vidar | hxxps://omgxplolts[.]com[:]443/nexomia

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://omgxplolts.com:443/nexomia
Sample260826-dh8dtsytas

Score

10^/10

a6d2471547d36419d2976bfb5f58f7b6 defense_evasion discovery vidar persistence ransomware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

a6d2471547d36419d2976bfb5f58f7b6

https://77.42.69.149
https://telegram.me/s11yne
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=roAjr
https://steamcommunity.com/profiles/76561198652917381

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	NexomiaUI_v6.90.427.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	NexomiaUI_v6.90.427.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NexomiaUI_v6.90.427.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	NexomiaUI_v6.90.427.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NexomiaUI_v6.90.427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NexomiaUI_v6.90.427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	NexomiaUI_v6.90.427.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	NexomiaUI_v6.90.427.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1292718150\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1292718150\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1578759462\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1520387199\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1520387199\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_2142461537\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_2142461537\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1844794602\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4812_471227983\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_2142461537\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1188638167\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_393533272\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1520387199\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1844794602\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4812_1844794602\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1700	chrome.exe
3492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NexomiaUI_v6.90.427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	NexomiaUI_v6.90.427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	NexomiaUI_v6.90.427.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321869666237775"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{BC8A9DE4-0DDC-4D7E-A443-D2F16E714FCC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
7084	chrome.exe
7084	chrome.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
6176	NexomiaUI_v6.90.427.exe
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3244	3900	chrome.exe	88
PID 3900 wrote to memory of 2040	3900	chrome.exe	90
PID 3900 wrote to memory of 2040	3900	chrome.exe	90
PID 3900 wrote to memory of 1700	3900	chrome.exe	91
PID 3900 wrote to memory of 1632	3900	chrome.exe	92
PID 3900 wrote to memory of 1632	3900	chrome.exe	92
PID 3900 wrote to memory of 5904	3900	chrome.exe	93
PID 3900 wrote to memory of 5904	3900	chrome.exe	93
PID 3900 wrote to memory of 1172	3900	chrome.exe	94
PID 3900 wrote to memory of 1172	3900	chrome.exe	94
PID 3900 wrote to memory of 2420	3900	chrome.exe	96
PID 3900 wrote to memory of 2420	3900	chrome.exe	96
PID 3900 wrote to memory of 3124	3900	chrome.exe	97
PID 3900 wrote to memory of 3124	3900	chrome.exe	97
PID 3900 wrote to memory of 5496	3900	chrome.exe	98
PID 3900 wrote to memory of 5496	3900	chrome.exe	98
PID 3900 wrote to memory of 4364	3900	chrome.exe	99
PID 3900 wrote to memory of 4364	3900	chrome.exe	99
PID 3900 wrote to memory of 4788	3900	chrome.exe	100
PID 3900 wrote to memory of 4788	3900	chrome.exe	100
PID 3900 wrote to memory of 4500	3900	chrome.exe	101
PID 3900 wrote to memory of 1208	3900	chrome.exe	103
PID 3900 wrote to memory of 1208	3900	chrome.exe	103
PID 3900 wrote to memory of 704	3900	chrome.exe	104
PID 3900 wrote to memory of 704	3900	chrome.exe	104
PID 3900 wrote to memory of 3920	3900	chrome.exe	105
PID 3900 wrote to memory of 3920	3900	chrome.exe	105
PID 3900 wrote to memory of 2824	3900	chrome.exe	106
PID 3900 wrote to memory of 2824	3900	chrome.exe	106
PID 3900 wrote to memory of 108	3900	chrome.exe	109
PID 3900 wrote to memory of 108	3900	chrome.exe	109
PID 3900 wrote to memory of 260	3900	chrome.exe	110
PID 3900 wrote to memory of 260	3900	chrome.exe	110
PID 3900 wrote to memory of 4256	3900	chrome.exe	112
PID 3900 wrote to memory of 5796	3900	chrome.exe	113
PID 3900 wrote to memory of 2696	3900	chrome.exe	114
PID 3900 wrote to memory of 3388	3900	chrome.exe	115
PID 3900 wrote to memory of 4256	3900	chrome.exe	112
PID 3900 wrote to memory of 5696	3900	chrome.exe	116
PID 3900 wrote to memory of 5696	3900	chrome.exe	116
PID 3900 wrote to memory of 1916	3900	chrome.exe	117
PID 3900 wrote to memory of 1916	3900	chrome.exe	117
PID 3900 wrote to memory of 3292	3900	chrome.exe	118
PID 3900 wrote to memory of 1556	3900	chrome.exe	119
PID 3900 wrote to memory of 1556	3900	chrome.exe	119
PID 4812 wrote to memory of 5680	4812	msedge.exe	122
PID 4812 wrote to memory of 3492	4812	msedge.exe	123
PID 4812 wrote to memory of 3608	4812	msedge.exe	124
PID 4812 wrote to memory of 3608	4812	msedge.exe	124
PID 4812 wrote to memory of 3608	4812	msedge.exe	124
PID 4812 wrote to memory of 3824	4812	msedge.exe	125
PID 4812 wrote to memory of 3824	4812	msedge.exe	125
PID 4812 wrote to memory of 5988	4812	msedge.exe	126
PID 4812 wrote to memory of 5988	4812	msedge.exe	126
PID 4812 wrote to memory of 5988	4812	msedge.exe	126
PID 4812 wrote to memory of 5728	4812	msedge.exe	127
PID 4812 wrote to memory of 5728	4812	msedge.exe	127
PID 4812 wrote to memory of 5728	4812	msedge.exe	127
PID 4812 wrote to memory of 3612	4812	msedge.exe	129
PID 4812 wrote to memory of 4384	4812	msedge.exe	130
PID 4812 wrote to memory of 3612	4812	msedge.exe	129
PID 4812 wrote to memory of 3612	4812	msedge.exe	129
PID 4812 wrote to memory of 4384	4812	msedge.exe	130
PID 4812 wrote to memory of 4384	4812	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://omgxplolts.com:443/nexomia
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc5eddc728,0x7ffc5eddc734,0x7ffc5eddc740
