00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
Size 1.5MB
Sample260831-fdcsgavdkh
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4480	wsw.exe
6000	wsw.exe
492	wsw.exe
5900	wsw.exe
5264	wsw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_667383079\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	chrome.exe
5228	msedge.exe
3204	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326251082431511"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{725EAFD3-A5F8-4266-982E-7B92E7906F9C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4A47A02C-11F5-48AD-8DA1-4C3CA6A36327}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
492	wsw.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5900	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
3532	msedge.exe
3532	msedge.exe
4824	chrome.exe
3532	msedge.exe
4824	chrome.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe
Token: SeShutdownPrivilege	4824	chrome.exe
Token: SeCreatePagefilePrivilege	4824	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
3532	msedge.exe
3532	msedge.exe
4824	chrome.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
6000	wsw.exe
6000	wsw.exe
1668	chrome.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
6000	wsw.exe
3972	msedge.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe
5264	wsw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4480	4664	00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe	86
PID 4480 wrote to memory of 6000	4480	wsw.exe	87
PID 6000 wrote to memory of 4824	6000	wsw.exe	88
PID 4824 wrote to memory of 5100	4824	chrome.exe	89
PID 4480 wrote to memory of 492	4480	wsw.exe	90
PID 4824 wrote to memory of 5424	4824	chrome.exe	91
PID 4824 wrote to memory of 4912	4824	chrome.exe	92
PID 4824 wrote to memory of 5424	4824	chrome.exe	91
PID 4824 wrote to memory of 2480	4824	chrome.exe	94
PID 4824 wrote to memory of 2480	4824	chrome.exe	94
PID 4824 wrote to memory of 4892	4824	chrome.exe	95
PID 4824 wrote to memory of 4892	4824	chrome.exe	95
PID 4824 wrote to memory of 4040	4824	chrome.exe	96
PID 4824 wrote to memory of 4040	4824	chrome.exe	96
PID 4824 wrote to memory of 4796	4824	chrome.exe	97
PID 4824 wrote to memory of 4796	4824	chrome.exe	97
PID 4480 wrote to memory of 5900	4480	wsw.exe	101
PID 4480 wrote to memory of 5264	4480	wsw.exe	104
PID 5264 wrote to memory of 3532	5264	wsw.exe	105
PID 3532 wrote to memory of 2456	3532	msedge.exe	106
PID 3532 wrote to memory of 5228	3532	msedge.exe	107
PID 3532 wrote to memory of 5008	3532	msedge.exe	108
PID 3532 wrote to memory of 5008	3532	msedge.exe	108
PID 3532 wrote to memory of 5008	3532	msedge.exe	108
PID 3532 wrote to memory of 4844	3532	msedge.exe	109
PID 3532 wrote to memory of 4844	3532	msedge.exe	109
PID 3532 wrote to memory of 3916	3532	msedge.exe	111
PID 3532 wrote to memory of 3916	3532	msedge.exe	111
PID 3532 wrote to memory of 3916	3532	msedge.exe	111
PID 3532 wrote to memory of 3788	3532	msedge.exe	112
PID 3532 wrote to memory of 3788	3532	msedge.exe	112
PID 3532 wrote to memory of 3788	3532	msedge.exe	112
PID 4824 wrote to memory of 5820	4824	chrome.exe	117
PID 3532 wrote to memory of 2484	3532	msedge.exe	121
PID 3532 wrote to memory of 2484	3532	msedge.exe	121
PID 3532 wrote to memory of 4252	3532	msedge.exe	122
PID 3532 wrote to memory of 4252	3532	msedge.exe	122
PID 3532 wrote to memory of 2896	3532	msedge.exe	124
PID 4824 wrote to memory of 6036	4824	chrome.exe	125
PID 4824 wrote to memory of 6036	4824	chrome.exe	125
PID 3532 wrote to memory of 5772	3532	msedge.exe	128
PID 3532 wrote to memory of 5772	3532	msedge.exe	128
PID 3532 wrote to memory of 5772	3532	msedge.exe	128
PID 4824 wrote to memory of 1668	4824	chrome.exe	132
PID 3532 wrote to memory of 3972	3532	msedge.exe	133
PID 4824 wrote to memory of 1672	4824	chrome.exe	134
PID 4824 wrote to memory of 1672	4824	chrome.exe	134
PID 4824 wrote to memory of 1720	4824	chrome.exe	137
PID 4824 wrote to memory of 2624	4824	chrome.exe	138
PID 4824 wrote to memory of 1496	4824	chrome.exe	139
PID 3532 wrote to memory of 2824	3532	msedge.exe	140
PID 3532 wrote to memory of 2824	3532	msedge.exe	140
PID 3532 wrote to memory of 2824	3532	msedge.exe	140
PID 3532 wrote to memory of 2160	3532	msedge.exe	141
PID 3532 wrote to memory of 5024	3532	msedge.exe	142
PID 3532 wrote to memory of 2668	3532	msedge.exe	143
PID 3532 wrote to memory of 5352	3532	msedge.exe	145
PID 3532 wrote to memory of 5352	3532	msedge.exe	145
PID 3532 wrote to memory of 556	3532	msedge.exe	146
PID 3532 wrote to memory of 556	3532	msedge.exe	146
PID 3532 wrote to memory of 4976	3532	msedge.exe	147
PID 4976 wrote to memory of 3920	4976	msedge.exe	148
PID 4976 wrote to memory of 3204	4976	msedge.exe	149
PID 4976 wrote to memory of 4460	4976	msedge.exe	150

