b184962fadb05e94aa985d6bc6c0626553643dbdba2959913a93a3b1735118bc

Analysis

user interaction
yes
max time kernel
901s
max time network
912s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
Size 126.4MB
Sample260825-jd6bkayalg
SHA256 b184962fadb05e94aa985d6bc6c0626553643dbdba2959913a93a3b1735118bc
MD5 b8e85ee58d8c7cf4c72deb830dc545f4
SHA1 829e0584e1e21b061669fc7874d39bab9fd295f1
SHA512 a8cb68dd16509eae4323409567e40adeb5830b95d7f5264fe66229052846f1dbd82f5164f754a465e3118a15c27cf78790ef08ddf159c294f5f29fc14d223d0c
SSDEEP 3145728:dhFd1qBWQyK1WGt0eeI5yCBR0lqG1UJnnPEwW+rfsOHWTG:hrqWMWJLIFBRDJnPbrfj2TG
TLSH
T175583338E9C93069D8B4763AE1DD98594755FB7107C2C543673AC2BF36F0388AA6FA04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1076	Furever Dock.exe

Loads dropped DLL 9 IoCs

pid	Process
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
1616	msedge.exe
2232	msedge.exe
2232	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Furever Dock = "C:\\Users\\Admin\\AppData\\Local\\Furever Dock\\Furever Dock.exe --autostart"	Furever Dock.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Furever Dock.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_132196791\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1814140447\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1649170538\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_24310590\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1248339739\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2232_5127257\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1248339739\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1751902479\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_405584513\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_629904015\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1649170538\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_311200583\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_405584513\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1698689352\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_1281616195\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_588757077\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_24310590\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1984088534\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_722102948\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_2034268825\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_24310590\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	msedge.exe
1640	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321174020687154"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F3261720-3AA7-4BFA-A899-354C81C551D5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{253B6EED-8877-4202-8A74-B9CE43D130BE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{934858E4-2417-4842-A1C8-BBBA0B2E7286}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
6056	Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
3236	msedgewebview2.exe
3236	msedgewebview2.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2352	msedgewebview2.exe
2352	msedgewebview2.exe
2352	msedgewebview2.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1076	Furever Dock.exe
1076	Furever Dock.exe
1076	Furever Dock.exe
1076	Furever Dock.exe
1616	msedge.exe
1616	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1076	Furever Dock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2352	1076	Furever Dock.exe	91
PID 2352 wrote to memory of 5868	2352	msedgewebview2.exe	92
PID 2352 wrote to memory of 5100	2352	msedgewebview2.exe	93
PID 2352 wrote to memory of 5100	2352	msedgewebview2.exe	93
PID 2352 wrote to memory of 5100	2352	msedgewebview2.exe	93
PID 2352 wrote to memory of 5100	2352	msedgewebview2.exe	93
PID 2352 wrote to memory of 924	2352	msedgewebview2.exe	94
PID 2352 wrote to memory of 5964	2352	msedgewebview2.exe	95
PID 2352 wrote to memory of 5964	2352	msedgewebview2.exe	95
PID 2352 wrote to memory of 5964	2352	msedgewebview2.exe	95
PID 2352 wrote to memory of 3408	2352	msedgewebview2.exe	96
PID 2352 wrote to memory of 3408	2352	msedgewebview2.exe	96
PID 2352 wrote to memory of 3408	2352	msedgewebview2.exe	96
PID 2352 wrote to memory of 3408	2352	msedgewebview2.exe	96
PID 2352 wrote to memory of 3408	2352	msedgewebview2.exe	96
PID 2352 wrote to memory of 568	2352	msedgewebview2.exe	97
PID 2352 wrote to memory of 568	2352	msedgewebview2.exe	97
PID 2352 wrote to memory of 568	2352	msedgewebview2.exe	97
PID 2352 wrote to memory of 568	2352	msedgewebview2.exe	97
PID 2352 wrote to memory of 568	2352	msedgewebview2.exe	97
PID 2352 wrote to memory of 3416	2352	msedgewebview2.exe	98
PID 2352 wrote to memory of 3416	2352	msedgewebview2.exe	98
PID 2352 wrote to memory of 3416	2352	msedgewebview2.exe	98
PID 2352 wrote to memory of 3416	2352	msedgewebview2.exe	98
PID 2352 wrote to memory of 3416	2352	msedgewebview2.exe	98
PID 2352 wrote to memory of 3328	2352	msedgewebview2.exe	100
PID 2352 wrote to memory of 3328	2352	msedgewebview2.exe	100
PID 2352 wrote to memory of 3328	2352	msedgewebview2.exe	100
PID 1076 wrote to memory of 1616	1076	Furever Dock.exe	101
PID 1616 wrote to memory of 1088	1616	msedge.exe	102
PID 1616 wrote to memory of 3604	1616	msedge.exe	103
PID 1616 wrote to memory of 2860	1616	msedge.exe	105
PID 1616 wrote to memory of 2664	1616	msedge.exe	106
PID 1616 wrote to memory of 3604	1616	msedge.exe	103
PID 1616 wrote to memory of 3604	1616	msedge.exe	103
PID 1616 wrote to memory of 2664	1616	msedge.exe	106
PID 1616 wrote to memory of 1572	1616	msedge.exe	107
PID 1616 wrote to memory of 1572	1616	msedge.exe	107
PID 1616 wrote to memory of 1572	1616	msedge.exe	107
PID 1616 wrote to memory of 4468	1616	msedge.exe	108
PID 1616 wrote to memory of 4468	1616	msedge.exe	108
PID 1616 wrote to memory of 4468	1616	msedge.exe	108
PID 1616 wrote to memory of 2964	1616	msedge.exe	109
PID 1616 wrote to memory of 2964	1616	msedge.exe	109
PID 1616 wrote to memory of 2964	1616	msedge.exe	109
PID 1616 wrote to memory of 1832	1616	msedge.exe	110
PID 1616 wrote to memory of 1832	1616	msedge.exe	110
PID 1616 wrote to memory of 1832	1616	msedge.exe	110
PID 1616 wrote to memory of 3432	1616	msedge.exe	111
PID 1616 wrote to memory of 3432	1616	msedge.exe	111
PID 1616 wrote to memory of 4044	1616	msedge.exe	113
PID 1616 wrote to memory of 4044	1616	msedge.exe	113
PID 1616 wrote to memory of 4044	1616	msedge.exe	113
PID 1616 wrote to memory of 2876	1616	msedge.exe	116
PID 1616 wrote to memory of 4816	1616	msedge.exe	117
PID 1616 wrote to memory of 2876	1616	msedge.exe	116
PID 1616 wrote to memory of 4816	1616	msedge.exe	117
PID 1616 wrote to memory of 2212	1616	msedge.exe	119
PID 1616 wrote to memory of 3760	1616	msedge.exe	120
PID 1616 wrote to memory of 3760	1616	msedge.exe	120
PID 1616 wrote to memory of 4696	1616	msedge.exe	121
PID 1616 wrote to memory of 4308	1616	msedge.exe	122
PID 1616 wrote to memory of 4308	1616	msedge.exe	122
PID 1616 wrote to memory of 4064	1616	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6056