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,17361973712178390330,6706274596616093463,262144 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1276,i,5637476496290503615,9045563306468980094,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,16199090207021715700,5188046370557198681,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,10474813563581322867,4323315410610300664,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,11498645996798075235,197523918578913749,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,7498393762023202692,14845013097120959114,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4872,i,15038472789502314563,1572841451225472545,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4664,i,7863862419143298300,396343219915846278,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5164,i,6817898435891847925,5099643240761242258,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5324,i,13125337562394943328,9277091630002569015,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,13696237323823869847,16385807190492915168,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6184,i,17868322945527006562,4055519396070218073,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6152,i,9493910534522853167,11769910777097348446,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6568,i,9820786808036404381,12822651085371268434,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6548,i,12582102668416598488,4551123082941075548,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6340,i,17711885022202157719,17322622312370544469,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6476,i,13574613983586065820,5190475617906740050,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6800,i,6328605127495957876,13743512562087960945,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,17893420122782533776,11871965748964629299,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,1344685005219904539,9473031078045961252,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,10810274148495713582,4620635648904338277,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5232,i,2166867213255200676,14678538330925052623,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4844,i,779924657331602688,16881014986420975668,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,732761991401007709,103968895823177445,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6544,i,16429856103254089856,10981193293684912963,2097152 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4904,i,4804622658248747352,5131132884533292276,262144 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,6883577805726579852,11482004062155407127,524288 --field-trial-handle=1908,i,13507385334531472196,12644783799988502260,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:6244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffc3c83c188,0x7ffc3c83c194,0x7ffc3c83c1a0
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,210886949789460971,13856284680226650847,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,6580608003837007609,10270972941774508601,262144 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,1574605806723272777,4855641828900355144,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,16217848412412227464,2280109252348549417,2097152 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,12749552449208452549,16724568882813718174,2097152 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,14791663237770590002,1636058357121598592,2097152 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,2542914816261181470,6696720683115784103,2097152 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17981227058511466510,11960356792699765746,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6123700199015583808,9148044203504709239,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,18370494889611970274,8771660826637290496,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,8656565425048895284,3187998564512889733,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,8656565425048895284,3187998564512889733,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:6708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,7864177045553274379,13683199269426286984,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:6616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,14212403482341762647,14131293431697503266,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,267827141714957166,883130150040642585,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:6760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,488947537074259269,8203036860392171864,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:6884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,8257141634657973483,17876429296424025673,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,7156304318510991451,15136252588842171488,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,15447230659132251139,12233121635829870322,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,1291622258254347522,18014007756035493762,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:6688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,6094454753575561242,5003724639011512237,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16502990473732147176,2164634943114270625,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,9441933159303028644,15575503889957675579,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4908,i,7430559081467792999,8060285522955059502,262144 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,13320952968177559542,12142715982228650774,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3143461889876221048,16824632717450628269,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,5889591387088897550,1377168884335616249,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8192778998873441493,18352435849757686084,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,16226423249558136648,3045614152922693952,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13309334335455056491,8609833285229281873,524288 --field-trial-handle=2260,i,17623056498473021740,6944085028587384007,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
  2⤵
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6848

