9a657c1ba47aac368f59d668834b3a27b2c762295c8dad8a338bb6e90565f26e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ParseMEUploader.exe
Size 149KB
Sample260816-m933vshr7v
SHA256 9a657c1ba47aac368f59d668834b3a27b2c762295c8dad8a338bb6e90565f26e
MD5 e88d03c54c893e9ef38e84cfbca19482
SHA1 40519d133baf6a596d21496b6fc81a85514c66f5
SHA512 4612fde73689dfee322f75b2083c953bc267f396673dc48fd2f6fb2dcf3cc65bca6308f1ead48d04cd0f92b8feec5aa2f52a0bf7cf8bb4d230c66bb5009db1fb
SSDEEP 3072:MiRnf5Lq7cgXB/aI+2USHziTCIi2V57fgD9WTy:xf5O7cgXB/GSTin69
TLSH
T15DE35B90B3ED5072E3FED2B9647A0211727A7961A806C61CF9AA50DF1D31784C2B5F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2560	ParseMEUploader.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parse ME Uploader = "\"C:\\Users\\Admin\\AppData\\Local\\Parse ME Uploader\\ParseMEUploader.exe\" --background"	ParseMEUploader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_888908505\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_902549701\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_902549701\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_1178111887\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1003171666\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_17287305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_17287305\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_1178111887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1003171666\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_17287305\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_17287305\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_1465075037\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe
6008	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313522685845254"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{093A243E-C362-4BD9-B4F9-BDB23F1651B5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{61C33B80-8DFA-459F-B525-F114AD2D0EAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1996	ParseMEUploader.exe
4132	msedge.exe
4132	msedge.exe
6408	msedge.exe
6408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
4132	msedge.exe
5344	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	ParseMEUploader.exe
Token: SeDebugPrivilege	2560	ParseMEUploader.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4132	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2560	1996	ParseMEUploader.exe	88
PID 2560 wrote to memory of 4132	2560	ParseMEUploader.exe	90
PID 4132 wrote to memory of 4644	4132	msedge.exe	91
PID 4132 wrote to memory of 1384	4132	msedge.exe	92
PID 4132 wrote to memory of 4880	4132	msedge.exe	93
PID 4132 wrote to memory of 1384	4132	msedge.exe	92
PID 4132 wrote to memory of 1384	4132	msedge.exe	92
PID 4132 wrote to memory of 2760	4132	msedge.exe	94
PID 4132 wrote to memory of 2760	4132	msedge.exe	94
PID 4132 wrote to memory of 1264	4132	msedge.exe	95
PID 4132 wrote to memory of 1264	4132	msedge.exe	95
PID 4132 wrote to memory of 1264	4132	msedge.exe	95
PID 4132 wrote to memory of 6036	4132	msedge.exe	96
PID 4132 wrote to memory of 6036	4132	msedge.exe	96
PID 4132 wrote to memory of 6036	4132	msedge.exe	96
PID 4132 wrote to memory of 124	4132	msedge.exe	97
PID 4132 wrote to memory of 5920	4132	msedge.exe	98
PID 4132 wrote to memory of 5224	4132	msedge.exe	99
PID 4132 wrote to memory of 3332	4132	msedge.exe	100
PID 4132 wrote to memory of 124	4132	msedge.exe	97
PID 4132 wrote to memory of 124	4132	msedge.exe	97
PID 4132 wrote to memory of 5416	4132	msedge.exe	101
PID 4132 wrote to memory of 4008	4132	msedge.exe	103
PID 4132 wrote to memory of 5920	4132	msedge.exe	98
PID 4132 wrote to memory of 1752	4132	msedge.exe	102
PID 4132 wrote to memory of 5920	4132	msedge.exe	98
PID 4132 wrote to memory of 5224	4132	msedge.exe	99
PID 4132 wrote to memory of 5224	4132	msedge.exe	99
PID 4132 wrote to memory of 3332	4132	msedge.exe	100
PID 4132 wrote to memory of 3332	4132	msedge.exe	100
PID 4132 wrote to memory of 1816	4132	msedge.exe	104
PID 4132 wrote to memory of 5416	4132	msedge.exe	101
PID 4132 wrote to memory of 5416	4132	msedge.exe	101
PID 4132 wrote to memory of 4180	4132	msedge.exe	105
PID 4132 wrote to memory of 4008	4132	msedge.exe	103
PID 4132 wrote to memory of 4008	4132	msedge.exe	103
PID 4132 wrote to memory of 1752	4132	msedge.exe	102
PID 4132 wrote to memory of 1752	4132	msedge.exe	102
PID 4132 wrote to memory of 1816	4132	msedge.exe	104
PID 4132 wrote to memory of 1816	4132	msedge.exe	104
PID 4132 wrote to memory of 4180	4132	msedge.exe	105
PID 4132 wrote to memory of 4180	4132	msedge.exe	105
PID 4132 wrote to memory of 1388	4132	msedge.exe	106
PID 4132 wrote to memory of 1388	4132	msedge.exe	106
PID 4132 wrote to memory of 1388	4132	msedge.exe	106
PID 4132 wrote to memory of 3024	4132	msedge.exe	107
PID 4132 wrote to memory of 3024	4132	msedge.exe	107
PID 4132 wrote to memory of 1184	4132	msedge.exe	108
PID 4132 wrote to memory of 1184	4132	msedge.exe	108
PID 4132 wrote to memory of 4804	4132	msedge.exe	109
PID 4804 wrote to memory of 2012	4804	msedge.exe	110
PID 4132 wrote to memory of 4344	4132	msedge.exe	112
PID 1996 wrote to memory of 5344	1996	ParseMEUploader.exe	113
PID 5344 wrote to memory of 2916	5344	msedge.exe	114
PID 5344 wrote to memory of 2932	5344	msedge.exe	115
PID 5344 wrote to memory of 6008	5344	msedge.exe	117
PID 5344 wrote to memory of 2932	5344	msedge.exe	115
PID 5344 wrote to memory of 2932	5344	msedge.exe	115
PID 5344 wrote to memory of 3504	5344	msedge.exe	118
PID 5344 wrote to memory of 3504	5344	msedge.exe	118
PID 5344 wrote to memory of 1140	5344	msedge.exe	119
PID 5344 wrote to memory of 4988	5344	msedge.exe	120
PID 5344 wrote to memory of 1140	5344	msedge.exe	119
PID 5344 wrote to memory of 1140	5344	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ParseMEUploader.exe
"C:\Users\Admin\AppData\Local\Temp\ParseMEUploader.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Parse ME Uploader\ParseMEUploader.exe
  "C:\Users\Admin\AppData\Local\Parse ME Uploader\ParseMEUploader.exe" --background
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --disable-extensions --disable-sync --no-first-run --disable-background-timer-throttling --disable-renderer-backgrounding --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" "http://127.0.0.1:49842/"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffbb0b5c188,0x7ffbb0b5c194,0x7ffbb0b5c1a0
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
      4⤵
      System Time Discovery
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:9
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:9
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1168
        5⤵
        
        PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,11789080921229701675,7374837422022895919,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
      4⤵
      PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://learnmyparse.com/downloads/ParseME-Addon.zip
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffbb0b5c188,0x7ffbb0b5c194,0x7ffbb0b5c1a0
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,13908533121771965519,4864830518087957451,262144 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,6260375291364936809,11934415084503341319,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,1152533348433460407,10520557810717243747,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,16839596178147698102,8053829247317838482,2097152 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,11714027682283596615,12618982538659354826,2097152 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,6754147925136664401,11015336243892974420,2097152 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3132389802526014951,15651936249450497092,2097152 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:9
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,9853963303716204082,13119648682393106603,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,14198421756986628197,2201854975781640958,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12919138579694793015,3434377115745525392,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,13584592876072046528,16411666148711878651,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5992,i,13312728033668902450,16717952579415225788,2097152 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,3464171025016114520,8774267921364652197,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7873381135461602295,5337260994593744537,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7873381135461602295,5337260994593744537,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,626509088597092093,14437180806670763320,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,7071496566688626539,8035568072556095880,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,11754832346195801737,14385690985943681167,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,5765464894853723359,6878835349908169227,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12410434679953090854,17113729884949837173,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13910597437572896521,13684413205815957891,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:14
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10112978975456129798,5167931705204312590,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17038372373650839022,15432733891439290861,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,12896575424185897061,10859826908369089371,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,10092528753408056167,7531733035398733971,524288 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6384,i,7644137240538861425,14021737434690637245,262144 --field-trial-handle=2112,i,651890289614313717,7871131195172380640,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dc32c44cbf4865f8816556051b4d67f7ccb1a3a8004ceafc454b442651496b46
MD5 a8822c2a97f1ba8a842d4bb3ad312622
SHA1 5e764a8b076b030171c5e1552182376862c43872
SHA512 ade66bdf73221572a8ef8c49270194ea2a0a92ddb9e5d2caeec38c5521ead39b2fac559d3aeb796751adc4842d624f0618cfc2c76247e362dd3ebdaa2eb4b9fe
TLSH
T10C51424683F996EDD775E2B552E286B53EF6BC3A83071E12A058ED33894AF1B50D0017
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8500.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8500.TMP
Size 2KB
SHA256 3c9780c6f4865f38402ba7602ad12a48eb39c7cae5970985bfa5a8c8c7c15545
MD5 06a5948221a8a096edcf8b46dbbb8adb
SHA1 2c10297f567876c64cf72cea68ef58a152d26f56
SHA512 6749d397849b6534b0737a27ee65ab1b2299133e5f9f943940322623a0887c7c66682c511c425331c00646f81c67715068e6d0f338313f0452ef83c39c9ef0c6
TLSH
T11451544643F996EDD775E2B152E286B43EF6BC3983031E12A058EE33490AF1B60D001B
MD5 SHA1 SHA512 TLSH