C:\Users\Admin\AppData\Local\Furever Dock\Furever Dock.exe
"C:\Users\Admin\AppData\Local\Furever Dock\Furever Dock.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1076.2472.11944099152460294734 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView /prefetch:4 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x104,0x7ff902aa5fd8,0x7ff902aa5fe4,0x7ff902aa5ff0
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3956 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:1
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4104 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4368 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5052 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5000 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5136 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4948 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5156 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5224 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4688 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5048 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4952 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4888 --field-trial-handle=1712,i,17538405803438316948,13159597050481144909,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1
    3⤵
    PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/o/oauth2/v2/auth?client_id=499784209572-iohh0r5ognogrir4bnj8a3k1h9tnt8uo.apps.googleusercontent.com&redirect_uri=http%3A%2F%2F127.0.0.1%3A50200%2Foauth%2Fgoogle%2Fcallback&response_type=code&scope=openid+email+profile&code_challenge=oyjvI0WCrFF8rAPiYdCkMgBDduzsZchwlLwm2ol_1g4&code_challenge_method=S256&state=2T7XjQaz7sFOqx7hbgQtoWVZjsdc2gzpbug1ooS6d1M&prompt=select_account
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9004cc188,0x7ff9004cc194,0x7ff9004cc1a0
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,7034747363046272466,9950860720394422481,262144 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14035093281763748676,1968011361038272516,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,13597070049847977273,287432961361953626,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3756089587904689476,485345656513206519,2097152 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,15464212797968536016,18087419851639863144,2097152 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,17002802735567422550,12896467712416839868,2097152 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8276314922018562675,4758116048972572766,2097152 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,7906599596691516811,12650600777879287051,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5404,i,14700148134402987864,1044142895832356057,2097152 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1546716377918703024,3866145000058075034,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,12277758876732941814,2003258177411513226,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,15587698716584993401,12475796499546035777,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9304047302673148083,3355401562479527741,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    - Modifies registry class
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,1816267469901446023,13111043816638613976,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,15587698716584993401,12475796499546035777,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,14185198218598579313,13196442739904233590,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,8622410439716927484,10572354924762661625,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,5761101569622083283,5855288157191800019,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,13643900200520121865,6295022521245415318,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,4333738703891734360,7895522775045532282,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,100970028010317448,5603882084315834301,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:6232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10993533901968330622,15687995227404273884,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,4035811396283800669,2520985658450449581,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:6356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,17347120847086101332,3158765414836965887,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,14454093993453518214,14105995548304477165,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,207893881998470103,10237366407799140332,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,6106524948856969817,12389141556049519178,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7256,i,3423586923284923234,9168511775171270931,262144 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,5512881397339274304,14941239778784923957,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,10231309565497170718,11566572176714390114,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3024,i,2607618244562518258,9985228488073321141,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,11326122901219056081,4585102633485441773,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16264935261911078489,7521358425471674240,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,7227926083675567098,15745251005077664567,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,16412231545554469793,18078169524047307739,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,10324163435412028269,15062141484775964981,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,5491896030321923974,14964982596491514964,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,8958438034595553642,1028650411686307649,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,2153154320133740151,12745891894966613085,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,3156577805810627860,15148603588967216029,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,9476040231026389218,7246563959359636351,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5693817726838769015,3193781247960257422,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,11660375908572153938,12512128504033827526,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,16095982896358134967,1663908895264992853,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8559685902873173149,14135149755277545654,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,14558663578893305017,11849023177512640090,524288 --field-trial-handle=2160,i,4223800252816581382,9511403210039235032,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff9004cc188,0x7ff9004cc194,0x7ff9004cc1a0
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,17723581926138264421,129254933648427167,262144 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,7838962181772956590,86891591395128803,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:11
      4⤵
      System Time Discovery
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,5183416722327486715,11769507569044791365,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:13
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9272052644388542917,12013741387177451754,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9272052644388542917,12013741387177451754,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5096,i,11932332707934175815,17148924403743984441,2097152 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5100,i,16946862666167033180,201413660153426042,2097152 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,4796474862437562835,10789847684378516645,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:7064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,5122875454933702312,2752909496591458291,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6048,i,2087046354718104874,12217041762139542601,2097152 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8963475056774173670,331531017191771367,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:12
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,17245771158392122862,15707398277767902572,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,6073324452116517284,16330623864244911780,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,17292028255256586159,7434960116515510089,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:6968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,3334202502969482541,15924837155005074014,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15659362666632331748,17781654120256772528,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,1054826577734090868,13081831796554139698,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:14
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,12143853126227360844,1002261563111177810,524288 --field-trial-handle=2952,i,4478530512111589129,5977517516630737593,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
      4⤵
      PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.fureverdock.com/api/auth/facebook/start?loopback_port=52604&state=cYT6Be7GsDGilOABH7PbcY5tklyNZxCYSVXUEU3AE_I
  2⤵
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4488

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad74352c4d598a54d1b49d4b398946ef449549dd3b58dad836f6278bb311892b
MD5 f827b3a54a2209dafedd56478d2199df
SHA1 f3050b1103ed09ece8ea3fe4a21441ddd69caddc
SHA512 78e9abe350676685dee36c7966e7ee6d17423c02551624c9394b61910dbfc3444a6c9515fa6a48aae1cf78af9f47aef10e35a57971cd6d859070c674fff124fd
TLSH
T191D0A76055E9BFE5F02A253CA2500154649D69919E032157A540052E5E3E1C305D98B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b203598e9ea5768a2994c24ebe6befb1ffd7eb446895a5dd191bda7e13f019a
MD5 65f828f5941ef5e14c1ed59617c1ec65
SHA1 1225c96e0ad1a50e8e0fa65ca00573d57a3d1ac2
SHA512 889a848530a36a96677eb1be29f9c09d664280286ae718c9ab7059e1b1872a652f23447c1bd2b893873232008e7a5a10d5083c3bcf8f5ce4fcf474c43f471f1a
TLSH
T10ED0A7B542EA6E15E01B2539E150616D35AE7AD0981261279141125E1D2F2C245D947A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b37a939e4cfbc21d6bfcef837f956435d4cc0928535a1057996c5a9bc168d2
MD5 337c405cb670dd6b0008e48e61bd7035
SHA1 bfe56b5ead346cbd38344b51b3bf7493009a3f15
SHA512 1eef7e9feb09db63897d7005ab650fdcd871150b52bb1f0c632315d6a794749119ff607d2e5410d7d588f7406d8aafce62529b0f7b6a0039b709df329680dcb2
TLSH
T1D5D023B143FA7E19F01F253DF150617D359E7AD0881361279141035E1D2F2C346DC4B6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