C:\Users\Admin\Desktop\v6.90.427\NexomiaUI_v6.90.427.exe
"C:\Users\Admin\Desktop\v6.90.427\NexomiaUI_v6.90.427.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 44KB
SHA256 61e4c391e924f9956aa54005c7e770f1b9ced2540a168e4e5807c8ca5f7ff9f6
MD5 313acb1a6dc55cd2194f1e768e6338cb
SHA1 0fcb1aeb6333de8931765d89e2973b953ce9c489
SHA512 c4460e39dc20330717747cfef0d7051bb55093b6af4c0bc4f7f83d48c08c6c69a17a3936b2fb98ef7a72c1801e39c4c21075d54e6ea6b7674eecad6eea540e2f
SSDEEP 768:0Wp34IekbYvRoox5HSc1MyzWJXAzzp8flQKYIU4vO4ScbqHO2wWst2WaN7:05IervRoo3ycMyzWJ4pwlxRUEKFw8
TLSH
T10D13F1D3DDD04697E008EC74E74D18396AEF103D0A0C708CA57AA94FB576B9A29688E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 46fb1da874427c91a3f08716947465e5c5bebd0edac8fff283c776197688ae2f
MD5 b90e76600118097cbcaebd21cc025f78
SHA1 1ca29ab6046bd1e731f203a7bc012b74d8b62a5a
SHA512 e3fe49162e890dcd59941dde9a900f9a89f535e9634e86af89e8b2885d8a19f6a06ee9fb846d02e8f5ac50bf3606209bbe46398ee77033e97ef158c58936087f
TLSH
T18BC08CCA13D88002C7AA59F031AAD88526B6386921CACA830290619F0203AA16041C32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ecb3f0a46a5b5a6450a188858a937a5846f8f3229dac8824293e9da87f7b93bb
MD5 8a9dc1223ce978b276318b89b4d6db8a
SHA1 a93a0e92567c0ff6ea860d8532ccdf2603cb6096
SHA512 2a4845f5d503608d60bd54904b41572cfe3ae55aed7a8895af1efa7fe24454afa70fcae24cbccbf35f2a8f775ecfedff723bec953068c392a5861b2aecdd0f59
SSDEEP 192:DTl7rbyJQC1eFdaIYE0arQ6+sUmNl736yW:DTl7rbyJQC1eFdaIYE0arQ6+sUmNl73y
TLSH
T13FE18EF7C7E4866DC81156F4AB156E1BCE2E0928422C3C76C9D5EF4B53E2472D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5b2051877cd690846bef61042243fdafc31297d37a3a34da6ad93eb96de45e0d
MD5 c1718061935aa543a67fcadb337756a8
SHA1 fd4223d274b28150261d2624dc18aad377e416a6
SHA512 e1d410dfb0109dbc19a9df507dd40e7dfeac197d5825e0d1041df5d0dc6ca2589f6f30574450ce69299cf3ca5979add21a25572c137442c4f2fcfae29541053d
SSDEEP 48:YALl2VSJP2Mx48w448MG74VG/hwnqMZqMghG9hVB48M5P48GqaXYfoKs3xYJzsMb:DTl7rbyJQC1edaIYE0arQ6+sUmEjDl7u
TLSH
T1C9D18EF7C7E4C66DC82156F4AB156E1BCE2E0918421C3C3689D5EF4B53E2472D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 236261bc070830d40cb10f36625f052b39c6777b5a61fe4180ecd4669a535ef0
MD5 2aa56d383ed433647e676c2161eaefa2
SHA1 a00fd49d45a7ed32337c5aed0ab0319bb61badea
SHA512 f1ca03253dd43ece2bfbad1b21182bdeeca4627f7248c646cc9f81c8ab42bb63cfeb622bd3361aec43b520a5a9d4a17b1c35c8bb419c8297a89e1306c1dab051
SSDEEP 192:KRAdor7v7xkAPRp2fmG9GHsb+WNwSl5pahmV28LU25lcwe8omaotVyIsnAUgR:KRAdwDfX4gwou2R25lcKao7R
TLSH
T1B242B82AEA206D3B6CEBC619FA667753D7F5102671902E84EBFC893C15D36CC221B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 295ae9a8866ba8bbe44aee718f507c1fcdd5fe2ba21a0fd078a6c7c712e27c4e
MD5 18b15ec60f8cb97615b8f8d7c1de0111
SHA1 37d1849d1ea2067bccc4ac41eabdfc1474705877
SHA512 e04c34d0c22922de20ae4efed60d47d8f69f0ea84f3ed2ac997b1b2ed39b3834be48f39143e8bac613d72c91e22e48cd512f4cb758ed51d6b3e028e314dcb472
SSDEEP 192:KRAtohuv7xk6PRp0Q4LmK9GHsb+WNwdrLA1l5pahmViKR+Bu2NU25lcwe8omastO:KRAtIK1XEgwpSuFl2+25lcKas7E
TLSH
T16B52C85BE9206E3B6CEAC619FA66B757D7F5102271902E84EBFC8D2C10D76CC211B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2dae1e2d5dd6d4ee953cb09459c6d2d9c5a6d3bdeb0a8103a18aff5702e0b963
MD5 a1f147b29df589ba0366de8ddb44ec58
SHA1 c260e4604267cd97b45a69e9c48113c83b2cca30
SHA512 c7f21f41247c243862748633c6900092af26df6a524602f17091dbd3974e9866aa03ec8a6c7c5f9943fa4df39f0ffc433356c147fe314254d5352f4a49900ecc
SSDEEP 192:KRltohuv7xk6PRp0Q4LmK9GHsb+WNwdrLA1l5pahmViKR+Bu2NU25lcwe8omastO:KRltIK1XEgwpSuFl2+25lcKas7E
TLSH