Submit Download

c22c91b8-732d-4f9a-854d-e94d90132660.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c22c91b8-732d-4f9a-854d-e94d90132660.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ed7737-9b09-4cef-82f5-fca15436f556.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\25ed7737-9b09-4cef-82f5-fca15436f556.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 40ac97e5d6e36aa0a9e003d4be6feceb98696a8a357d2aee39380045f63a6b92
MD5 f7fe08f0644565f65adb7fb7cfcafc4b
SHA1 0d4efc0f2eb03aa45375390251a547c29e0dcaa8
SHA512 497be6d33f252fc8a000e2ad836535f7ca81e4f3b0175c047486be8338c1bf95669bd7a0c46f6d0f702f320563763951ffa6af140e62107f3befcdc827d174c8
TLSH
T13351AEF383F4866D890196F4AA146E1FCE2D0915432C7C6AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 794a4b61fc6ddb54f6d780520573ae6e9e9987e2f1d5bca966610b714ea02da1
MD5 c391f5a0d2de9a7c58d00063faa103e6
SHA1 a0976a375a14b284fe159f34b88a0e669b1a330b
SHA512 8273027840f5749ac71bedf895e142cad51b60381b7d8734de6027b239fc71ca7676b39a62c536eb252744ba6a9e05eee0c2d02985b161ff9120a525eff71651
SSDEEP 192:sxR/RMTQ/f3s7+TvdZczoA8pi/g6+WNIYZFLErcGeIgVHJ:sxR/wQ/f3s7+TvTNi/5ISVr
TLSH
T1E632D8156968A93B5CC7E21DBB59BF53D7F95032A1D02A48EAFC960C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46d66ec194ca574e192b5e20cc401d9849d6b0adbed8a75efde08f0e891e805a
MD5 7ba2f2da3a30574707e34203f015bd4b
SHA1 1de14a5ae7086d12e76b3b17c1765154681eec96
SHA512 dd0aac0bdc642ae84951a10f4f4963bf8663e8abbc1be23264d45bf3163069b2f43919b64785b6053d9e12fd44caf1e605b1a4517726aebbd46068560f044be6
SSDEEP 192:sxRcRMTQ/f3si+hvdZczoA8pi/g6+WNIYZFLCPcGeIgDSHJ:sxRcwQ/f3si+hvTNi/5IShm
TLSH
T19A42D8156968A93B5CC7E21DBB55BF53E7F95072A0D02E48AAFC9B1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 22ade435dda48cf340e02427c64f49c8caa8e7a6fa7966dde397e1c713cbb8e7
MD5 b27de91d2a79259000862bdfe2fa8d0a
SHA1 74610fa72e99764c7bb4fb20b9e782029efffda1
SHA512 e58ecac85cabdf74e466ceb232e06596b383c502acaa7ef4f9a2e82865a275ca7b6e8037bedc3e8b93890539dd87ffbfff13de812b697b3aada9d5b9216ee154
SSDEEP 192:sxRcRMTQ/f3si+TvdZczoA8pi/g6+WNIYZFLErcGeIgDAHJ:sxRcwQ/f3si+TvTNi/5ISV4
TLSH
T16942D8156968A93B5CC7E21DBB59BF53D7F95032A1D02E48EAFC961C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 286f0c652c616d7dd37fdcb625a62abba861ef2336ddeca1e3af6550130df182
MD5 6042cfbc7fca3539953a65169ff6688e
SHA1 3a70c9f687dd1f144df1a5efeb4c42daccc23d15
SHA512 876f3a7428044379039d48d381b8eab18e9ebab2280b2e88b6861a55c5ee38d7902fb1d60bbd985abb2400b09650fcc4de710e21b229ada8b0a77036af1a20d8
SSDEEP 768:K80E+67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVggowLWiroLczY:K80E+SE7FwWgNhfVNu1jafgogW5LczY
TLSH
T180D2E87B740DCB7E4F804ADDAC197E9B7DA802CB9698C98047FE841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b2094.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b2094.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 95665be3a03904c467c60f754f35f4425fd0563d23ab3fca1acd5783c5df9ac2
MD5 cb28b096afc78fa32757c92cbac640f6
SHA1 78a269fc64ea542c88acac6728552258fdf591c8