83ec3cee-ed03-403c-8777-c601bc4cf9ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83ec3cee-ed03-403c-8777-c601bc4cf9ba.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9e7577dd-9db7-4732-b3c3-d84e237ae309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e7577dd-9db7-4732-b3c3-d84e237ae309.tmp
Size 414B
SHA256 64b046bf4152fcfbac63521cdb3f1909ae4b11f7b4554fa29f96251de2e18060
MD5 69d71209b14d4e4de95d7280e5838765
SHA1 ec50cd519dd24a709bec9edac5eb066bc41c23b5
SHA512 7a53a13bab41bec650fad01ea403f2a86be42de36a99f814840f2cd8d3c5969ff2283fb7c0a589eabe82c48819dae27b2404a0c57e745dfed6565be4f05c6724
TLSH
T176E0E5A6C811BC672DF90F29E1404746EB6A23471A615A5A373D810D8FB563A51C781C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5a2942f101008e3015ff45d96c08e23128f067e16ffb9f6e2b7ddcabd420f59f
MD5 70dffbc1889ed9d4b8694238215d75c0
SHA1 6f7184f37cab9840b77598622f733d408b1feb76
SHA512 402afed5834bc79d0ac1e930d903cdbefbcefad3e4e00d83a105ae4d7bbf94e475c3fc555138dcc95e8acee405c31abb0f9a68d00bb8048d69d1bffdd4261cdd
TLSH
T15BE0789545C6C66D6571644F53DCD74CC1C0360FE2C4FA153F08848D7441044FFD3550
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 76f41c9a730318e238b838102756a6339d5ddeab96175a6e1270dd63e435fdef
MD5 c659a31f27ebd99e107d93c95f571b8e
SHA1 fb70c9db2651003eea1bb9c0e5ba127e98b60ff7
SHA512 4628c5bfc311a5627c271e54fa058643e2ea61e1f0f55d462a60594c6fc9201022492cc31359a2c9d2174489dab7200425573e55e4a8b637f17befb4cf689b03
TLSH
T1B3E078F805C5C25FB7407867516C4F0F82C0371EE3C4EA459B089C8878C104072C7DD0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 82a74ab4ba38b33f213acb6d4dc804a680bff9b3c64bf61aee9afd9fbd5726d2
MD5 4da50ad2df4f5673444823c71c83d68c
SHA1 0fb3fbcc7f840e3248e118be5ebffaf5b725a425
SHA512 8123f758e9559263b40439fc0e8571b5e5cb5187e48d766d4841129bf0fd0cf4849cf2c76ff27e23ccce296fc26c8bf1a7dcfc8e5629821fb3c1156d04f8eabf
TLSH
T19081FD4F2B5598D3E332157120F6076231F9A229CFCBAA14D4505E72EA45F79C2E7C83
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9beb534fdf871a7dde80fbbcf7fe3be2fd9034d783749409f2c381d82cc33ea6
MD5 1fb9756b26ef41d319f4227ae716baf4
SHA1 e517b888997f2529439d266f0bf4973fca9e9abc
SHA512 fc636e4597f84b7e12847d42f09a3d823885f7304fe696eafb5b1667d5170cfcc76f520a19a49d1e3d9d061a5ad048e112f611f2239d45e8b70c6aab988e17b8
TLSH
T11281FC8F275698C3E373157120E6076231F9A22ADEC7AA14D5405E72FA45F78C2EBD83
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 619ebd2d6ed2827e2ebc441e409f6f3e0459780b307228f24b33fac32ccca096
MD5 363658e197a54fdb44ba863164eed7cd
SHA1 527948bfb0af64c68cda69614024b4946567321c
SHA512 2deded10864b02cac3bc47bbb8bc07071df714193450cb9c7df9339d99c6d26bd5f96b9d14d458536d5a036c03ef09b43242ea542699c7e2b1ce10a66a514ef0
TLSH
T19F81EB8F2B5594D3E372157120F6076231F9A22ACFCBA914C4541E72EA46F79C2EBD83
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 09302828569606f95ed64eca540fadaf83e5772451f21d86b50c3f65bd4e74d0
MD5 028635bcc86baf9ad5d20b574dbd4041
SHA1 6f930dc8d6275fe69668b2811aef43293a387278
SHA512 1e66e58a8f3716c12e4f64d244c0407b150b10edc1e41a623f22dee0bbe9a032dac2d94265b96bac5928c86dc4786d75280586952b0b74e7caead3c314bfd92a
TLSH
T1E061A30F2B5588D3E372657120E60B6531F9A22ACFC39A14D8445E72EA46F7981EBC93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 73c86a1e57b8342712523ffd17ea336a5adab64f202b4d35ed803ab34b025640
MD5 bfbc6a76173defc5ebe5555029d1e15d
SHA1 c09faa02852512e6f8411ce3a7cc027a2527408b
SHA512 b13bac306db49f5a2feef216aecbc593865d3805e3b7287588803699887b628cd693cf370c72984edc5135bb180c8300be12bebe3d00c37d829315a6bd250ac4
SSDEEP 96:hWfm64R1k2AjKRzo4tvxh/DlepuPkK4rMr:A14/Vzo4tX/DUMPkK4rMr
TLSH
T1A6A11B4F2B4A99C6D73318B110F64B6232F9A229DEC79A14C4005E72FE46F78C1E6D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f247be7eb5a3ca2612ebffe35ca5f722ccb36db7b1d015aef3c015a824e4dbc
MD5 d04d51cce431f0d0a1479762f673d7d4
SHA1 acb639d226831395d3fbc1de87edc4e2b0332481
SHA512 66d9d75a0dd3997d63bfb1b40028d789ee74c530869beac0dadbfb95ec9ac9ec1f782a2e6078e8b9f1f763f6730ccefd8c650ee78034f5fb3745ee9336ddf4aa
TLSH
T18361A60F2B6588D3E772517220E60B6431F96229DFC39E00D8545F72EA46F3981EBC93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c59b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c59b0.TMP
Size 2KB
SHA256 558b331e202dfee4d90e7b2f3ee13ff210257ad2bafcd24eb2093651fe75b2b6
MD5 68d3c02fb208526f80e4139099fd5436
SHA1 3d8f9b5341a6cd3317aa0ae8bc1961df01c81e2a
SHA512 6ee0577d50caa1846571be888d07538b264e1807077cd8296c0dae7413869aeea678b5d66916df0bd13027c86e3af877cb452cec49d31a1758dab612c60a384b
TLSH
T1D551930F2B2589D3E771957260E6076932F9A669DBC39E10C8001E32EA06F3181EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6b1797def8a5034ef77a9f7f5769e350668f372426c2dbfd92825426d81d0326
MD5 f61d007206d5e95d007b241b85b4637e
SHA1 9133d48edeef2adbf410a3127af179609254ac29
SHA512 700601d2d8ff04af08c9400ce3f3e9c5d32980669ade47c6e4df5c71ebbc0af68cebaf1302b9d673e07a8f8f8720d116f9079ab25ae57f4476e12f0c8d13d90f
SSDEEP 48:YALlN3Ohrnh6hZh5hgVaCZs6QzsG/foKsstzB0EsruCIs+2Ns8csN/4slVCKsotp:D9OxwzvKVaeCXzB03uR2vtlVvZIw/R
TLSH
T1C9A19BF7C3E8852DC91156F4AB15AF2FCE190925432C3C6AC8D8AF6B93E2871D20565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 84c155a053f702c235edbb2b0598d953f7c7450e8a18b689d29dc3c925293f75
MD5 3090900b687cb3ad412dd48cef2607b9
SHA1 739e9046c508064065714b098554275250f225a4
SHA512 6415362064889295714cdf7fbee5714d841b66d4630d22aa25b1c437dc1bd11ea09cc761be00a0ff7698c608d94ed797c3dd6c29c413f7723ac13d6f7efd124e
SSDEEP 96:D/O96YlMODVSBVaeCazBDiwBj4/RW2XSHzVZ0gR:DW96Y+OpSBVaeCa1Dikj4ZWSSHzVZhR
TLSH
T186B17AF7C3E9822DC91156F4AB15AF1FCE1D0924432C3C6A88D4BE5B93E2471E115A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 95e6972e3726f141e1cef5cbe5337074c7af8c8f07195781439636a840c2e152
MD5 51df805c7a0ea7819a9d8cd7365e27dd
SHA1 abd03b3fae8ea7c0b230f0344e28357964ad1ae7
SHA512 126ac15709c34513f02e818b63c8b99ff93a44fe69a7ca6e06a4b8ea77f40c6f7ecb6f3c90168199ae1384d25b6471cdea5bef06e5a81cd5c66050263bd2a945
SSDEEP 96:D/OZO96YlMmVaeCazBuqYiwUGj4/R8Z0D2BdR:DWZO96Y+mVaeCa1uqYipGj4Z8Ze0dR
TLSH
T116A189FBC3E9822DC91156F4AB15AF1FCE2D0924432C3C6A88D4BE5B93E2471E115A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5bf1f8bed1ecc711644c7ea985b712193308b27c1d965edb2567a6c239e7874d
MD5 065043494a69378e2479ae7740911e14
SHA1 dadc26c7436c86744f2952b52eeb2f73ee274c01
SHA512 06544a1a9122cb598ee44ddf1ffe3fb70c7f17424d730e2379e9a4b242b1c6c7c66e3e5dbdc559f2cd8ef34cbf0a3d1c7c5b9f10524af2f003a9477314bf5d99
SSDEEP 96:D/OfZKOqFVaeCazB0BuR2OZYimwB1Gj4/3:DWfZKOqFVaeCa1QuRrZYimk1Gj4v
TLSH
T131819AF783F5812DC91196F4AB15AF2FCE2D0524432C386A89D4AE27D3E2471E105B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c59766553ca4b2feb181a3e3f15d0bfae2c8891ea14f60e8d470f22fcbcba723
MD5 077c2dbbd24aefd378a0e32d72b28de7
SHA1 c28172105acaf2928c5eed0294e1abb8b3fe6642
SHA512 78e9e13ba198b13ca17c1a2cd8d0aa7bb76586dfb70fc91c3be5cbbbb42c9c68f90eb56d54df2fce2fed76f70ae20bbdea08fca312f615a9b05f07dfeb4b4088
SSDEEP 192:DW6Y+8WS5oIJh/VaeCagitxDZQ6VIII92fhqj49NmbLkuW:DW6Y+8WS5oIJh/VaeCagitxDZQ6VIIIs
TLSH
T111F17BF783E8862DDD1156F4AB156F2FCE2E0924432C3C6A88D4AF5793E2471E105B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 43df0370581af92644f5e1bee8b10988c2033e28281d44883734ebfaa750124b
MD5 ceea1a9feaced16ae00d0f1671b38ae7
SHA1 650a55c6deae6822bceb29c43222f3e939776b46
SHA512 c7062d2e23bab477a58802a65ee6008a226ab67f1b663d4b87b2f8b37153711e1e90bebc930dfb01532d43fda1357f68fff8bc62f7c9648ab839da82006869ab
SSDEEP 96:D/O56YlMODVSBVaeCazBDij4/e2ExDZ0t6VmwBSl/:DW56Y+OpSBVaeCa1Dij4GtxDZs6Vmko/
TLSH
T1D8B17BF7C3E9822DC91156F4AB15AF2FCE2D0924432C3C6A88D8BE5B93E2471D115B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 904e6680b4903ba72daf513b99ad48dc1328ef7c2c59ce23028d74ef3fccbaf3
MD5 3df977c48983c95cd9925f6b89df0b9a
SHA1 9af3dc9ea1dfd441eb8fdc3d63c225639208d968
SHA512 500f3e9aa366a5ea671518b257b10ab8570dbae21450ee9688263438cb090478335b2c53994dd50262d070d0185c741b6d82d4116d768882e156ddf752c1bfbd
TLSH
T149017B67E4BEA577207C4DFB090AB802BCB9E431068094F5DA65A36CA0C15F70B0343A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe6635cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe6635cc.TMP
Size 689B
SHA256 527d521a87873670ef73d40396d2f05e616d2cca2c64cf0efc973d21e939b328
MD5 62d24f340ee3658d33a9344df97efb7f
SHA1 4e8a3b4fc2c56ee51280ebd4dd5c723fc93db81f
SHA512 e73966ee3df3abb96baf3a886d9121abdbbe53342824f9cc7142557206ca40ec139023b6f80df29c497f169fbcbb831681d381646f1cb202dc3808f5e4a55e4d
TLSH
T112017B23E0FEA477207C4DFB090AB80268F9E431454094F1DAA5A36CA0C15F70B0243A
MD5 SHA1 SHA512 TLSH