T11752C85BE9206E3B6CEAC619FA66B757D7F5102271902E84EBFC8D2C10D76CC211B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7b8ecb027d52a738a5fcc7e4fab3916d1ed345312e815941ffbcb13585c67336
MD5 5cfdae37bf670f78f01061b739af76b8
SHA1 ba1781cfca63b2d3c608e5be214b837bf0c9b0f6
SHA512 aeb0455681fa21c1877233839d6e52bab2a83acb0a6ff186f23c2b58a9e84957ebef714a5c61f4f85429e057b386e24838e8379fa3482f9e830896f9589247dd
SSDEEP 192:KRAdohuv7xk6PRp0Q4LmK9GHsb+WNwdTl5pahmViKR+Bu2YU25lcwe8omastVyI4:KRAdIK1XEgwzuFl2N25lcKas7E
TLSH
T1AA52C82BE9206D3B6CEAC619FA66B757D6F5102271902E84EBFC8D3C10D76CC221B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d08e0f8d2ae07ea8a43de3f1fb76fc1479e935435db0b467810e2e148da1e107
MD5 868f6039e25ebe39c11d4069c6d92dab
SHA1 102df28627e9c0eed38124590e5ce6808802a91c
SHA512 b88a68056be7145899e83a87d9a5eac680665f94cfa6a674066d037a9cfa0dcf5657417d106a8a10c826c52612ed315e9a4b875ba92877b5679bdd239c0bfa58
SSDEEP 192:KRAdohyv7xkAPRp2Q4LmG9GHsb+WNwdTl5pahmV+Bu2CU25lcwe8omaotVyIsnAl:KRAdIefXCgwzul2725lcKao7R
TLSH
T1AB42A62BEA206D3B6CEAC619FA627757D6F5102675D02D84EBF8893C10D3ACC221B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2de375baf1458fc9387804c32acc03f7ac0af0f134e32d06bc74d2c8bcb49148
MD5 32100de5111a70873fcab3099c448056
SHA1 f1fbce40327a19bc290279694d2b8655f0430cfa
SHA512 ee43c8c1362311d242b6c9f39dd33e2cdbd189d99c5cd9183c5d224243bd4c91a428fdeccd6b798379d111a8ea6a29c2e39a3a79836a5a2a3b044745b6dfb0b3
SSDEEP 192:KRAdohMv7xkAPRp2Q4LmK9GHsb+WNwdTl5pahmV+Bu2AU25lcwe8omaQtVyIsnAl:KRAdIYfXGgwzul2l25lcKaQ7R
TLSH
T13442A72BEA206D3B5CEAC619FA667757D6F5102275D02D84EBF88D3C14D3ACC221B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ec5009a28ada471894b423a4bfa470fd7c9b87ca8111711ca9a6c54046909489
MD5 ccc03b00459707dee7fc95b889bf3a0f
SHA1 3e30b7e86e14518c75f9cfef45126138d33b8586
SHA512 fbf3390129b99c5b7dd3b5bcd903a535ad9cf3dae97784c757fbecbae31a8d334d2d0ce031d7b334b0f7fa3e377684322a6ae850683285ff5152ae0d7d608f16
SSDEEP 192:KRAdohuv7xkAPRp2Q4LmK9GHsb+WNwdTl5pahmViKR+Bu27U25lcwe8omaQtVyIP:KRAdIKfXGgwzuFl2425lcKaQ7L
TLSH
T17D52A66BE5206D3B6CEAC619FA667757E6F5102275D02E84EBFC8D2C10D3ACC221B447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 39d255193b89ec79a0d755b55ace59820f056dc1997628403b5337928b2d68bc
MD5 209bd34ab25f2f0cbd7c4b69389910c9
SHA1 2b6df13142bcbb17617fa42876ceb610464f0bb0
SHA512 2540fbbc33e0e1d48cb3919ef7b40a8da8540196c7bb29916eb894409beb1425188409e386574fa76e714e8e7b753be1f77d764d38b04141abd1f9201d00bea6
SSDEEP 96:/bJod+CVgOeTnnGBfYZS63/NASl8h4otop5y5DrB6zGGfvhyYm8f+ca/kJRNC39v:/toJeGn9iU2aVGv3tWcaMJuCEM5o
TLSH
T1D3C1F8B1E05DECBB4DF6B88AB1422D43C8A5216FAA157E58EEE95F0C01E60DD1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d4ad44e0db760c0b2e67c14017d36c9be4cded5a4108e419169ce946bf07c827
MD5 623b5bd6dcec17d2a2fe155eec7cd9a5
SHA1 238c646be2594f02584bc7bf7db5b2b1733780f2
SHA512 2df319675584f7eb37d2e4dae6d599c232a2251d44812956743d568a1084c8078c74cc572ec215d70ccace3b6d5320371ce845b06561da118ab1d8fb6a6b09c1
SSDEEP 96:/bJ0d+CVgOeTnnGBfYZS63/NASl8h4otop5y5DrB6zGGfvhyYm8f+ca/kJRNC39v:/t0JeGn9iU2aVGv3tWcaMJuCEM5o
TLSH
T146C1F8B1E05DECAB4DF6B886F1022D43C8A5216BAA257E54FED94E0C01E64DD5383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 a5d747b806e985218a68b10b977099ff17f23cf0da6501651b5cc3a13fc1ac0d
MD5 91ac11bc12c7622b7050f58d74051ec3
SHA1 edce1b9fb1285a8bdc4f1a4a82dc6850e95b268e
SHA512 d324af3290976a99bb4e7857856b2ec977579fd490c7f786a4ff408c229ef4cb1da1de7290edc96660752956a9eb5d0cd032771722d530a157b35c2802ff6a61