C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
"C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\wsw\wsw.exe
  "C:\Users\Admin\AppData\Local\wsw\wsw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent chrome "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --lang=en --force-renderer-accessibility --no-first-run --no-default-browser-check --disable-default-browser-promo --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7509c728,0x7ffa7509c734,0x7ffa7509c740
        5⤵
        
        PID:5100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,8531539362307708510,5820816513980563037,262144 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:5424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,9916243740872496591,4970907961380092889,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,7627030578697437977,1519153023054050671,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:2480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,8253892403960540500,9805965858720959274,2097152 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
        5⤵
        
        PID:4892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,8805021581454787127,14187705127968115330,2097152 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
        5⤵
        
        PID:4040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,11978462005113977083,12701284339824370680,2097152 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:2
        5⤵
        
        PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,6152649435982886689,5161296307451287540,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5280 /prefetch:8
        5⤵
        
        PID:5820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5500,i,8093622976912634650,926233995392792924,2097152 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
        5⤵
        
        PID:6036
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,5650634506060478313,13896570961655214353,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5788,i,9116891342218995553,8759199976628268039,2097152 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:2
        5⤵
        
        PID:1672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,14627951095031831632,7368650776519689145,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        
        PID:1720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,9662876024132362328,16788501005693411636,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:8
        5⤵
        
        PID:2624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,8755524993781616808,13984383227712198690,524288 --field-trial-handle=2072,i,12327074390519460629,10302425992710830663,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
        5⤵
        
        PID:1496
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent opera "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:492
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent brave "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5900
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent edge "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --lang=en --force-renderer-accessibility=complete --no-first-run --no-default-browser-check --disable-default-browser-promo --disable-features=msEdgeFirstRunExperience --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffa60d4c188,0x7ffa60d4c194,0x7ffa60d4c1a0
        5⤵
        
        PID:2456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,1927557111971255839,9246373319863798207,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,13126988202931329310,16550112045701088164,262144 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
        5⤵
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2396000194689995473,1035852805744822307,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,9238935918987218391,15996489477228675785,2097152 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,5643523027459107818,9671085585193409765,2097152 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,15778364366140898211,5079487032134345709,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
        5⤵
        
        PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,18361602760714232422,9207776113813429254,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,18416064411592255502,2053706593672801652,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,18416064411592255502,2053706593672801652,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:2896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6132,i,10589065981308600765,14174318121941961656,2097152 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,15970967456737656580,14675800784508118624,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3452,i,16366708819032568480,8536459248882173069,2097152 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:2
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11459059295598863655,15151841283522221479,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
        5⤵
        
