4e657bf469ee790a8aed1849
MD5 7d45889e275fd1630e041541a3e23da4
SHA1 ef4f8038c6910f7975666cb15e3a48813d963b5a
SHA512 2c58d545318e77c8ae6e1fd54e68a7170930ce8aed0aaa5a9867a4df66071a77b5c7285419c36a260bb0903519b741b5800a5cd094231363c510a0f92e92142e
TLSH
T110511A8E0C451D5DC96E50B35CFA0881737A3CEE9B85D907269CD230B8C333E2D5821A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e4f66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\15a892f5-34fc-4b2a-b5b4-e7bebd2e6f36\index-dir\the-real-index~RFe5e4f66.TMP
Size 360B
SHA256 840417d2df6f3796c239d8acd0168c74c8595bb76ec1a07a6fed9671e29b5b24
MD5 6bebf9a21f93d6dfc42aca87a58a13aa
SHA1 631cc4015b879b75059aa1f855a29d7e6a88777b
SHA512 6f73687ef2930f54239fb3870acd80c10e81cb60298caad2a2670d053635e2d5a6b664b2b9ceff1ed4c6c9a16488a500101c59227a62de5c312fec0b02c049f1
TLSH
T185E02BDB54D16E62CA2769391906A11A333F08282505EB1A10AE945F55617BC894660A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\90b154bc-44fd-44d0-b8ea-0f536c096a1f\index-dir\the-real-index
Size 72B
SHA256 2866ff1f97db0fd781d65886d1723d49f58ac09730b9c4f3a7c097d4a52d9196
MD5 e02bc92ee8388c490a26a4a746462088
SHA1 e2bb586a39ed2aebd169632954eb9907f231c6f7
SHA512 7b68ef98c79bbef278623f50a6418c682b6ee2c1775c0bc1f7fef5a6fc5d49aa398b29f1f411363c20565053217bc301012abe1bb022be156100e0ba7b49b041
TLSH
T1E5A0025902C0C611C14616F42DD6C15276A489502302579DA5D00084CD505CD45D151C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\90b154bc-44fd-44d0-b8ea-0f536c096a1f\index-dir\the-real-index
Size 72B
SHA256 cabf0eac0c8bb0b2b1a4fc605e7a000e3f83d60b3533a4186b5625655be9ae02
MD5 316349d6dcfc5fb6885768449bec5c95
SHA1 ad34ae3eca2a454b3aa9da3f37528b8f82b0b11f
SHA512 e0a9a4077eca0c46db93401789f328285242f4150b06a308ec6bd15dff6ec93fbec14b25d8c35acbcca23d7fa6b82f50dce1df77e38a7a65058015cd36a08a34
TLSH
T15FA0025113C4120BCC5611F615D3127917008921B100164641921284CD508F086C710D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 09023e5396338eb4ae172ef8e24aa299780003227951214cf687bb1900183cf4
MD5 910efac954cc4b20b968300deeda2262
SHA1 167df8fbbf88b51efd8239ce31c352e548f018b5
SHA512 b2a1e9142e1692d426a404a46556585222a81ee35eb39486f41ae961d4c324fcdf83fab076bd79222890d8ba280559bf4823f6d95c6a9f62cb243488497448e9
TLSH
T127E0C0B72FF73858FC9F83D5103080700102B5988548FD4F105D92C750F2362349ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 53e82860dea613fac4fe1725fb559b3f7127975bb932294f148a03303ce80ef7
MD5 f52fca6f4235e5a0d7c7b94def0e9a28
SHA1 f48b655fb72c0fdf1c4d140439a0ec51cc44e022
SHA512 68307860d101ca5dea17365607d830cb4a4dd61f8e8f18946ac380c661f4f986c680737fc796e39989fdb3bce597c526f6f1d173a0e76e6dedfdc36aafaf2af2
TLSH
T17EA002509D49A119E80107B110F5A3C8336158ED02551201ECB8B4B88C9164052D1601
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ea9f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ea9f9.TMP
Size 48B
SHA256 6601a786ad264da1d3da759becc6fc9d2510eb06088ebd7faaca2eb2af8d9ac7
MD5 2047b8ff7744eff23e25bba06b1f7570
SHA1 eee7c24f07dfcc5a4fd763ff8042746c0aefe20a
SHA512 8b429c4107087cd3e5d13e05a948afaa8baeaef03e123626b7bc049b461cc38577e6eedd53049e1e55317bf2a5ee5b43ae93d6d9b0caa42ee68270949a61d90d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6d98d016e66ba7371c362baf4d677c4d73cd06d844aa5301a446e6a1c2b48de2
MD5 6f57a12435ea1f7d27b4cb60e0808343
SHA1 135564b92127a8406b161be88a558064179d5475
SHA512 8a24ccb74df0c73f4a96e82efe4c175d535019663bdb4813fd73b0be903f29090298535f3539221c7e78e9c657f708320062c25e9c8f5887d8ea71cdd980dca5
TLSH
T1D9A0022443C00265C05907B52191434067A05D10A152820F709160E4DDA11815D25010
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0b5d00e7f3106f03e46c94101f7bb066921f421f0dd2325ea824dfe82d646e3
MD5 797ba5454a8652a47c35e70ec93caaf1
SHA1 ee4aa67c1ed1a37a93dcebe37231c8308312dac6
SHA512 11802c87a338328022c38273ddb1cdae3739790c17f130ed962bd2a296195b012e063b17a03341794923e6189864bee89770816906f46718cd8d8b22440b543d
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOCmEKrKuCHSKoM7z:CbEBVj5JAdSp9/EgTK7j6dJOvjNO
TLSH
T17591134435BF02053C3E650CD0B88E6A469170A33425B66B7BA844764FAFE456FFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5da5f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5da5f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 26f9600569af827c7864a6c382d5e698069671f440e0fb05920dcd4227d1564a
MD5 8d57f676f11d85b5f9378f9a6e5d11e9
SHA1 334ae724ae08409aca1b4e01201b9e5d205d6e5c
SHA512 94114fa3b2d5626b88a7030e25b8d68d36f88af68637e496b81df6d230700098fb4de92b3b6f10858c27b57cb57b0abb43daf49b22ee924a77a5732c5e54d5ce
SSDEEP 768:Xc3aAFBwup8+p3bd66j+4BRv86aLIWAPi9Pbtb:Xc3Ao8+p3Z6n4yuPYtb
TLSH
T198F2AFB1F8A99D639CF9D745B2563743AFF411A3A5C00ED4E5DCAB0D008725E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5eb6915e635c05af24cc5173bec322e320c6d5b4dc217c167dbe2979684f5e51
MD5 7146f98f6c3638823b8f93ee2b40e60b