SSDEEP 768:FYWGvZl2bQp1e/1O5CYqbJ0kT+5hjE2/46srrqV38GAzxD2RqP/kfE3ibV1A:+1SQDe/Q5CYJu4hjV/cQ8GMD2RqH5izA
TLSH
T16913F1A4C0832D6B5D24BA16D500218D6C61246F6E11AF887EDE5FC8178FEDE93736B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 240d73bc27c5ebd94c91cded36e00395d5441af639fcf5bf58380cc98d4a3bda
MD5 a7139db2d09a6ec4fbca7133934513cd
SHA1 d627fb4581202eab30be77271965022d1bc010d3
SHA512 57c13651062bcfe361b83da702e588e3273f572d46302c30407457ffd8ebeaf27b0a5bf6151e6cb29284496ca61d1c1a0612ccd2a71ce159d78183d7b6edb954
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5ycDrB6gGyvhyLfOL/kEbZP9v4a:SC0JeGnpDUD5VE1mLMEbj
TLSH
T1F0A13C71F02CD97348BA9889F9822B43CDA521ABDA31AE44EDC95F0C42FB0EC0346437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1987fb23c7bd2815944e7ec1b31c54638c7ea65af98016331c74b24140e2c220
MD5 f32dec323462749a2c0d92a428bdf950
SHA1 dffea864dbf3e84d30abadaf62d75b6499ac4f26
SHA512 0100e75b6e6fc55545e985a4bb41b759bdd91e141b9cc0424b16000cd128867ce5bb19334070b422fa5593e09f850269d8de400301cb427f4441515afa61d7fb
SSDEEP 96:7C0d+CVgOeTnnGBfYZS63/NASl8h4otop5y7DrB6zGGfvhyYMUGsakO0AGXHf+9T:7C0JeGn9iU2wVGv3MUGsnW9aMFUm
TLSH
T17BC13B71E46DAC734DFBAD59F5462A43CDE121ABDA12AE50EEE84F0C41EB0DC1302527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3a0037f26a042417f4c1d7bfde2e245a5a8bf56df10fda24d84908fd5d99be2b
MD5 2a3ddb5c89c32f722fc52c2b8cc801c3
SHA1 b441a73ce830f0b9765535f54febbe3bf7d42dfd
SHA512 0db736be456476fbccf41d24e14e6308c0e0352b2a2a8803167dfa71f44bb78d31efe1bf1b737678fc16320184319a234a27b87448f0c39f672e9f56e0fae086
SSDEEP 96:/bJ0d+CVgOeTnnGBfYZS63/NASl8h4otop5yADrB6zGGfvhyYMUGsakO0AGXgf+S:/t0JeGn9iU29VGv3MUGsAWiaMFUm
TLSH
T1B9C12A71E46DEC734CFBA959F5462A43CDE121AB9A12AE50EEE84F0C02EB0DD1302527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9263cd283aff554e956bf592ed55a54cd62e2fd4f57e7b7f9ceef44075348a03
MD5 8352ac55cf41e19ebf0b577e706f65be
SHA1 6f1f2f6a40114bd8674cfcf39354efe4bf754d69
SHA512 891314086cacff6c495e7571d6bd77dcad3412a636cc5b94bad3d533ae691b7bfa985e26ad9e01b6f9c2e13374074a9577073bcb0208507ffa40c1828a5cf8fc
SSDEEP 96:YpkVQcQYVDHUSLI0giP7PN0A8k+EUsal8n:YjcPqzW7PN0A8PG
TLSH
T13BB1BC62FA8F24E2DF3265F855A9CCE8377E94D542FAAB1145B0763CB0036AD0078DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ac034.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac034.TMP
Size 3KB
SHA256 f0086bda7c77c528b1770f26d9960c2c7cf3431ebe7986e33b019d7ce090a190
MD5 395bd6140c24b82497cd48a43922e568
SHA1 a7bab75862ba06275a79d377b58c20f8424e2c85
SHA512 3f4e3b82b73350f5142aecea2d8e1ed690c340aa9bfc707b9a2be8ac5636a09339f6241db5f4899b92c619d1c9c9e808e216c845119f5e6a762c229fce6f2878
TLSH
T1D161FA937F1E15E3EB26B9FC50E5C4F835BB88E507CBAE1452706B7D940369D11380A5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e2dcef85bdbdbc14ac265488828afd4ccce8f7e5a53fdc6b889768b5f8fd3c04
MD5 13e454c4f5a34024f9cb609b26ab1bc3
SHA1 d2109f280224cbe00a6661701db4ee8b782ed606
SHA512 1849259b07026186ff68146f6d9f0225baeddbc93304ad5ed2b7c7ae4e30210801bd1d83ec6312b451b8015b2462190eb4c976ac3c2292388c32c6eb88d65266
TLSH
T16771CBF3C3E9866DC90195F0AE14AF1BCE1D0556436C3D5A88E4AF4BA3F2871E151B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a704b972d1671ab1346ea36d330d631aecd98bee2d5b837331ab07afab2e3b09
MD5 86d0691b2f46010a97d4a59f15564fed
SHA1 8e8ba76b27cc0861f1e3ac8ed6c5c93709a55433
SHA512 fa2ac390f6dab79de3bf1ea2002efc2562b743bbfde457a6f3dfd5ea47ee80fbaaa17a0fa5ee3008076c1c22517844568cb9bcd962b81bcb5da2f121215aae08
SSDEEP 192:sxRURnyM/jK1Ml8wxA/fqsZD/ZxMJ8ex3dkbbIoA8pJl/g6+WNPiB/YxLlKVyGfE:sxRUlnA/fqsZDhuJ8eirL/5A/7NbA