        PID:2160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17769057093960760644,4132881665454189319,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,11342239410316001218,17479901689530524156,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,9096297606826141591,260704386747196005,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17340086410658497877,12693541849854855914,524288 --field-trial-handle=2256,i,4865456576682578135,11607042660499089184,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa60d4c188,0x7ffa60d4c194,0x7ffa60d4c1a0
        6⤵
        
        PID:3920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2453707214069521321,17250777412881615855,524288 --field-trial-handle=2764,i,5881344815936917715,7446485428310057665,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,12694036965719942062,4887640011256542224,262144 --field-trial-handle=2764,i,5881344815936917715,7446485428310057665,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
        6⤵
        
        PID:4460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,11125964862678111011,18359361372005926684,524288 --field-trial-handle=2764,i,5881344815936917715,7446485428310057665,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
        6⤵
        
        PID:2400
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,6242945914676008239,11774081087241165093,524288 --field-trial-handle=2764,i,5881344815936917715,7446485428310057665,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
        6⤵
        
        PID:2448
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,6242945914676008239,11774081087241165093,524288 --field-trial-handle=2764,i,5881344815936917715,7446485428310057665,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
        6⤵
        
        PID:1284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 49ada1cc8c97414724795f8e002ff31238bad49938ee4b8a227f20fe6dba6427
MD5 4653e601d17a1369f1381b4dc4add2d3
SHA1 db66f6664859412b4e54856b24aef60e8f3c26c9
SHA512 3a23c4510d89b1e25bd9ef91c6cf4944cb578703e6d3d508264cf0e618ab0a1efc19671a6eba6ee80017ce5d5fa3c6a2cad99bfec8bf6a70dba201ceea32efd4
TLSH
T175E02BADC962EC3708FD071D90510745E65413073740488B3A3C99194FB533A474685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 6ae6f51d4eb488973c56fb6c4b836e10c2973be02b8ee4507a896cd360feb07b
MD5 6a760c2c757bd8ab8768e5cb36fa3235
SHA1 1686fbf90e77cbeaa305569409668bc8800920b7
SHA512 6d7312f19b60b0c692ee0e6c530c2edf36d1a005772275f2c569c93e7b1406a7c40ec0f2612b2ed8d6148a962139bfba3cd65150c8868e1e17e65a2fe6578fd1
TLSH
T13FB0122122C4B900DF8D6AB80A32384302F92F2E253E834782E128B14C3F5F0D101113
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b265f680dff706da852d8b52f1077585f9eb24a586488c7715aa7413afac9622
MD5 6844813d4bf91a657a96fa334c3f67f8
SHA1 6ec143519757bcf31e73f85ef64d0c39f2a36590
SHA512 290661334bce7815f09c4e8d4a86a09cfbfc6b7f815fd186e124ec5fff946a5045a607e00edd0831d1ccbda15e93815ac279d008b3c91f35fa834c7a55847938
TLSH
T121418FF793B4857E8A1192F4DA156E2FCE690525136C7CA689D46E2743F2872E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 1ee33a774a87b2f0c2208bd038ea2c5ca4659e651dd815734a43b21b97475aac
MD5 58467a7f12d2560e7dedee733f62f463
SHA1 8c95c734bdedc791834d8f7e697d04b8a26970b8
SHA512 f66df07114f76dac65dc3ce3478704421b64de3cbbaf3bb9657ecbdb3bf0bb7b37b4910bb4549baa1afb549a9e4cef59a2e19bf564e9262ad7f1e5d228f8cdc3
TLSH
T132014EE7E36EB46B117989FB6D00BC0925BAA83506806CF4CE6A81BCF0D69F30712553
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2e5fc59ee30fb5b026422ce766d7734ddb872c3acb7c4a4f8760167bb1b34cc9
MD5 c290b9b7668b10338bb8c34fbf14091a
SHA1 7994f2354137b84ecd2bc880678f32cae1888f1d
SHA512 67f04f62afdde16e684b08c40230c6012bf10fe9d0b44ee7bf4b02c74e7ca2aaebd1e0592d24af2a15d046573cc40b8c6583b627281490f75bbe54e26c9e1328
SSDEEP 192:5RAlanWn/Ev71hpAPRp2g92Hsb+WNNo0Q1whPL22eElTaxi8VyIsnAUgtaJ:5RAlw4gBhUXDQwNksPK2eElaj8
TLSH
T1BA42E92EA920797B6CDBD21AFD267753D7F5102121E52E80E6FCC92C15E76CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4cbef54657d82d420fdb25a8438f609d0f269c15ddf91fe48f62cb33b0924709
MD5 bbd44f869d47c9a8026973200bcab799