Submit Download

fec05706-02b1-40c9-9382-4a17ec635829.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fec05706-02b1-40c9-9382-4a17ec635829.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 1d7975409e07a41e835f098c8683a8de0b53bdbc9559289774d7764912df04d1
MD5 bc63b68ed5e376b37d8f9f56cbd64eb2
SHA1 32a20a2a21796cf69d2fcfbe4dc71c8f8daa578d
SHA512 1fba82b18745b79b2212705d894ff9ab993b929260ec403c5988935075197241f3bc6bb747cc7f4121f82d534d290e42978de4500097385ead7314c0f2cddbea
SSDEEP 384:sxRtNI/f9sf/66s8qMpRiYnazAW8pZS15posJWeT+5Y3APk/5f/OwuP:sRNI/fe/4Mnc7WeT+51M/5nO5
TLSH
T15BC2F9069924C83B9EC35D18A93D7E33DAEC505222C5DEDE56ECCA1C01AE2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 060776a8c07bf2c5af785c885b9db2ae196f61e67ae4e9b9eaaf722e523a6590
MD5 bd1410ee65dbc811da31fef07dd2b52d
SHA1 6102a28f45a36878b7c36e9dbbe4e7a9c0590faa
SHA512 622d23070b3b99b0aab50991c78672655f14b9ea5403b7d527fd9df7265bc3ed2873a4e6654eb6a3bfb19738f52072fa754a1cdcb3af66e93c24a57ee62e4e37
SSDEEP 192:sxRtRsCI/f9sTDZeZ3ACzoA8pWu6/g6+WNkMT/YoaOCYhGUIgDCDrGuFJ:sxRtNI/f9sfZY3APi/5f/OwuP
TLSH
T10342B717AE28693B9CC7E219FB55BF53E2F9202391901E48A6FC861C01E7BDE520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 9cbaa44b49981e6b24f155279ab4d1ff1052ff76601b359319844baab14fe1bd
MD5 99db6ce0ccd79c35f1b08083ddf48f78
SHA1 02f9710b6023ab8a959220de5ba9997b739a9859
SHA512 46aca8ff191e19a2d20f33815237e7b792d9ccf948292587a940ce511433489e335b2f074195db5ae40e64d1338964dc45cebbef57ff1f1562927b5f767a9cc6
SSDEEP 384:sxRhvI/f9sRWvS/66s8qMpRiYnazAW8pZS15posJWeT+5Y3AG1/5zd9/auP:s1vI/f2YS/4Mnc7WeT+51W/5JxD
TLSH
T176D2FA06A924C83B9FC39D1CA53D7E33DAAC105262C5DEDA56ECCA1C019E2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a0e7ccd547db2cbbe25db18a66e8cbc13ceb688f9babddffe7eee958d3072dab
MD5 f5c4ba248467f8e93cf1bd6e2436a3d9
SHA1 5913f1341fd274e604169f795fea000ed6bc1d57
SHA512 3c0764b990992a4f5073367032da58706b6981edfa0f81c4e0cf11ffc780f8c28bee55a02a078d1a315cb991bbf17fb374d3318994138e2670b05d922b4a9852
SSDEEP 192:sxR+RsCI/f9slDxeZ3ACzoA8pWu6/g6+WNkMT/Yo/gCYhGUIgVGuFJ:sxR+NI/f9sRxY3APi/5f//wR
TLSH
T1AD42A716AE28693B9CC7D219FB55BF53D6F92023A1D05E48A6FC861C04EBBDE520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 6bf0d6fffd9bc6a5ea0023fcd3f28de46112b90835d69323e817010519370e2a
MD5 dbc4d33b0b1a35add5f10ea6b640316a
SHA1 4da4a0c15cf359fd1c1f5984057dbea294168735
SHA512 33913d579c216da0883399020e294167c5b382f5b023efafe64954867ffd60de18b93317efd3d87096236acf0cc53b7287a95a67215a9e55a939c1be449288a5
SSDEEP 384:sxRhNI/f9sf/66s8qMpRiYnazAW8pZS15posJWeT+5Y3Ag1/5Ad9vwuP:s1NI/fe/4Mnc7WeT+51c/5YB5
TLSH
T197C2F906A924C83B9EC35D18A53D7E33EAEC505222C5DEDE56ECCA1C019E2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 dc756d3b13dced08f3560a6770cded63a1c0c3210faad7380eb89e4ecfeeb477
MD5 52bcf0aa6ab18d07990eaf6f87357aa3
SHA1 95a2503bec7fd1277b1334f7459842e0bbd07cdd
SHA512 708ca1cf0a2bf36678870eb18796aa56c0d990b00c5e37c2a522a15ebb7cd553116261db2a981769d7600354101349d954917d74ca246b640985ad5fb4b529ae
SSDEEP 384:sxRhvI/f9shWvv/66s8qMpRiYnazAW8pZS15posJWeT+/Y3ASS1/5zd9/FuP:s1vI/fyYv/4Mnc7WeT+/1h/5Jx4
TLSH
T19ED2FA06A924C83B9FC35D1CA93D7E33E6AC505222C5DEDA56ECCA1C019E2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 cecc53075c7240be218319db525c74b8727ff52db3d3044f47d7e9e91ba4d467
MD5 ce8828c8ded6a14d10f7f31d3634ad12
SHA1 7e43b15ed1e0e3fac1fca85dc59599c8b4538296
SHA512 dd81172c9f15535bd4a1746ea64ba6342e19db7d3f5c013be4238f998162be9e101f5ad05a8c53b36bb5fd345196fe49be3f6f4ff92ae6cef2b1a00e087fb184
SSDEEP 384:sxRiNI/f9sf/66s8qMpRiYnazAW8pZS15posJWeT+5Y3APk/53d92wuP:s2NI/fe/4Mnc7WeT+51M/5N45
TLSH
T1F6C2F906A924C83B9EC36D18A93D7E33DAEC505221C5DEDE56ECCA1C019E2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 eabd8c67d9dd2a6ca40a7771452a7d0e6e220c33612b937193e363ae66adf2d8
MD5 33fa4479af685f0f449c37022627c3c2
SHA1 5f640d93fa89d5b32c11a77df5a4ecfea196b9ab
SHA512 c0db2f0a26aa55f5bfbc48d8be329942a2ff5915ec8f4dbe63928979c62fd6a8be197edeb9d782884080065eed3d5a3221e74b27e8a16787eb4ebec84bab890b
SSDEEP 384:sxRhqI/f9shWvv/66s8qMpRiYnazAW8pZS15posJWeT+7Y3ASz5f5zXX9pFufR:s1qI/fyYv/4Mnc7WeT+71Mf5DnK
TLSH
T176D2F906A924C83B9FC35D18A93D7E33E6AC105222C5DEDA56ECCA1C01DE2FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd89808487fdfa3c819d192979bbfd381d0584d8be7c3aba44d80038a0834ce8
MD5 1d36d09515d366d102e71fb63a65bd28
SHA1 efec0750f739aae0933aee41b67187370080946f
SHA512 5929f89a51a142099a5c07821204191c7a318ac55b1de33ab2321ab0d4ef08f147e5b0a9506c12da32e88add81bc48a64200308a056911010ef31d6bd3872bf3
SSDEEP 192:sxRtRsCI/f9sTDxeZ3ACzoA8pWu6/g6+WNkMT/Yo/gCYhGUIgDCDBGuFJ:sxRtNI/f9sfxY3APi/5f//wup
TLSH
T11042B717AE28693B9CC7D219FB55BF53D6F92023A1D01E48A6FC861C04EB7DE520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 38b5f05d9046b72a56bc0fb9e5ad46b990f246c90108d9d2140e3ef493f37fc3
MD5 d9473d94b285a9d56d62f3b07ce65124
SHA1 70d502309c3eaba81cde03545743c7671a04226e
SHA512 24b55f75abf181df640dfb790b067952e3e57700412ce8d4c01c91178d0b1e16ed0cc9ad372a2371848db1561992ca3cf402f70e5a302e7e9c1fdab8d567c89c
SSDEEP 768:j26HqJ7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVsUBVuwgro9de0Z:j26HqfEz6RWgs2f02u1javUB4wrs+
TLSH
T1D6D2DA7B640DCBBE4F800ADDDD197E9F6D6802CB9698CD8047FE851C02C6BEA511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7bc06df3-5a99-4bf7-b23e-54b8f06fb0d4\index-dir\the-real-index
Size 288B
SHA256 079aaa976cb7d875402e6832412c96698ae9c46ba381eddf4ca16a0b3128570f
MD5 6c3837d83b715b5b4d33f5b74af4d105
SHA1 aa1985178cf96d9b7e57d821ce72b5ff4ae12fa8
SHA512 6c04976339b3b6eb0de0d40aa6680f79a6ec0dce7199b1048f44b1cc81b7add0e719a00d82b0d007865258001e82f5de18ad3da1482fb2cc986d931401efb030
TLSH
T16DD0A78A9DA2551AD6167D390A732465373706FD25026E2600FD043D5655A788946505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe608968.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7bc06df3-5a99-4bf7-b23e-54b8f06fb0d4\index-dir\the-real-index~RFe608968.TMP
Size 288B
SHA256 5b35ef79ae62a45481b9b8ffc4ab32dcc874ea1aa033fb3cc8c9b74aa866527a
MD5 66ba6590efcb7c2c626a533dd51d2286
SHA1 bbcdad789716fdf7a9eb47ad43347f0ce345ef79
SHA512 c13a5398972b0007976d55e8cf69bd67f4e3842521867a579ce5d2c8e44029a86c6ff8dff7a0f128d7d506ddd9e0ca9b2a994ddb7f061acb492c2be00375f06d
TLSH
T1FBD023CF4A916965DA1714391C4355153337083425159E3510FD086F4B717ACD95110A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c2a75f1b9b49a3c2a8524427ce00e3d1bda03d5d4570a8d3bb394a2d61934873
MD5 c65d1eb8f71519526f923791b1a8f575
SHA1 5ab5523e55df1ea4f5c2ea4a2e5c1bc4320383bc
SHA512 9f52d3811c74cee636b8bda7f0680a8f27ff39cc616462063608c0a5081e0d493b01f00bace3c8cefeb179952843a5725b008adbbdf2b8bfa213bebaefa7a95b
TLSH
T1ECE0D8B32EDB6814ECBF97F5247198A50142F964D80AACCF251E93C250B1251795FC25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82ceea6842133379fdaeaa005402c0469685242428d0d41f4ce16f84c25a35b0
MD5 2852df715d6dac4bf2c28da817dc4f69
SHA1 dcfafaaad2ba7280d7f26656d003f6fafb883d33
SHA512 990f525faf684befcb882c2d4c0b7ad755e659788d87da1988afed22e599b2aed6b553803651fb067e32541d9a35983a6a66ff0d4452115fbb6a336b1d5c75e7
SSDEEP 96:KREaEfEGE6EMEsEMEaWE0ExEpgEqEaK4EvgEwEacE6EyEZEIEKETSUoK5eCS+EK8:CEaEfEGE6EMEsEMElE0ExE6EqEiEvgEe
TLSH
T166917C8172FA42403C7F6A5C98E4986B528274723019E87B7BE813A14FEBE154DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5cd662.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5cd662.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b27017843013c30c2a16eeac2bc4cbd1bd0baf5a57683b75cdeec99e0cb6e3af
MD5 17c79c1d53871dc08cf13b04b84ea349
SHA1 52e3c7c73567e5c608994ca179b3ed34ea035a2f
SHA512 70046cba01104ed39aeb7a53c2fb21f2d1dd75b9b6a6e051b1d87c1b95d404fbff7a5377b92a4aafe7889a8c808a35e1f487e672c389d4d3878c43acf9d40d63
SSDEEP 768:bM3JgDX/TBOW1r+sONXyer1IRCzni9rflF:bM36DvSIqnUflF
TLSH
T1F6F2AE30A9959D334CE6E3C6F6467783BFB82067C4C44A50E9EA9F1E059765E230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21d05d915096a0575a7405f6d96f26876d37d946cf742a5960b569168ebc2a1b
MD5 ce86fe0cd58c83f60471fee56c49e5c6
SHA1 ee608c746dd69bca63411119a567dcc9eb8faa7d
SHA512 c41b296af242391f23f6c7e4d32a33f0f2b179575dae7d8fa336be14b8d9a39e9eb108b2b3829953146a9a41e66266d9cd14e3df62a234d341b44b1779a27c02
SSDEEP 768:hrv+4UNbdz3B7/TBOW1PONXyer1IRCzniB8eVH1SK7:hbsbV3B/SIqn7EH1l
TLSH
T13303CF32E4989E338DE2A3D6B147B6437FB86057C6800790DCDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0331843dd2063db4b0c17aa6e68bd457fc01f1788ac54926785f66b510a3750c
MD5 5489f5059fed97944bcce465db60f47d
SHA1 db295920c2c85e1db57d04d20dcbfafaa93189f4
SHA512 4fb68cb87bbefe23ded2ec0076fad566c2244ab395beea07ab3bdc890fdc845ab8e278a85c998326c7938d72c0eaf9f4a5b9e3fe8a50d87d62b657f6bb671a98
SSDEEP 768:hFQk3vwg5gJI0sOW1r+/ONXyer1IRCzni9rflF:wk3kWCSIqnUflF
TLSH
T1EA133AF594D38937D8AE9383A33D6E46AEBCD063B4884990BBD55E4DCC8217FD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c5205ecabf1cfd4f505bbf28323cfd637927d041ccb0270ae2f9cec17141dc33
MD5 6c2b0c9f0a58b038e89b1e52c9c0e735
SHA1 d9f876ebc7e20451819a57f18cbf0cb439d29426