TLSH
T11D72F80AA924593BDCD7D219FA957F93D6F91133A1900E48A9FCDE0C04E6ADD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 248ec40aeafd55d94ebcf11f2c81d525ed48f70ee7893fd43cd035813d88a0fd
MD5 710e82e7b67cda62df2e3530a498e29b
SHA1 1037b7a882e3a61d46a25470ec46c97e3cfdc1c7
SHA512 d71e0c894a005451ff37b05895ce94784ee057c240c3c42f34146daf81aaaef907232b26e060b0228972cee84e332be699dc82395adc9e75e17d5ccccd7ba921
SSDEEP 192:sxR/RnyM/jK1Ml8wRA/fqsUH/ZxMJ8ex3dkbbIoA8pXl/g6+WNPiB/Yxll5VyGfn:sxR/lrA/fqsUHhuJ8eirV/5A/oNyA
TLSH
T16172F90AA534593BDCD7D219FA957F93D6F91133A1900E48AAFCDE0C04E6BDD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bdc23e83ad6d32ad8df341f72aa00d5b46e144d286fe48915602fff529a30de2
MD5 301ae88232926215706925d7aea8e34c
SHA1 43d7ad2824ab7a215adbcd43ca1fd23881b9289c
SHA512 0f4d7de062cfa67ab09a25baadf2068a71ccef1770dda96666655b44f8402b420abab4c51655b6a6c7e664db332d3bb8b55eb2750c481e4ec3499e656e4e21b8
SSDEEP 192:sxR/RnyM/jK1Ml8wxA/fqsUD/ZxMJ8ex3dkbbIoA8pJl/g6+WNPiB/YxLlKVyGfl:sxR/lnA/fqsUDhuJ8eirL/5A/7NIA
TLSH
T10D72F80AA934593BCCDBD219FA857F93D6F81033A1900E48A9FCDE0C04E67DD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 65565ffec345c5c6131586461b818f452da1576801b09be863aee44cd32a8bee
MD5 7b5e6baa45a7f0487638c8f55b5d7af4
SHA1 34659aabb2f0df8d7244ff32e1b8c05ede5a0bf0
SHA512 19c8fe7e460f8ee2e43cfd8587b976241ef7c7530fd3143c31bb568c1a4110e896a176a9071311c22c45702d26dfc9edd3ad4bdcbbdd8744c5a5e4436f81624f
SSDEEP 192:sxR/RnyM/jK1Ml8UQFRA/fqsUH/ZxMJ8ex3dkbbIoA8pXl/g6+WNPiB/Yxll58y8:sxR/lqjA/fqsUHhuJ8eirV/5A/VNyA
TLSH
T15772F90AA534593BDCD7D219FA957F93E6F91133A1900E48A9FCDE0C04E67DD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6a06e2669e2db5a94eec7a157eb557a6227097ded10ff50feab86838c9df600d
MD5 73d7a9c62588918886df944e7d945ee2
SHA1 3a7431b47aa14be2ca99e015a2c3156a058d5474
SHA512 ba9a73d42832a79ad4a183b8e6d80a1cdc62a1a1e001dd1fc8e63896f5d7f41769b030295d1e35ce3247b7f9a52e896e4e41870cc20317659c3bbec9331b276b
SSDEEP 768:0xCyFD7pLuLzUjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVp/3HrVAAroJEjt:0xCyF1EzUjWgbrfM1u1ja2/3HpALJE24
TLSH
T1B5E2EC7B680CCB7F4F404A9DEC297E9BADE802CB96D8C95447EA480C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 3KB
SHA256 daf9b33887cad192fa286eea386616464ffbdf576ab91999b82f6ee66edd8f71
MD5 df7647d6d84b714b3d27df1a4b598330
SHA1 65e380ef4f1ac4ec4dae85ed5855fb8091706751
SHA512 bbdc3b2686b3029a38fe638ac8433f5873095578d458542948542870b730ab42e136f9e86e55de77e86d411b182ec913bf7c4105198e78b175e4c9f95e369a2b
TLSH
T16251C54FCD4A1D5AC9ED06B228FE009133796CEE4B50C9872AACA132B8D733E1D1D50A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 840B
SHA256 059e9ffc37bb14c836740018f62824dfbaef11e6b7acae6d372379860991d7d0
MD5 d0db35dd77a84c50c5b60318c6a04c17
SHA1 1f1dd4027905751e9af204584df15ed41b78ea15
SHA512 d1489dadb97cf144e87b12837468c446ab0af2105cd9ad73ba6d40b3fd5d307fb04d6482ca5d8722e884ecfd08748ddcbe7e595dc43b9899e9f97f3c97c5acdd
TLSH
T12F010226DCD75847CD32AEB7E53A248A3B7B06FC210DCF8B112D5E358EC652D4501658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4ce9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe5a4ce9.TMP
Size 840B
SHA256 a36f80f432b99ed248b24eed4fbc9f938b89bc426e1425e733d254de0fbf2ddc
MD5 c8cefc0d450fc4ad508b84fa831fd436
SHA1 f715ce9ca48094bd659b1285299c4b9751455222
SHA512 bacb45e44ef165218cabc81fc1fdf35ca54df6c500030ea9929277fd898756434b2962a0fbaab0ddc9bb02e6c7ccfdc04585d5df19c079b88edae9d0e0d3e33a
TLSH
T1E901E1A790C2EC97CC2266B5F557519A337E8414221AC74B30AF3D6559D362C4E01565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 33ba7274f18360a9057f0a3acab38d82a56276461aaa0c3cd028338561f3824c