SHA512 8fdeef38b5e39563b7fde8551cd1d44ca6d77ffbfcb9e2387ded23e2d3e69a0405db17b5c46c8859c93450d35f39e25b779f3c9ae9c460623c1745ed628c90f5
SSDEEP 768:cg3DvD+LeSFOUKVtlX4fouOToPvB2thtA9VAgiPi9PK:cg3bsnnwthttrPN
TLSH
T1A8F2BFB1A8E99D63ECE9D394720A33826FF01063D4D05F949EED970D0947A9E1B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d769eedabe39d15daa9e009feb4c408f39308070fd8e780114e2141a5064526c
MD5 1e0e944c5f79bbaf0f77b0bae6207ad2
SHA1 8d74491103684e9b9c49a81447404e8047830200
SHA512 361a69a23c2587fbb86178c1c94ffbcb8c4bd758f601ba523a336a5d040665eb1f893757e7438dd02de34805ec3b57a534f328f2e962f8fd4b8e60dc371ad2db
SSDEEP 768:KFQ+3Gwgfv+h1OUKVtNX4fouOToPvB2thtA9VAgiPi9PK:x+3wsnnwthttrPN
TLSH
T1F7038DB2D8A9CA6BECEAD7C5730976829FF011A3C4C89AD4DAD95E4D00875DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 19a638466725fb55808e1ba74fc0f2187be5a42138c700f901414757c6887427
MD5 cac48c23b47f44e7998e4c29c6738a7a
SHA1 42132e6d5c15f2ffa88ea79c0305eb988cd4beb0
SHA512 4b9b597b1fe0e1050d10bf3874caa20ebc9d91bd3ecd3209197a5f69f0e354434103dff32ce42c4bc850d0caca405cd455776faa82d0183a318d503b8c916f5a
SSDEEP 768:grv+4UNbdH3n++LeSFOU5X4fouOToPvB2thtA9VAwXeVH1SlX:gbsbh3NsnnwthttaEH1Y
TLSH
T1CA03CF32A8AC8A33DDE6D388710B72473FF4516396900BD499DE1B4E069B9DE170BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ba6d20663b92557f07ab60533f63638ae5fa0e2547a9a1adce1663e0aebfffa7
MD5 cb3cfa842e932bfddce0a0d2398d7226
SHA1 7bd6af32f7440bdff1c0a3d4e93be5d5a821e6f9
SHA512 09b1543924bac4301b49a077a64a375d7faa426d0f1d4c7e1290fd4b1ba0d8cb7e861e4f4bc69d3192d122034a4a55d34056129d737d7574ebd499ccc1002679
SSDEEP 768:Erv+4UNbdH3D4D+LeSFOUKVtlX4fouOToPvB2thtA9VAgiac:Ebsbx3Csnnwthttrac
TLSH
T17503AE71A8AD9D63DDE9D298720B76832FF0206388C04F98DED96B9D054B5DE1B0BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 af61eb62bf4cbf6f498994b1d4312516c17b52581c57d00697e15eab02a11d98
MD5 c9529b7bdde7e330e9c36c3c7f420769
SHA1 1afb18e1de029fd32ddd2d5412d8f2b0c26ad1d7
SHA512 07376c3910d5a69cf3ef9f13969144faac90eaef9fabf0ac402db4266cebee0a970ea7f08b7048ad5107ef6e4936cc6c7085400374a87c8d7d63ee14490f5369
SSDEEP 768:Lrv+4UNbdH3ut+LeSFOUKVtRX4fouOToPvB2thtA9VABieVH1SlX:Lbsbh3Msnnwthtt0EH1Y
TLSH
T1D203BF72A4AD8973EDE6D398710B72832FF4206385800F94DEDA5B4D095B9DE170FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3f689434b915ccf05220f727b4273ef29896f2ed0fd4909f175bce7334cecf37
MD5 b5c416dd77589e0a670689e5336f6770
SHA1 65b78af49d58c1ace28a6346bec07004880c302f
SHA512 c7700d06c1f8c854bd5180e859dfca4ee58fdb588da00754275f354d26db10b57bc55c392c38a650f484bcf9da74a8ccbf0dc4571bd99962010c6be74e08a7ef
SSDEEP 768:kg3QvD+LeSFOUKVtlX4fouOToPvB2thtA9VAgiPi9PK:kg3+snnwthttrPN
TLSH
T1CAF2B0B1A8E99D63ECE9E394720A33826FF01163D4D05F949EED970D0947A9E1B0BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0f65e456-a1a7-42c2-bcd0-64e8b22541e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0f65e456-a1a7-42c2-bcd0-64e8b22541e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ParseMEUploader.exe