SHA512 e54a86a7a81b3d0b70afe5547a98f3138c4e14e246622e47966445908f2a67778e36601d60b0a049921658caa97bea028b8f8ce2e574b4a5d99ad961087c94f8
SSDEEP 768:irv+4UNbdz3Bl/TBOW1r+wONXyer1IRCzniwreVH1SK7:ibsbV3vvSIqnfEH1l
TLSH
T1BB03BF31A1A9DE334DE6A395B147B3837FB82067C5800B90EDDA1F8E069759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5aa0ae5bba3853111d0cb4a317819919f196c5ebc955b665e22fdfbc1c85b2cf
MD5 0932dd6229841547cfb13d14912f9c41
SHA1 d94f53656851646ea6ea65448379e55c669a4761
SHA512 b12b9076c5f2c08fadde189f4df256bca589c7908b117ab80a9d2c261ed19dcc7b61bf534522ed934c24562f3f05de48ee36b74d1fc4f3b158d17eefe063edc1
SSDEEP 768:pM3QgDX/TBOW1r+sONXyer1IRCzni9rflF:pM37DvSIqnUflF
TLSH
T1C8F2AE30A9A59D334CE6E3C6F6466783BFB82067C4C44A50E9EA5F1E059765E230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 facf10b1b6153e43f973c59151eaca53441eca7e8d8449f7af3d75a17e61e0d2
MD5 0bcbd26dd691b36fcc4633a7162177b5
SHA1 7d2e8e13875aa9e92ca175bb95b129801d6f55e6
SHA512 6e18ee8cf711b3bd41ac26f59ec0b7932b06651149ff90d967866bd11ac77f2b5c4f42178221e514241dd1b5831c86794926e05e77d9b0b8a51d406b165229c6
SSDEEP 768:zrv+4UNbdz3kgbX/TBOW1r+jONXyer1IRCzni9rS:zbsbV3HbCSIqnUS
TLSH
T15203B031E5689E334CE293D6F14777837FB8206788C10690E9DA2F8E069765E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 d00360fe64b96203f0acc2a1a95c6c840b7f16da7189e9473fc4d55ea8f7b37e
MD5 814272c68618e1c1b4b40272b9e89ba1
SHA1 4249531ff5842a4455608ca6dd2c23dc3996e909
SHA512 c70f97f105240704bd9cf505b00e915c8f4760819eae45406547189efd300bbc1cff50c83f90532f92f71518ecabbc1911cb35221e39b26e47262a5a41cf86da
SSDEEP 768:EFHu3Vwg4gxxeBsOW1r+OxONXyer1IRCznierfEg:cu33TBxSIqnFfEg
TLSH
T11F1328F194D78977D89E8787A33D6E42AEBCC023B4888990B7C54E4DCC9617FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 bb99574631c52fb932d8bc3c191e9e475d7534f852862e3fb674263ae2b6035e
MD5 5dc8faf76786c971ba4cd97980ef5cc9
SHA1 d1e543d7254cd98c31a2d864a33b39488119568c
SHA512 034d784d021da85cc6537de9df6b988d5cbde0b5278e2a2c175f6460776d69e7a3af24359d4b46f8a122be4f26c5249895d2da2b196c887dc4ca245ec318b216
SSDEEP 768:3FHu3Vwg4gxxUBsOW1r+/7ONXyer1IRCznierfEg:Zu33Ti7SIqnFfEg
TLSH
T1991327F194D78973D89E8797A33D6E42AEBCC023B4888990B7C55E4DCC8617FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 bc39c25abbc7b04cc810f0b10b404d89ca9a59a768e623f399ca7c42751b8ce7
MD5 bd8db93251116fb6a88da5f7114c2526
SHA1 1d614d21174aa18eafecd76d410dd0d7af37c1d4
SHA512 37fea0fe0c05dc0c0f9731ae9f4a0a80f7735f8be5dd410c386c4899642f98b7e3b7a50ed8fd097809d4ab72156dbafa57c0f37b9e7b7d9d488e04e26285680c
SSDEEP 768:hF7u31wgig4xeBsOW1r+ZONXyer1IRCzni9TsbXjhQflF:bu3hMkSIqnq+XNQflF
TLSH
T10C33D3B98CD3893AC8AEAB87632D6D1699BCC137F0A84494F7850F4DCC6657FE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ab1b418da71113e6daa22753ea3ff0e58ca71f52d5b11e49f69635f195104a82
MD5 b145a33c60b40609532fe28eb42c4e23
SHA1 5f41aa3209f26048679c5fc352d5632ec2806175
SHA512 c4c05db491b79d8f1647ea7a692a7b18f968cc3ee135b07fd0cdc31e83d402017e24dc4bff4b34db39381733493ec79ab0f06c841ae183d903bccf4b7a334bc2
TLSH
T1F5E00916E35280BAC46C8732448B1F552BEAE12092F207976A3106AC6C6B7516E21B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 caf73a16c456eded373846d33a507ce16ae0e698b280b4f4ff577a6309d37c61
MD5 0b016c2f76186daccb8df2664e5abf8d
SHA1 161c4f359f1d5930cedffad3b8bfa29da3d83f65
SHA512 093f01ed898081a4b904d4dba4e7a243387d4aef0c83f5c8323ed9fd9e4cf4618673e19b9b24af7a3d06fcd244b7e2fceada397071dd9ceea33303c43bdbcd46
TLSH
T1C9E0020353000069C074473140431B2017D6E12042F103575A30026C1C533411E10B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 04c0ebd8908b1ced324ac878a48e6a532d4f2e98820b59e8ed4a0f009dcdf492
MD5 4eec9e663a86ef8d01cfe71fb1ec98b4
SHA1 2ff318c0e0904faaaa6b6bdebb290001218d41cb
SHA512 734c0912d6fb411fa1c325a5f8937eb0ecca2d36d4bd539826958b103cccbb8025a0d5ff0500e93138e5d8432791634dbfcc6e6a3b8261832109af2290dd3c61
TLSH
T154E00203D31000AAC074473240431B6113DBE03042F107575D3102A82C433410E11B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8d4c75db5d550f66f852524fb460c8a246a916be73ff05196626aaf1fa39e97
MD5 122e1cdaaad233cc172f97de2b643c18
SHA1 e85d8d2451ae0be458b9fde63d5dad32c973c3b3
SHA512 a0298c674fac354b22b821992e4d961121a2eb1347419eb640b21aeaaa4a644916a13dcad631ef4ebaad3ea77dce098be22bc0a3fdbfb7342867b5cdebfffab1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a174f6feeced099626b4861a6cefa4da1cd5a032eb35d90a704aaf99a4f903f
MD5 65732ddfd2d0876f16c1d0d8f9807bb9
SHA1 24ee5511f422f0c00084e9e9450278307d022f48
SHA512 262d842edc94d7e56cad8f983b50b8484284f5938fa81e9a3659279c4cef4784bf7dd25945c3ca1f6d88ed58d38f599c5b35466ec7f6050ac7644b8bc648f433
TLSH
T115E00916E35280BBD47D8732449B1F562BFAE12193F3075B6A3206BD6C2B7916E21BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 329fe8087017ae5f642a9d9bb0f3ce02feffc798a924b8cd5870a5d1f49938eb
MD5 7a68a5830930a81745c4a384663bb6ad
SHA1 229d552272e99bc3f3e0cc0c0d26ac91218a5f68
SHA512 3dcb69c7f3900f40f6f2bd10861951e018b8eb9758b7c1e612e8e17c54a272cef11f36501412ffc9349c4032b4875f10bb6721b4ab0b737bccce79dcc0810e99
TLSH
T1BFE00103E35280BAD06C4732448B1F652BEBE03042F207575E3106AC3C637412E21BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5683e4b13104321ac23348656f045d0a78a99d8cc0543a5227ccafc06561d2d5
MD5 a30be9f543080af885baa14af199f378
SHA1 3cdeea0da972df614f81ec4364b7f8e1847deb2f
SHA512 958f8e1ce70b357daa66ab7fe37496d727807f857d572b9956f9a9fce9a96e51b161c9aa48e77ae53ff754f0c233991382c20f19f4667b1b655c183d8602ad57
TLSH
T1ACE00812A35141BBD46D873544971F552BFAE02153F3075B5A31067D7C277612E21B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eaaff0e5c93e1de3b9b2aec64541b29a7e04540a9be6fcb3b58c7e0751d6147c
MD5 b933ccf63adf1c2fae29916559c4bbbf
SHA1 136c648d16c971af5b948f2f75a368a3fc1ebc83
SHA512 5d33becf25559278d614792f35488d65dcdeb91c1b27f55ba42c7b29512c56a3fb13603990ebf66623ecb52d1b30832866099e4d09ef31b9b3652225c2d641b3
TLSH
T1B0E04802D30180BBC03C833204970F5127FAE02023F3030B5920063C7C137602E31BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 50c5f5f2238af42e4f5470f383f87548f9f0d021ba30afe2e636103b847250d7
MD5 c4578b6ae0c6e066011b9fe0d2a4cf59
SHA1 f90022373d6277c7e5427cbd80e89aa5506ad695
SHA512 697d5e1f5a317808fd44a8356a2e0e65230736f106cc2280ac2cd4a5c7c6d09fbea84f9d0f911a3b697195e30f1baad9fb14e89661d8672678631eed89e47384
TLSH
T1BBE00103E31000AAC068473240871F612BEBE02042F207575A3102AC2C633412E21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe61cf94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe61cf94.TMP
Size 392B
SHA256 32914652ae374657405952b2bca567a0d96f45fc7ab33e33e17923e2c4e9713b
MD5 344de050869f374063a0bf72de5ef809
SHA1 0010cb73153a0495ad97821a4c72570257a1628b
SHA512 0440d25e1c326a18ff833c7fec076542bf7b8cab4ba67a2e60b7f9f1727bb0e7bb7940eccfdc1f4f00dd1be552aedd3f62fc987949edb3509dde191c1d9866c9
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
MD5 c854428d46d0bd8106d3a4b26b2c17af
SHA1 3414466742a52757c163c28cc508953129b9067d
SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
TLSH
T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
MD5 95ac3c4f8946991b2f4b965a390aa896
SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
TLSH
T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d322f05184dd2161b8423b7ed8c3fe3a2f6c2ccfdf9e2cd80faaf3d22ce34d61
MD5 52c9871daeef3c7736e000fa3d16321d
SHA1 d3bfe04c46c8a4177b69d3aea1ce66f5aeaf9fa9
SHA512 df73949f72720048d650f7745d31f1d11574879ad5bb2edbf4de358e0cf9823365ccec2190dcbaf467d2605542324535969a853d9b88113980ea34532a9dda9e
TLSH
T18A4100E0587D1AD2D4BE0DBFB08B25FC94E89222F4A4743D2898ED68967E61D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf6f9a42cb2e4ca9469c59e3e413f1095e2793853e8d59510aaaa47c75856608
MD5 c4c83b8137863883b36d10904db60b44
SHA1 062a1cdb31565db40a22235312881fb5c0786acf
SHA512 ddcfb1e714150cd0ba23e9a998213d5f876ff821b1bdcb1df8fff38e681c57f6668ecf13f2f4ffa1c8ea30d2a515b2a5d83f705a4866cd4c3f36879939f59e2c
TLSH
T1463103E0587D1AD2D5BE0DAFB09735FC94D89211F8A474396898ED68967E51D210083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 560ee7e0d7557322d94bace43c28ac646d9d42fc0a2c1d1ec868ce5af83f10e5
MD5 cc1217ef5ea06f444a49dd3894b6b76f
SHA1 21acaaaedbfc70ba260bfa8a21be697d7b46d119
SHA512 8e66af3a7a11a743deeb1e553d2cc7cc2d9f3c6496515fc41b0c846b88c85a7e366c2f4e7f3d5ddc5e210b9ebcb392fd86d770cef8cf5308cea4bc35c77fed9e
TLSH
T1253164E0483D1AD2D17E0DBFB0872AFC54DCD211F8A474382898E968963E50D300083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9cf91dac77e815a9cb318a018cac9d1920e3a076afbf83173876f3b81f06504c
MD5 dc3075d50123f8abec212915cc0e920a
SHA1 4c3cc6674a628daa4d48cba7a4271c4db5e219f7
SHA512 5ad964f6001533b4e61192f1a664db2c386fd329f34ff1657a09a8d6898a3074a5d6723fe934336d6ed1b6ebb0dee54b083278eea4e46cda9d2eaf39077ee797
TLSH
T12F4122E058796AD1D4BE0E6FB09735EC94ECD721F4A4343D2898EDA8567E50D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
MD5 13fbadbf74e4028d922652c3b1fb7281
SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
TLSH
T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