MD5 15dd88891aa6346f5a281fe9f49bf0a7
SHA1 b5e881bb671f8301b9797f4152b54308c849b62f
SHA512 0c83f154d0f1f7ecdd30e705f6a3567182204f1230fcdfddab8c4f41964e208ece60d0e3c6ba58aa5b6b051c0847fd53ba94157df15171300a05d0593b517349
TLSH
T18BA0021C03C20672D01322B12997C9C12370C9E05337537751E0245CCC52D554D4100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 a612467dce7bf70eb5f79694cc3601f6182ae7869da5ddfcf9e95b3a70e01552
MD5 f67010d10a6cef54d336024ca8ac583a
SHA1 cf19006612b0df871c58bd780ab48a716c7c0272
SHA512 e967947c8395255a058d163413db6a44f291b1930aa17201cf51fc0317107749c0845ee97ac012be563475739c558184c8ee5c05371f9adc0ed44411b0470137
TLSH
T177A0026403C88246D11221F92592D2923684C9902211134E64D20345CC514D4498111C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4690e5555df55a80d978376a099480cb96896fb49662ef381543307b8acfa96a
MD5 46353e626101be4e2494cfbee56881ad
SHA1 3f2175b35425dc74f698b2cfe327567a9617292e
SHA512 919494c5c599e12b560fd28dd078086d0367c8a2c784befa0868abcd459327bffc4f387c59db71cb70e5dc1dcd39dda15fdf3f16cea1faba00ce0bd0216c43ed
TLSH
T16EE0207B3EF61634FDBFD3D22C304AF549427958D940FD4F642992C75071354645AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 14553c6bccd07db326ec41a838d621fb3ae9da0b86f291c73f7db0524141ac38
MD5 ab968022d03bfcf7c772377c43915a70
SHA1 e6cfdf55f51aca447be21483c4013359816a4b66
SHA512 dda877e1da91f53d522e3ec73d4b3534343a0f7c3ee3601135dcfb3714537ec0e158e3bfb8d86b5fd881158527765b5e987c9614a9f0b54427c84f5b980bbe08
TLSH
T13EA002908AAB9465D40006B110FE995033D04AD99365524154A8F4D8CC9224051D1941
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa20e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa20e.TMP
Size 48B
SHA256 3ed4f421ae97bd16d239827ffc5f1247edf7fbd1518b59b4d35d7dbb246a0364
MD5 b2f81bd57e9f14df8aa03b49b4359fa3
SHA1 6986ffd8f99c279c2e02738c01bcd2c8c30fc90b
SHA512 053c44792ef367e837066745b89271fe10e12b95e8c965f4af34020dba32018e6351b63f5c21ac6fcd298ea42f75ac5346efd17dbdf4e19f477ef00bacc3e34b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f6b85297f6a79aa16c56d854d47f71e7431cd3ace72f86710c16bc6fb37917c9
MD5 1f3b771cdd6a421dae3463f76fac5e48
SHA1 f7962a015187191bcde71d297e4bbd5d56ef4bb4
SHA512 406cde18d26bb5ac091a93272a126313f0da08a675466049d32116e3ddc398c8a331b82b9611f6391254cc0a7c72a015e33b469515bd84b4a47a918304d2edb1
SSDEEP 48:KseIvKrCYLytnItKIEY4vIhK0Isby5WIXKLKANMJCOMSyhXu:KseUKrCO2nSKIE7v6K0Iq6WMKLKYe
TLSH
T1B2C11A51B17A564439BE650891A4D626CAC2B4B33416B52B3BE840B61F3FF054EFC8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b316d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b316d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a54645bf35374bb531cb4da8744bce296cdb6862ba90706d6220521e1fd90622
MD5 257cacdc93813fe917d0e4ef8bcfc8e6
SHA1 04af553c60395f6e6e40c793aefdca626c2a9986
SHA512 7750578e6b64395159332cf78a97040188d6798d45e13697a782082edc77201dd9dc5b1c6c5f0a732b8d70eab16490aa9cfc0e28581987f5d4b8460bc864423e
SSDEEP 768:l53HWkKL20atfHjF669yrqUjWiIwwxMtvzD7:l53tsGHjF66INWZTMZzD7
TLSH
T1F5F2AFB46C945EB7C8FAD785B2523383AFB040A395C90F88D9DCE60E05475DD2B4B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d5f323bbb8d45a73140204bd2fc50104fde33eb37b0a65b75b118caa8fd47383
MD5 cb0acce238258b5df81fb585bb5a8149
SHA1 7d440ba1d70487db1e3d4c939b0d154f32bd0d74
SHA512 23212368d5aa7183c4034a416f2945437a84560a59e5bb5bf8ac57ae36e864bbf4d09ff63fcc0657cc0b0d5e2f6fb8878b74688d884b5c0aa9097367bfebb831
SSDEEP 768:QFRB3MwgvTOatf1nF669yrqUjWiIwwxMtvzD7:0B3jG1nF66INWZTMZzD7