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\ParseMEUploader.exe
Size 149KB
SHA256 9a657c1ba47aac368f59d668834b3a27b2c762295c8dad8a338bb6e90565f26e
MD5 e88d03c54c893e9ef38e84cfbca19482
SHA1 40519d133baf6a596d21496b6fc81a85514c66f5
SHA512 4612fde73689dfee322f75b2083c953bc267f396673dc48fd2f6fb2dcf3cc65bca6308f1ead48d04cd0f92b8feec5aa2f52a0bf7cf8bb4d230c66bb5009db1fb
SSDEEP 3072:MiRnf5Lq7cgXB/aI+2USHziTCIi2V57fgD9WTy:xf5O7cgXB/GSTin69
TLSH
T15DE35B90B3ED5072E3FED2B9647A0211727A7961A806C61CF9AA50DF1D31784C2B5F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Crashpad\settings.dat
Size 280B
SHA256 ce4db756a494082473b20f4f656950d74e53f1f303b49bb820b5903b598d2493
MD5 296e3b1455ddd22d85e600a764657762
SHA1 499fd7eef2e7a819a4753e18d23e11033078bae6
SHA512 32d386270c7939364833e317515e8dd12283fb8e01d7d21aa654f2ac3e72ccddfff6164fc8a5b4075e80fda6144dca35b9075cb45cd56b62a113ab20b50ccd51
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Crashpad\settings.dat
Size 280B
SHA256 a51fdcfcf1b0bfc29e167ede6df23347e7795ac8b41fabcae96b7b846794432e
MD5 f502bf0ad61436eaa312d720601991a2
SHA1 4f184e2c2669ba4d466e59d76e23334131eee37e
SHA512 667b3349fe8cc5f565ea48abf453c9ab4265bbb73f0b8eb724e4ec4cba3f5226e798a0fbc840473475977fe66e21a4cb22029f31819668864d8a6df41dd23a05
TLSH
T104D001E1F7EA3690E16060362111D3991D98CB390902C2155AF8926C6DF6461A25A183
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1d3abdf3-09d4-434b-9040-eeb638c922d1.tmp

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\1d3abdf3-09d4-434b-9040-eeb638c922d1.tmp
Size 24KB
SHA256 490ac10f7bc8c21a45ba512f1cf4c3e5ded834c976cd677fa1bed6379006be6c
MD5 66436921d108f9913abe72d25dfdde1e
SHA1 8ebae04f35285973306d32f61d4ac2cd401c71da
SHA512 1f047cf27e5d6c12b2de314458ece07db87d52ff75fec596ff8cfe7e9a8227d1f3247b235783a03c86e44155c3cdfcd6fde0506f03cf50aa280ce27401f711d7
SSDEEP 768:wPtL+nWDc8fwq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV17qxZro6I8:wPtL+nWDc8fwqu1ja4exSB8
TLSH
T17EB2E82F604DCB7E5F800A9DD8166F976EA801CBA6548D404BFE995C03CB7EB911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 35c614d013a5beadb1f950cf51c97d0a811ac3440418c1637e0b81e578235634
MD5 a44bd11925f5c986470d3aa54b8a5840
SHA1 9b4466323d83c1b2069c5974f3ae5f4da9ffd016
SHA512 95a212c01cfb9f9da8f67fd3b8db024518bae6107654ce61737f6057cfb50cfe34e903cfadc2856c84d8a71662c3ce5ec390331330a2c2171d513fbfd9e27ae1
TLSH
T172E02E5082E3E084CF20C87D58588C8C302982A302F9E36BC2803CCABC0F6F30240096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5891.TMP