38292423-49fc-4643-b8be-f189e97d57b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38292423-49fc-4643-b8be-f189e97d57b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5c12e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5c12e3.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

fbff7e7a-4313-4593-84bc-ac9fbd315428.tmp

Path C:\Users\Admin\AppData\Local\Temp\fbff7e7a-4313-4593-84bc-ac9fbd315428.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdC9B1.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsdC9B1.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdC9B1.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdC9B1.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1616_1648909548\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e6f3d27e3ccd93f8e0fdbf6e9f5dc64e36c35ac11940e03baee9bfa79a7f7cf
MD5 8acc0174dab4157f001939f14d9cd773
SHA1 2e71d479e9d631d367af9744a22d0fad5eb6b76f
SHA512 385bfb48d2eadad19f1c181c33706fef3f0e6bdf4560e5f8acdf3704e935e5ccedab446f364b91c28916a69d9c2908bc90717de89ca58e164b8e76f094141e50
TLSH
T13BD024137743073CC01034331403714C14C1C10F45054100547DD51DFF040D01D03C51
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d401de52d67583f89112dd7f66699c528bc099e397276aa2e9a0aa6acbfbac4c
MD5 57618174ee908e327ffdda24fe324954
SHA1 293706cbd4471d6d4c6aae308dc68c6129105bf0
SHA512 2665b50e62231e4ba2f94684b3f887c272518becfb85f2431f7e396656425bf3776cf6ef8bde720554ca5ca702489ec4ccd00b1d914dbcf398b687e72bd6d2df
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2aca727d96f210f0b72e52b7e3af74430ad8618f9432c6679e8b9883f0d418bb
MD5 0f6e6d718155074654054991eebe724d
SHA1 d1d98a50e4e63c6bcab6de4d53e5ce5b1f89a8bf
SHA512 2d9a25e0e8df129d72bdcd86f9ad970f9b514722d4557b1a40cd536ad557f658f27e87063c72d14863c89de334a461e8925bc42421c83bd74a35c4ec860690bc
TLSH
T142B001A8529AA112E64786B6F2928499B1784D610E438E16A8A441AE991378D9A01AE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bc9d4.TMP