SHA1 5e30730394ebe67e3b21f80208fba5c206bd21e3
SHA512 3c89a8fa16de3f95e7eea57e567dc2a88ae59736b71df65815177eb7624a96ecc049e3d28e1964993cf252853d1b599048338d4fa70984fef432578098df1d1d
SSDEEP 768:nc3ZAFBwup8+p3bd66j+4BRv86aLIWAPi9Pbtb:nc3Ho8+p3Z6n4yuPYtb
TLSH
T1BAF2AFB1F8A99D639CF9D745B2563743AFF410A3A5C00ED4E5DCAB0D108726E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 44c6724f9367672ae9699ed1f3d16e62b73128b705e042a9326aa6d3252c6f3c
MD5 a8f44c8c8c06398edde2bd9ccf453deb
SHA1 8a665a213b59b749d1f68b785637acb39afbc85a
SHA512 51c351f519e02a203e67019fcfdcccedb56867ddd7b8e4fcfb2bf00a90014b9134decb91c9013f06844a690280e78cdb341ac34ef4dac2f62f162d1709a97c24
SSDEEP 768:Irv+4UNbdD3ecHNp8+p3bd66j+4BRv86aLIixM2bwCl1:Ibsbp3NL8+p3Z6n4yDM0ww
TLSH
T1AE03BE33F8A8A9739CE6C644B24A7B437FF851A396C10AC4D5DD2B4E415A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 665f26907adfa9761c922a0b3373e898af83949bdfff6ef3a504ffe44f4e5f98
MD5 8d2d6bb10f7a835038d76ff066fff0a9
SHA1 c152b5bd0c02a6874c1c44cb7671ad737dc54ffa
SHA512 47272c36868d581b040f8bf77c6b07af31ed6db21f4e42db66bd68e6a039a6ec858df030e0b35e5d28b432c878a4536dd8d3765a662d51be4b8c09f87a5d17bf
SSDEEP 768:Prv+4UNbdD3oPBwNp8+p3bd66j+4BRv86aLITA2bwCl1:Pbsbp3fL8+p3Z6n4yd0ww
TLSH
T1E303BF72F4A8E9739CE6C64471467B837FB811A399C10EC4E8D96B4E005A19E370F937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c9583240916aac2fd11eef3282c50a068524fc7fb09abc17e8d84f0d599d7157
MD5 560d99c3047e200098447eee342df8cd
SHA1 87a55d1c2d2cff8cd9f0d259e2f13836dfacf65c
SHA512 92928e671d0ca5b16996079dc4901d9c4e5c27e67bb879f50f406b9d27ea8c678168be95581515e68ee3840c3e26e049e3147a89e749d44b009da13eeda94a21
SSDEEP 768:lFQz3Wwg2O6sqp8+p3bd66j+4BRv86aLIWAPi9Pbtb:Ez3L8+p3Z6n4yuPYtb
TLSH
T1911318F198D78976D8AD8787637D2E429EBCC063B5844994B7C85E0CCC861BFC70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 7a5b5440a5027fdc2905ece0837b1ad9349088dfe1a5da5366bf8cc03ea103eb
MD5 60aa1df215d98dfdd45ac481a31e4a47
SHA1 4026722891ee808bf1d1fee97b7003912dbbb0bb
SHA512 dac67b0b6124874f73678f3fe42865286be819f95b04f9577a3248c44d560bf5ccffde1cd9bf6ba2970e839b9e22a1f61c8c8990a7034c73f4ae196c5bb388d6
SSDEEP 768:lFVQ3Rwg6nu8skp8+p3bd66j+4BRv86aLIW69y9gDPi9Pbtb:BQ3g8+p3Z6n4y83DPYtb
TLSH
T10833C2F998D7893AD8AEAB47633D2E1299BCC173F5A44894F7845B0CCC6207FE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26f1e59262a7bbb296dd4eafbc427875032eb443bdfee014996e48a3f2e44c0b
MD5 935633a3eee1bceb2cf2bbe6667091a1
SHA1 abb5a48f794946888a60571d3b28085f1c8e6e80
SHA512 74a90f02c5961547d362d1a44203c72ce1d796b1b561afc329f38da9a450df76841f8fdd4a137acdd92f091135b0eceba536515bd36489f7d1d93cb59c76716a
SSDEEP 768:hrv+4UNbdD3amFBwlp8+p3bd66j+4BRv86aLIWA8:hbsbp30z8+p3Z6n4yu8
TLSH
T18303AE72F8A9DD738CF6D644B1467B43BFF820A359C00E94E9D96B4D019B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 90f9a3d7023a4911e1c99fea9cff4c1715d4eb8f90e10b80769608a04631a079
MD5 b60cf910d8466030c18cdb670b5c8b30
SHA1 a881e270a62387817f9d65a1174328fad974fd8e
SHA512 8b14d95abab8fe4f4a64aed55be924c23f0229fbda48769badcdc132ce7ea4238d06ff66e6f68af1deff802c956346dd05be4dc068aa07e46a0c29b2ec03b81e
TLSH
T1F7E00243930000B9C03C033001C75A6329EA802015F302449A21035C5C233002B34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0953499824b0f11247f33dd591f0e2e616933259116123fe6665a67483bff5e5
MD5 2bd1d1cadc52082d5bb00d28dc379122
SHA1 d9254395cc67e72dba4ec27f5bbd4092f56317ec
SHA512 cfd5323e5321a3d86f252c8c673b50ee732ecc5651a73c214bf918428bb19f15abeb6bf3630e8622722b5a4c846a1e8fc3e613b095d0c9fe47fbda37595c86a2
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ae7fbc5fda1ad10277abf1a261505e0e9ccb97093000c73c69989d1ebf896380
MD5 94950d2a97f19e04a1f59875015fd466
SHA1 3d62f799c2e44a81a22360f3a3782a89d4a96a5f
SHA512 7b76ee15cac8f44a7e42abdcf9ac1170188a8427519c8d28fbc2060f00f5747c3ec95bccf500aa64935b99c37b72b9ef4cc1a51a9bf43cfea790030837a9e8b7
TLSH
T1D2E00443D3000075C03C033001C7155335DDC01015F30344D510035C5C133003734FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5e6649.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5e6649.TMP
Size 392B
SHA256 a4f1fe81f2b465d15a668d02010e50c4fa5b7fbe6fcc419290f89857b3efcac0
MD5 e10d3df6d7a3e422509151a2fec5486c
SHA1 22aabd09daf22d7267647e1d72a0ef5f10e27156
SHA512 74e95b561e32e5d9420215f13b2d84189c585a4e858f2e4bf77e4b39b6ccc247216e6d437836bdbff6df9d995a3a1a2a4689844626abaa0bfb1c069955a85436
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7fa00b29-82bc-4e05-8909-b58a0f8302e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7fa00b29-82bc-4e05-8909-b58a0f8302e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_209974914\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_209974914\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3476_796240289\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RiseLauncher-NewUI.jar.crdownload