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Code Cache\js\index-dir\the-real-index~RFe5a5891.TMP
Size 48B
SHA256 ab00bd71a0e425c9a569ba44d3c4e1956fd51ddd94548fd43a88756cd462a936
MD5 c8db16b4b208dad0ba585f8bde4b2f01
SHA1 1f95232ae539b94e7916fa6bd2a385425b15dab7
SHA512 a2d4ff91e5fc69ceb0ee4e0989c6ead3903d8d5976920e1ab7f89666e0f10d3615c46115ad411c0a7bce8e95929b07ad880e45041c83dee28b6dbd9f916f200b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Network\Network Persistent State
Size 478B
SHA256 ed9454b2971ee7fcfc5ab9c6b8279184683a6c62554bab3c5d919a6a3038a1b2
MD5 d64e9e54d6cab1c06427e68b6412dcdc
SHA1 c91ee8909ca5cc7c15fd1f6fba22385a4ba8174c
SHA512 e6512ca6aa5f365fb9f9a03d2777c20e45860cee0478fb3ca0ecd2371f97b72aafa4f29b95c4c53e60f32ef35c9692c63210b2cf02e1ecc432a91bb21c39dcf7
TLSH
T171F09EF383E0557E8A0052F05A186E17CE2D0502431C7D5AC5D4AE2B93E6074D10089B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Preferences
Size 9KB
SHA256 f79a6fe6e6cd3a30b7c792af3f25c24e0bc2bda57ad92ad56b67576a782e2724
MD5 9d2d292e690255f4e619347f103590e9
SHA1 23c8b0a1f1bff744c221ab4e5d10e870855ba435
SHA512 5c4ae1b7fd24e0babc40032204f48a420f14e99e26b88e1fbf64e9d047e458a9517bcefd7cb27269a76a5f51658813eca08091f28a7e70399e116ce8f940a2d1
SSDEEP 192:sxRXlSZ/fcsFEo9dvIdpw+/gb+WNvos/deRN+gBJ:sxRXMZ/fcsFEo9dAv/c3/27
TLSH
T1BB12B7066E68A9B75CCBE319FB647B13E3F56065A0C51E08DBFC951C04EA6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Preferences
Size 9KB
SHA256 33b6f4ce06d95b0200a4d0aaa3ab485f0ed1c63c5a9497927871671b747a16b2
MD5 e353bb886584d00a932ecc0fd267b8cf
SHA1 332789dc95dce06a7f7663b388d86616f3ce82a4
SHA512 53485813399958e53be451179c7baca1ac51a6890150fc07a002087ce39078293f808c01d1c317f8b39c0679daa66ea42bfb0910082a7403c8d500576031115b
SSDEEP 192:sxRXlSZ/fcsFEogdvIdpw+/gb+WNvos/declN+gDJ:sxRXMZ/fcsFEogdAv/c3/Fl
TLSH
T18A12B8566E64A9775CCBE219BB657B13E3F5606690C50E08DBFCD61C04EA6CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Preferences
Size 9KB
SHA256 01ea0990ca58cf61ef39f1c7bb784cf13311080dd7cf2f6c30c2ca36ef5c7234
MD5 509f58ee2c4a7428c6a3e63c18f79074
SHA1 0f4b936f1359491a7d984621056d7da068e4656c
SHA512 798f2098f8d95c5361c1532c082ffd9ee5f024c47fd5dc629a0d164a9609d2f23b2f70eafe1d3b0c62da84917314ab1d25155e2f2e9904791fee5a3176795b68
SSDEEP 192:sxRXlSZ/fcsFEogdvIdpW+/gb+WNvos/deuAN+gDJ:sxRXMZ/fcsFEogdAB/c3/2l
TLSH
T1AF12C7466E68A9775CC7E21DFB657F13E3F5606590C50E08DBFC961C04EA6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a4037.TMP

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Preferences~RFe5a4037.TMP
Size 8KB
SHA256 97d879bc65c54b072a81e6149d6baae6da0cb46f554cd79b4219f9e415ea08b7
MD5 b19581de34a90e22c1380a9b2191fbb4
SHA1 45407f015cb7c6621745fa054c43e5eb8609f56f
SHA512 f1d0d0becda27317c048af5724f2a28ffd57433808b83e4bd6d7457aa794ec375ebc7032a72862a6c0b55da5f2a55d52c4024cbc58ed35149b05446bc311d20f
SSDEEP 192:sxRXlSZ/fcsCEo9dvIdpw+/gb+WNvos/deRN+rJ:sxRXMZ/fcsCEo9dAv/c3/22
TLSH
T1B812C8066E64A9775CCBE31DFB647B13E2F56065A0C51E08DBFC951C04EA6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 cd25b7e8c1c4a3bd7571312f59eaf07079da79c317da16be6c36c1c9323fb967
MD5 18d055ebc99073ab9fc1b9f43c190806
SHA1 f247c8d3adb56b694017f03e8cc1f6b1c13160cf
SHA512 12cab9c86540ac52890cdd8c7b339028f54e4f873e7bae1d6941c485f3073bf7d37dfbe8e15f66e668b1ea4a4fb8a5007df03dc9cb2f0e147914b636ae8fdff7
TLSH
T153A0021405C6C442C945427856C3199136504C2295978727819424D8FD5B1E1461A002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a56fb.TMP