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5bc9d4.TMP
Size 48B
SHA256 f6dc8364b3bfefe629847d6ab929b67ea027464b724fa89d52d80eb97c0aa916
MD5 e1ac25b6c63d67e8ead7f8d6846cc0af
SHA1 dff7e1fb1eaa91ea57980355a0a834994011f7d2
SHA512 8db506ec6ae0f39ad636491f4df4c2b68f153f54db533127891141e9179c03863bfda6be17d53bac1b46517365ce406f4b9cb3c86d4712391be4d2a17ba1179b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 21459c256b40da053c04a1e1e4f311a5c67a745d9c5b8b0becd236656a88623f
MD5 720aefeee18dee2b3854d10774ca3f48
SHA1 e0bba42dee4fc6f3e88984e48c2e278bb9491bd2
SHA512 929f0b7d0bef512f27b37d4ea68fe1ea4719a6aa2b24bb94209d808bba9c6d8e7e84528203dc8291a873ae95f22f6deb41d16fd2e5997564c0b447e931bf1198
TLSH
T15B216BA243F0C67D8A4166E426343D17CD2D0519A3286D37CDDAEBA66BD24B1D11064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 d363c5f56c78539d32f138ccd132f640f96bb42ff12ccaf6861c8ad0cec34d1b
MD5 a47307be1607be042ff7bfcbdb6f522c
SHA1 161808a315b1722ecc393cd5d46e931cd74641d5
SHA512 4d0097f0be496cd0b7eb0486d43bef07d80e568d4e19e97761ac7e97dd08acc8107c2fef60f5eeef9abbd5000168d98e35ff6aeb9e8ade9749bb07bd81293d18
TLSH
T181113BB643B0C57D8B1166A426346D17CD3D011AA32C6937CDDAEBE66BD24B2D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 bc6a4203d62407ba9ffaa539c305292e50486e4173d7905ba05cffaa8355b2e4
MD5 33de2d1f8fd0c0371adb50c89ce6abb1
SHA1 6e8f5280756b89a57a7b07e32a2d2928c0804411
SHA512 cb6466f3caf9e7488fb6468bad2dfc938b0fe5c8bf0a66b2a4c22156c17cb5cf4f2a2ad1c733864bb8c4997a6bfedd7853ea8f9541728261da8786adb563cab3
TLSH
T1D1113BB643B0C57D8B1166A426346D17CD3D011AA32C6937CDDAEBE66BD24B2D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5c8237.TMP

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State~RFe5c8237.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 c75187085262e2788712eec7bdcd700cb42760af49a7dadbfb62790854d48458
MD5 ca03c5a28eb871b9779fdc1d68e944da
SHA1 4ebd10734583d9058d32306b9cb32d8879417c9a
SHA512 c865202c1a2661197f42f568f1732d29d807f63ac4f43c6b13061d78b089b654077a2dd969195f9ddfdfb33f8f58177a51047434cd3046a9b6f6dfe2cda7fda7
TLSH
T18DF024E791BEF56B206C1E7A2C417C065F36E433319168E0DA96956D70C21E74A12466
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 024d4359b10b77c01893a193bff6f43c3e18265db6dc44c2cd78416aa77d19a6
MD5 e1b345e4c2bc06f53467f41464c05d76
SHA1 44dd5929fb0d9f91e743207214d9fe8751f01d6b
SHA512 b9506c7c2f9860af24bb3e3df37d3acc871d34006ea6ff0670d31e9a97210f18e05cab126d01d20ab7fb39d6b895de640011e6bc6aa355e967039548aac49af5
TLSH
T1CAF059A790BEF567206C1D3B3C41BC521F37E03721905CE0D9979A6D70C21E74A0A867
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 b0c260164ef7c5ca81e36372fbf6df8214881c4bb995fadb79ceed4a3b9e789c
MD5 2bc9e5e8c34127b562c8c95bbe44a558
SHA1 b21bc514c634fc35a1d308ae4e2a94b098ff2a97
SHA512 3ba911c0ae8084ba5a63d67d0905bf25051db1c146365e24cef9b6c5f48984b2962724aad4398f845bbcab74a567cb8a6524c2bb6d2e79d964c3d383e719dd94
TLSH
T164F059A790BEF567206C5D3F2C41BC521F37B03721505CE0D997866C70C21F70A0A866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 1b057e1579e7a5e97a4420faadca7c153eb9f080d8b1eb8023f40d08871a8cb3
MD5 352ac253e977056542574650c1931303
SHA1 bb6b2ce48ebe1e8612363f5022a050c445a6c439
SHA512 bf435b665d38ed2c75c26c6b7afbef01b9b5e081add49c4b4ee84d36b93d463957cc424296d7bb3aa91537990b39dca190cb0d2cc8fe36fd4c6a42c55df510ed
TLSH
T194F059AF917EF567206CAD7A28467C125F3FE53221812CE4D982816C70C21F71B074A2
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 6a697c05a1632f162ecb4e8cc5384fc66630903335cd953bee19d6e9c08d2156
MD5 6986336742fdb341753dc05d23bcd4de
SHA1 80efbfa58a5b69c0c33b9ba5c898c66d360a95be
SHA512 604db331069507f5dd4c1dd0dbf1804e2ee8255c140b9b85166d138c838387fb8cccf49bf076da27899983fcaba5be417a3d4c9b8ccb55c22c618a6269079e60
TLSH
T152F0C9A790BEF46B207C0E3B3C417C021F32E03662816CF0C987892EB0C21E31A03427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 3fd2373a69846640ed46b9a3fbbe8ec5ca1089458ed2bdfec11dec8c7545fb77
MD5 4a1be1b2ec5f5e122c33c2fb1c221694
SHA1 bbef034366c1d50a0e2a3aec73c27828abf809a4
SHA512 7e7417f7341e0b72611429ba18a26124b3d2c1a497aa36a36b84e8586542351f0c71744287b410e6b1fd8107fa0965808c6cd2f62d306b240ea5eaa331da9d85
TLSH
T187F050AB917FF56730AC5D7619457C565F3BE13221812CF5D542416C70C21F74A07461
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5bdb39.TMP

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity~RFe5bdb39.TMP
Size 524B
SHA256 f37872642a21f0df4da6641fbfc16c71220d6763b925f08e9b337de6dc267869
MD5 15c051b8e98e48c375dde163857c8a64
SHA1 59517815ad6c6ffd2b4aec88bb8ea72e41967104
SHA512 5f65643badd71ffa89d23914834635dc5c1bac8d91f84d31e1b55c4af983a79a17b4a617d61c788d6104e0e3c3283cdfcfa78b79c5b476f51cd314fcac4bf56e
TLSH
T1D1F024A7A0BEF567206C2D3B2881B8521F36A03721505CE0DA97966C74C21E71A0A467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Preferences
Size 6KB
SHA256 868e3a3c52246277f9950dbd97db0a81d7fda00cd245cb86e63e69aff77df659
MD5 7df66714ecb234d1afd4f0cc326626d3
SHA1 89a84834f7e026b660f56f29e307f008f41c593e
SHA512 a21b2f6de3a02cd807c5fbc9fdea9ca855b3cfa38c7823098f5298485b0c60eb12c2ff6cea91dee20d86707fd96c8660d0e8733c5fcb369610bd6683ae18abb9
SSDEEP 96:stC/d+N3GSb9Qk4o5h16Z0ys7/x+6MhmuecJMcf8TjeMK+g5LrK28XM1C7K:staIcbonysV+FdMcqjg7LuG6K
TLSH
T1DDD185025E24797B4CC6E51DFA397A13E2F5606261911E48EBF9862C05DB7DD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f15de596-76fc-4d50-94ec-d0b0b875798f.tmp