TLSH
T1C4038CB5A894DABBDCF6D782B7527383DEE040A385C88EC8DAD89D0D01875DD174BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b6615edd4c00af8395979f2298bb7547fd2b8635a672b84519a45376a6a9d70b
MD5 ccccb6a059639be2e95bf948ff720ff2
SHA1 ea115c6a823fe3a0e52ed108fbbcd3ca92ca4383
SHA512 909963c38afb39ad7b7e4f29d6e5a4f9e0f9ad8f4873c5daba068bb387985218fd91a386c2add555c886eb756f2e6137f2bbf092bccdcb99aa7fa81c3266c265
SSDEEP 768:arv+4UNbdl3ZPkKL20atqjF669yrqUjWiIwwxMRZUiler:absbX32sjjF66INWZTMbUsQ
TLSH
T1CF03CE35AC589AB7CCF2D68672433783BFB4109396C50B88CACD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 150c53c33b4a3bbf6082f11893332c113bbbad4ebd1fca693ecfab0bc168a906
MD5 2e0548ee3bb235c8e150b0e6d809bc7a
SHA1 b2a81114f7543ccb2895bd8a4824b94a79faa638
SHA512 bd99e0e71b35131baa74d204dea3ae56b5f8d1b53dc4517eceac0b02baadd621102f14956d732672d4d52b24881b193256351b736ee83bca5733bcfac0ccafca
SSDEEP 768:4938WkKL20atf6jF669yrqUjWiIwwxMtvzD7:493esG6jF66INWZTMZzD7
TLSH
T164F2AFB46C945EB7C8FAD785B2523383AFB050A395C90F88D9DCE60E05475DD2B4B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 61e18b3e2e55ad965828d2272c0545155a35b2255d0744f283b255a77d64c734
MD5 f24b5ea3f1d4458999dc7c8b95cb63b3
SHA1 79c53676e2b71a6f09bc67ebf9bf14475a2f14c2
SHA512 0b1d3c4f4ef34ae0a77e9ae52bf8718ac212be60e4743a6ad258724c2c4c670578cf9a24ad5395d837f56fca608ad2757eb2583b4d77f0fc7dbe249acc154360
SSDEEP 768:n538WkKL20atfHjF669yrqUjWiIwwxMtvzD7:n53esGHjF66INWZTMZzD7
TLSH
T123F2AFB46C945EB7C8FAD785B25233C3AFB040A395C90F88D9DDA60E05475DD2B4B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 be1991aa0a701b48f2a5a430956046fe3a0642286e35ea32de72ec4563334c94
MD5 e5103757a7fadc147ac818c89bd04fa8
SHA1 2427d54b6c20ad8770297572d90b034675bc817a
SHA512 d74005697a1f10d7ece4bbd12d83f629cd298c7e2b97d8749d60a1e8cb66a417130cd68697456e33e461de855b1f86c137829e12dc7c3e8d3132ff0b194f39c9
SSDEEP 768:2rv+4UNbdl3ZAkKL20atfNjF669yrqUjWiIwwxMAvUiler:2bsbX3BsGNjF66INWZTMyUsQ
TLSH
T1F103CF70A85899B3CDF6D686B25377C3BF7410A395C50F88DADD630D464B0C92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8df49b6291b5893e0107771e39c559225f1eb4ace845a380776268efacda5559
MD5 5fcfdfffad8dd4fbc3d9e60a560bca81
SHA1 e8514c3e9d86e4195aba34ea56224e6283932e15
SHA512 c5e50e4f72f13fdbf2e71c8ec643e600de0fc6b9284d19112ad41f4745dfa9c3029863e9c57a988dd772a989d6435886eb7b0f0a4351931ed3acc281b7c2332e
SSDEEP 768:xrv+4UNbde33WkKL20atfHjF669yrqUjWiIwwxMtvy:xbsbc39sGHjF66INWZTMZy
TLSH
T1B903BF70A868AEB3CCF6D686B25337C3BF7410A385C50F88D9C9970D464B5DD274B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

c6e813df-1672-4b43-b3ad-7fe26791730b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6e813df-1672-4b43-b3ad-7fe26791730b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

28851299-b340-40e7-a6d0-e6b72f9662ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\28851299-b340-40e7-a6d0-e6b72f9662ef.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4812_1964453766\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-198-0x000002E874A90000-0x000002E874B53000-memory.dmp

Download

memory/6176-1543-0x00007FF7FF640000-0x00007FF7FFA3D000-memory.dmp

Download

memory/6176-1541-0x0000022E31130000-0x0000022E313C5000-memory.dmp

Download

memory/6176-1540-0x0000022E31130000-0x0000022E313C5000-memory.dmp

Download

memory/6176-1539-0x0000022E31130000-0x0000022E313C5000-memory.dmp

Download

memory/6176-1536-0x0000022E31130000-0x0000022E313C5000-memory.dmp

Download

memory/6176-1533-0x0000022E31130000-0x0000022E313C5000-memory.dmp

Download