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe5a56fb.TMP
Size 48B
SHA256 b7c923e8a9869f365716f6a4369e01b3ce15d74a97d1910f63fd72809cce3193
MD5 c1c1507a79f25d467102110e3834eea8
SHA1 3c4b4bcce376106d6a8d92ea36eb1e195640a590
SHA512 6e90393fafac9db549b949d2e6d62b4889db3f5507ad19844315647e57e7a87b6db40f72238ff99e115cef225311ba15d6a39aa9010d77ee6bd06efe7d993d7a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

94a44ade-0120-4bdd-b565-1c0dfbb281ec.tmp

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Edge Cloud Config\94a44ade-0120-4bdd-b565-1c0dfbb281ec.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State
Size 15KB
SHA256 d91bfa3ff737f6992e934c86a4d2d1c65699bf20f24e079e3f105b07cb032d8f
MD5 b5d4bc822ea2fae211e1919952d4d9fc
SHA1 c479a3eb48c63e319faf931d225a60e9f688b26a
SHA512 d35a9cb459b658c3649b564ee131607ddcc907561a1ac9ba44e65a4f79a9ffe0248ce66912df8aeb8df54f5c0e0523b617df22b6b005750da393b6c8a5677544
SSDEEP 192:uuMm+xasuheOwQxMG8N3nU2oHYDooDUhUHsWWwZ471KOPhZ0YtHFpmF8C/rL+jrH:nfZcIh8N3nUtuIRxIOPrXLpe8C/w
TLSH
T17C629CB2A9B8AD7368F9F544F5892703AEB864B7F0906F88E9E8D70D05D32451307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State
Size 25KB
SHA256 fbea4e6314eb4f40b0917f41edb021a1313479b9cf1626d7feda8c7ad321052d
MD5 b17e2640ea3d47e43683fc4f41cb5895
SHA1 31c43eb61803349306cfd9888892903cc6e8d053
SHA512 334189524a7d37afa660d7b5e68630df586d24dfd80979f3b39adf868814300f57a356f2ba17cc5612512472c5bd7462b0b01aee7ec4b49eb3782a524e7d0d31
SSDEEP 384:nTiFiZcIe8N3c8TUNTUlIl6uJJRnDfwDIOPrXLpe8C/w:+FQeWcwgVJODIi9P3
TLSH
T1A7C294F194D79A77E8AE5783A77D6E429EBCD163B0885984BBC45D0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State
Size 3KB
SHA256 6597a7f774d5f5b38f471e2741273095d0e1f0e6984d0d25de7909d9e0d4ba90
MD5 5cb95096d04a834c8a1369e0d06d0bb3
SHA1 505a88060e1f0aa7d5dad6f536389b8b399b983d
SHA512 6ec1248f3094549104f1de9f199582aa45f7f94939fdae23e29f0e0727beef115b02a9faec6fb6fa8fb8f28dd2ff6b2e1d10f337b6dc0ab2faf5a00c27fda3aa
TLSH
T17181B6B26468FD7765F57644B08A37A39E3831F7E802AF44E6D5621800EB7483B0AC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State
Size 4KB
SHA256 dd2e2d23270d751c9efe7dd049504665a405577916e5129ec50fc3ea562cb79d
MD5 67870ea31543370df6ce511ac1709c03
SHA1 3b58bbc65e52b2899f009dfcccc53cb9378ee237
SHA512 af7abb71abc8b17d007873d6c1af84d9c4b0bb53bec8108bfbfd6e870fd6d5c10a9447e570a1a043fe4784209d1644f739057f0d00a647564919dc4ef83d0e74
SSDEEP 96:tqGNkqOQsFfaejX4O58Frh/cInURoDotov1/ODXBr/KvDmJ70eUckFFq4a:EGN3hT/ooDUwhIRTPJ71F
TLSH
T13BA1A5B265B8EC6769F1B644B4C63393AF6431B7E885BF49D6D81A1C00E7388274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State
Size 15KB
SHA256 3c6e655a14cea376facb7523b59dbc8adde3c419df5326339f8bd60a859d487c
MD5 0efd458a8f397544af3c43d8c36071c5
SHA1 0e6566557642de97048c6e8d584871ac785b4042
SHA512 ae92afa4c43d93616b0b520e4fad81104c2e7190d91e58588261755c061c56e53c49df157bbeebd2ee338ee8359b47d81614ae7dd0c3dc2ddb4798fabbb4bccd
SSDEEP 192:uu3m+xasuheOwQxMG8N3nUdoHYDooDUhUHsWWwZ471KOPhZ0YtHFpmF8C/rL+jrH:nUZcIh8N3nU6uIRxIOPrXLpe8C/w
TLSH
T19A629DB1A9B8AD6368F9F545F5882703AEB870B7F0946F88D9E8D70D04D32451307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59f255.TMP