SHA1 d3724ec12e7e65996bf370adf2f6085d80a97ee1
SHA512 642a83176838fe975ee01a268de4b16f6c192ee4dcf3ed20f60f1c6251212eb006e3eb1ce86102b9160ff6898aa6446c2e59acaad5791fa9fc986a80d6d8fd97
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLhLcSjwxXODKh+ErU3wZUHG7A1OAnF:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697z
TLSH
T121720A676C4C8E770F94C6CCE8177B4FADB5024B65ED886483FA982503D5BCB014A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a03a43e6d8f60173cbd39d59ff3471d01c6af4220fbe5fbcb56362a1c6c468df
MD5 bcdfe5fedcd03aa4f553fe32d7425de2
SHA1 d7564d5ef943d41ea977a1ad9b552366043dd26f
SHA512 020be0289bc1e48cd71945e5e3087792355ad4a6aebccc0167e074ef9170f9498d56e77e53ac037742a930b507ba3333d6558f47834125e85bd2126edf9ae152
TLSH
T153B012419412A201C45602B01146158CB2185F25960B1B0553F86922CC25162C015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 192B
SHA256 d5fc8ce85e46e8347025f29c74b90f3232e3b48de9f3089c0e1148610c02ea48
MD5 27c3b17bbbb4ab326001f2d45235e5ef
SHA1 79803f1bc104aa183eff1f1cf661e0f2e5fc216e
SHA512 4b6e9f900bd683de72b551924a582737b48c9b0b9f62c9593e37c2075fd1ea37f325950c2c56ae959c119f6e2a63f66f59ab082cc5facae04c9bd33ecd51256f
TLSH
T13AC02B6340013101C08E027C0107F0E8230C9F72D019378403E0F757ECF4360C00D242
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c82d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c82d.TMP
Size 96B
SHA256 277a9836f9fca345cf1ff5e35b0cac210ba13016cc610dad18d37e56bd7a631c
MD5 ac30d9fc9880ddb952fe4297ee5ad298
SHA1 c07ced861f7c1f663d555fc4f645cc77eb6f2701
SHA512 2d8a28411b3ed3985e972409c8770285019199eb9a3ed4fd77c5c711b50a6b9d6fd7e4ca23956ff96299aa1f5b6813bda7adb2661d1edca84b59a9d661d8389a
TLSH
T136B02280C00E3202C00A03B0288282C830A0EF20C2032222C3E00E22FE22A3000302A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b272f8b013fc23aa35f804075dc33f1f8f2d4412a87f6f55b4ddfe4013e823b2
MD5 4faa3aa05342dfafbc95612fd7b6e6d2
SHA1 9f3776523c3a71b1e0e6f5d85640f893fa396e4b
SHA512 b2fd501ad5f42b94e7ff669cab0a62b7be84f6d5521c3b91001c6d83ceb97fd23df854a541dfb9788131e6ff1f9524889bec4cec08cc9885359068e39b98a571
SSDEEP 3072:sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:fm7Rkm1tYpBeh2BAo3
TLSH
T1E8C312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 31783e421f5cc9e7122ca152639ccf832f45e6a1a4b06ee529e789a8292a8d5e
MD5 672d2cb3cff5ea9d775d6f6245f1d1b2
SHA1 58c9bca886e7f2cb037fdb496f0152368bf438a7
SHA512 b70b350e545f849decde9ae4f2f099359fc15e88ed9c3f11a2f27f1979f7540281a5cb03584d7adeaa793cd6bb2e424cf7f939296e16cda6f64d4fa5d8ca9255
SSDEEP 3072:DtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPg5Gm7D5Lk17ox1tIpud63U8BehbCBi9H:w0mAIpUNVS64m7Rkm1tYpBeh2BAoY
TLSH
T1AB34133B9CE36D3B269ABB96B4891F3D18B245E2C8148A54C8D06E493FDF78C1907D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 9ee45c967b324a477954eecb1e8af940a22e692eb5bb8c52df8f791a3e503366
MD5 985d16543a5f7d5a8318cc4f2ca471d3
SHA1 f6182391fb28faf386ae5b8b6734322ea956afa1
SHA512 e87d23e3f3413c00d73fbe06286c90a90ac30064ddb7b18d5b5b9051db0cecba555688245661483018c0da8fb658a4b126d50202ac2de3b2cc1be0f1f72f5428
SSDEEP 3072:CtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPg5Gm7D5Lk17ox1tIpud63U8BehbCBi9H:n0mAIpUNVS64m7Rkm1tYpBeh2BAoY
TLSH
T17834133B9CE36D3B269ABB96B4891F3D18B245E2C8148A54C8D06E493FDF78C1907D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18216900c0782881f3d39263ddf90b752fb7f4f851c5b2fc3f2110d7ff641a90
MD5 936d72cb095073f56393fe2fb60ba55c
SHA1 c91285846713bed1dc7fe34efd5f7160b613bec1
SHA512 c0abdea8bc420ea26e7d646d264befc18a08efcf79524c81011979e825eb6c1d5e87665766faf82b4d9e99c4a75e0434764596fd8267b8d60a8f36cac6b663e4
TLSH
T195D0A7DC52D576A1F9371D757129821573CC6A416C53931DC06922534E8F17601D55D4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fdd13de58d52cf6e8a36b8426b5398b80963db394603fc0eafafee20ab854537
MD5 110c9c85ef43ed27b3cd4e6e716cd00a
SHA1 c4237ae2db0f486f12754c9966384fbdce2f4a6d
SHA512 e28cae5686d8960299bb2a89b1e67860d118c16c978f772b9bd84d6354fd065f1caa604f356d31459f8dc7401b050e6715b0259c09a3b7f4ff460b083c5257e1
TLSH
T1C6D0A7DC979ABFA0F4375D357128825072CD6A819C13A32D916821A24C8B17610D98E4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