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\f15de596-76fc-4d50-94ec-d0b0b875798f.tmp
Size 6KB
SHA256 c981110440a099c15e9c238dbe95eee04fe245201364ffb2792c7a44b94dac21
MD5 f79ed24fa9f82b6f403a8340cdd92496
SHA1 74c97cbc8347593a3439ac2a94424de5cd474da9
SHA512 8eebf9764e2cd48a2b7326d21bdbbbdc35398ad0736a4ce89774cfdb9b372d9e849a5a67697293bf18406e8fd2672ef31e3ef9a37e53bdf54b2cc62fedb064f7
SSDEEP 96:stC/d+NQSb9Qk4o5h16Z0ys7/x+6MhmuecJMcf8TjeMK+g5Ern28XM1C7K:staIKbonysV+FdMcqjg7E7G6K
TLSH
T1C3D195029E24797B4CC6E51DFB39BA13E2F9606261D11E48EBF9862C05DB7DD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 15KB
SHA256 620c593a04343124911b6ed7653c1d8361399efc86c1bb13a27701c5c496fcd9
MD5 b2387d50feb38d383af963c08e761487
SHA1 d83abec84246bf44050b9df3558821539acdfd0c
SHA512 039f394bf8815678a2c82a9e48d6de3f7f86684f6455884786e7416fe4e2536eb59a5af073455d94ad5081e98b62b5deac12b2fe334dd383915926d446d571f7
SSDEEP 384:v+aQikB+z/xvxjg/qhEeNBSNommgd4ep9z/:+/UxvxjgC+sjI4iF/
TLSH
T1FE72AF2795797E23A9F3E505795D074FDBB884B291C26EA40AED5F0D03C73981306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 18KB
SHA256 4a6e83676d81eda4b036c866e5d911afba483360ea12c27e3302af09eafc1ea9
MD5 13bdc94f8839ac7be9bcc6588a86003b
SHA1 9dc8bcd5694abb629fb4ebf406bcd4c607807bfc
SHA512 4a6c6e9c402c7029e89d15574fc37893649af9bc1b28f41408ef9a63176c558d413272eec0ba111c493e944f0857e5ff8f36ef2f479b8d7f4d0aa0acfc6399ab
SSDEEP 384:k+aQikB+z/xvxjg/qhEFNldpymxgxmj6yWgd4ep9z/:D/UxvxjgC+QlU2yWI4iF/
TLSH
T10482AF37D979BE23E8F79905664A179BCBF485A261C11EA84EDD1F0C06C73ED130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 15KB
SHA256 4e31d5f3d8a15fe05df24b7e0b2255be006b8e6f619ae648af15d71c380d5eb4
MD5 428e255dec31ff4ae6ee92de97cb4f28
SHA1 634d96c5b599f56abd42271952ef6d6728b79884
SHA512 44f9c3acb2ea4e900a9c70482f3a7c9a7b3fbe95685e9a5c0a9fd852a33fde7e3ef2b6262a73b3558abd3069417db1303c4138694889fa51a2e09ccf9afdfe4b
SSDEEP 384:G+aQikB+z/xvxjg/qhE2NBSNommgd4ep9z/:R/UxvxjgC+kjI4iF/
TLSH
T1B472AF2796797E23A9F3E505794D0B4FDBB884B291C26EB80AED5F0D03C73981302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 2KB
SHA256 17f9af0548b38d447c4b85fc72a6987d6ce7815baa3d0f1f2ff15d6db2214a40
MD5 9adb191d39e1f544b3103be0b20a6cc7
SHA1 b141a9c81504f160524533f4214eecb969e5d21e
SHA512 8dfcc1444341687e76885f5cad42584968208e190db05af9264025bf03f608049fd2313af0b7c4fa785bc9dd94b0fb268e0abf08b6b8989cc6bf825c1470655e
TLSH
T18B5194336D246F338DE24A05BA4A3B23EE3581A2AA422F5157DD0B0D42DB79D3311C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 3KB
SHA256 94dbe0852f83c462e62dfe453e76f0aaf8a1b9c297134e7ae5e1a09d05a71c46
MD5 f4f2da5ac43ebd01e88be0addc9b4642
SHA1 04b8c2f3bd85d7ce600a1eba318883f9a9a850b1
SHA512 aa9d9bcfec4660b561d4441527d29d41c3c29e3bd3fb999ef0e9abfb1856898bb29cc240bd63135a736f463144eaa9dcd1a4d085f2d7ca75d3cf4d808bf5f9d9
TLSH
T1366184336974AE278DE28A05B9863B12BBA54163E9823F95C7EC0F0D02D739C2351C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
Size 18KB
SHA256 8848a31c7c10ed3cf4812b90fdc6b3e80986dc938cd66c608c7fb1bd9a2d8960
MD5 dc73c4ba1296f07533a63e81dd036bd8
SHA1 953794c2f3194635230b1421f4988868f5d6253f
SHA512 74998ed0d1a9260ee2f61654f5ff6f8fb16fdf0ee1a9e0f48173ac29cabbd0e087c32ccaca22cc8cde587fd639e6074d34839ac486db5cc756a93aadd7eeff70
SSDEEP 384:b+aQikB+z/xvxjg/qhEeNldpymxgxmj6yWgd4ep9z/:6/UxvxjgC+9lU2yWI4iF/
TLSH
T1FD82BF37D979BE23E8F79905664A179BCBF485A261C11EA84EDD1F0C06C73ED130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b6c82.TMP

Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State~RFe5b6c82.TMP
Size 1KB
SHA256 93fdc731e01f6e0134c5fc0c736c6df4cd8490c9efe516285de82653277910ae
MD5 c99535d51c6577f7a8f829bce83ea78e
SHA1 5aebb20e404f9b12ddfa55fdd6c86fd2c773228c
SHA512 d716ae36bb73feb7f4513a5b75ad8e63172951f47c97a50ec187210995f3da761f741c7ba277e703411e5a0f14a43377dc297d19a8b509603a35827e2d197324
TLSH
T1F32142B3D9B41F23AC921207725636576E3041A692418F0413DE4B1D42DB79DE225C37
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Furever Dock.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Furever Dock.lnk
Size 1KB
SHA256 15d4412ca610520e9c27bc03d1a1dbdf11c515085408f577ae2cf7866323efb6
MD5 6c9d0082a60024956a59ce9a4a9a233a
SHA1 0f31d0bb2a5d9b510e3ef66d24a03d35d16ba701
SHA512 326b7df5bb1fceb55b9e88d8e2371733a19f28a0a4d88cdf707180c866f447680855e00413ea89cf04e18665d53bc4717e9db265969aa173a5c8e6ea981320db
TLSH
T1A0210D42DBE80710E2DA813526FB130AC5723CD2E7BE8B8C0160D2112C35A939D85F9F
MD5 SHA1 SHA512 TLSH

Submit Download

Furever Dock.lnk

Path C:\Users\Admin\Desktop\Furever Dock.lnk
Size 1KB
SHA256 06fb5a36a0614cfb53e06c3f5540a1ac5ad1ddc22e99ddbcc2ae7405e69568e3
MD5 f3e26c27f190dab69639e2b43653dc54
SHA1 a4960557e4a2d7e8e3220307a2790373ef3822ab
SHA512 9120885fdb689fbb26dcb73712464365282c08ff77296c03979747e826581ae09dfca70984351a6cb2d0f95754c13899c267ffeb02e3bc7e14e14533720fe967
TLSH
T1F3212042EBEC0210E2EAC13526FB130AC57138D257BD8E8C0160D2112C32F939DC5B9F
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_24310590\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_297086709\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_297086709\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_297086709\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_297086709\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1616_601505646\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1167056524\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1251572283\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_1324569814\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_405584513\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_405584513\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_470353306\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_470353306\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_629904015\_metadata\verified_contents.json
Size 1KB
SHA256 721a6439a0b19869aaace755c9e795f83aed516e4b42d8a13f4fd978d0586d18
MD5 61be80a9c93aef9160d69c843d290855
SHA1 b4ccbdc935f95400b730d1c9b00bde4dc5146872
SHA512 8754c4795a7cef4acb6a90807614ba2c4bc2e9e7e58bbc9944c0cbc121d88f19b8a5f349582dd968738f10324d0652e904d28dfa91646f4f5064219e8f047fa5
TLSH
T1B73119A4C40EE21BF5BF33252E593E3F0717A1DBA1D8E7236690145F10C4A4E9313562
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_629904015\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2352_629904015\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2508-892-0x00007FF924A90000-0x00007FF924A91000-memory.dmp

Download

memory/2508-891-0x00007FF923C30000-0x00007FF923C31000-memory.dmp

Download

memory/3236-1166-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1160-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1170-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1169-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1168-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1167-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1165-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3236-1158-0x00000188ABEC0000-0x00000188ABEC1000-memory.dmp

Download

memory/3408-196-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download

memory/5100-306-0x000001F204E80000-0x000001F204F28000-memory.dmp

Download

memory/5100-119-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download