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\edge-profile\Local State~RFe59f255.TMP
Size 1KB
SHA256 cdc06668ae555392e0d12af0e4be325e23ea3ad16f854e73b1bed4e7ccc5ee42
MD5 c9d33922e0ea1faf6faaeafc87126d15
SHA1 588f58bcbca98ecee77ff4950119ea0ec75c4aa7
SHA512 9c4c5c90b5ae3e907ccf92916a88f3f90862b87d53dcbeb491070ad27d089cd7325cf02e902b53807c72e46ab80356ae83a90597ef29c17d502b4c642bb7a299
TLSH
T1B53183F2A5A82DF7A8A06245A14AB7A34E3431A9D0566F0896DC241D05E328D5207C3B
MD5 SHA1 SHA512 TLSH

Submit Download

uploader.log

Path C:\Users\Admin\AppData\Local\Parse ME Uploader\data\uploader.log
Size 4KB
SHA256 fb82fbeb56e2369ece2f30de2c2cb9a929e8051abbf5fe6f436b85e7b9a64791
MD5 2b62f568a6cb19d211f186035a25ad6e
SHA1 31ab8bde7af2bed785f30be2c0e45bf9cbd4aedc
SHA512 b8dfa29c746799d17730d1ef253d4398d1f9bad45e3b82e98293c6b10b4b793a66a386006f5f13caacf62696166603c33a990b0cd4b5c5eddc548b1e87ae60e9
SSDEEP 96:KlW/3Vn/zVBuqSND8iQ1+Q5RI1k5H1k2SpirW9MBiqvRjuLiElbrHI5LZ5M6S04Z:yW/ln/zVBuqSND8t1+Q5RI1k5H1k2Spt
TLSH
T13E91F71DADFE54842ED382BCC24C8E769C673FAFBB8A64793715341452041DAFA79074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

201432e8-9960-4764-b047-5d8d706c32cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\201432e8-9960-4764-b047-5d8d706c32cb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 928B
SHA256 bbf9b8ab7d8c2d625fb2277ec727c6a9e80f053b345609057df0615a104ce590
MD5 1725622b3e4a309ea788223ed013a3dc
SHA1 ace5a215deb5b61ccc5aa3498fa170dc358a494a
SHA512 ea44c46ee31522319919fabe6e5f458aac07d2e9d140b6bce81dd12362a5a82708c795b0dd3e011443f0f43f134d1e87ecb1710908489758002c8e9c3f1050f5
TLSH
T1F61108D03931637B47C747E5A0220CC19D50F58A432F1AACDD565075BE6CEE0A35E38A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5344_1253482899\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7c861e5ccb8401a12b055378f50c3a5af46726972e258151f5ff60f1e48f4e3e
MD5 8b88bd2e394184ebea3f8ec3240f98aa
SHA1 bdf96c040f17567db5d72701506362b58f1c5b26
SHA512 c45778af099a56de9ed2ef47286081468754f26d03493266dd3b4c820a9348115a9e11245221d025244a53e784394a5a99685f62d7cf7a9eafe1588630ba9322
SSDEEP 48:u1ZdOeLieG4hJ9z+Y3tVdLXuH9xsExss8p28ZdOeLieG4hJ9z9Y3tugdLXuH9xsH:ubFJ+Yudjn8ccFJ9zIudj+
TLSH
T1A291D4006FE60E45F3F7FEB155727623AA77F9495A188A4D0089510D0C72B0986ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1003171666\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1003171666\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_888908505\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1996-3-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/1996-2-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/1996-132-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/1996-1-0x0000000000230000-0x000000000025C000-memory.dmp

Download

memory/1996-4-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/1996-324-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/1996-0-0x00007FFBAF51F000-0x00007FFBAF520000-memory.dmp

Download

memory/2560-359-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-7-0x000000001B760000-0x000000001B922000-memory.dmp

Download

memory/2560-217-0x000000001C660000-0x000000001CB88000-memory.dmp

Download

memory/2560-9-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-11-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-28-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-318-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-320-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-29-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-163-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-12-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-13-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download

memory/2560-14-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp

Download