Path C:\Users\Admin\Downloads\RiseLauncher-NewUI.jar.crdownload
Size 207KB
SHA256 9504565eafc5fff1a030d37fa8c8219da85f34d1ba0b19745180e7a1fe932d8e
MD5 8f79fd0cd9ad1eeeba92e56837fe4978
SHA1 89f2df128d5aa0c01e1715aec4195807b59af98f
SHA512 bbb792244501c6bdaff13dcd1ed59f1e51a6c3495e0681f2356c730fc7f1eeb3034f114194e707442e8b6996fb0857d88823bd2c2db6513e97e8debbbc38e12e
SSDEEP 3072:IZwBlxtCC0yXiYeO6WB+OTBNCK9lc+xdmM2gCb39yr+LsC0s4gWhceku:IZMlWCPV6kGKjR/R2n9yFC0s4Tcet
TLSH
T18524F115BE96D819C08B713A10318693E268959CCA5CFB2F59F292C5CDE058F3B427EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2692-2-0x000001EC6E1E0000-0x000001EC6E450000-memory.dmp

Download

memory/2692-13-0x000001EC6E1E0000-0x000001EC6E450000-memory.dmp

Download

memory/2692-12-0x000001EC6C850000-0x000001EC6C851000-memory.dmp

Download

memory/4648-2021-0x000002360A2C0000-0x000002360A2C1000-memory.dmp

Download