170fc54e-ab5e-42de-a019-06574c6b0bdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\170fc54e-ab5e-42de-a019-06574c6b0bdf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 534d879d6a283a59a27c4cd390b70301cfda8659d07ba828b305328190d972fd
MD5 e04161a0af0965bc78de48e05cc587f1
SHA1 0065cd732e1e237e734fc3a9fd2ac47db2acbd4d
SHA512 5a4a901900cc045148ba4998bfb18b8549fab60c47e3de5e007857cba3dae3222c050e0d70decf0521db63a04470175a2dceb5e9d9bceaeaa56470797d8aad19
TLSH
T10FE022A6CC66FC2B08FD071AA01D8746E74013173A80898F3B3C921D8FF063A46CA86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8c731b2841733df94d80da82d8f9735507c8f217ff3f592beeb95b9ed573669e
MD5 8843ff35167112f40848be30ec627f21
SHA1 e5109d238426c61d33d09ac35a3b51e368694ed3
SHA512 34871416fe9f0339ac06ea6da041a8001f0bd74b9f4ce97ce6ac8ca6b448aa71ffaa10b4bddf654d03115f48b0ae2a22e28eab76845a19201c9bc316a62cba10
TLSH
T165512BB9F9C1196DF30A623FA1A03618BD29CDE8FD5A0DD10DA06038E9D3B68C1359C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f44e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f44e.TMP
Size 2KB
SHA256 c6e4ad71c989901753e27c69197b04526b1620072f1a599248604e8bfbc1fdbc
MD5 7650a1ed0330d4dc91017501537af831
SHA1 00e44eb34fb144905828c0052653d269354435f2
SHA512 e5ab7cf3dfb35fad4b116b9db5a67fb4de5a35cfe894639df006b74574475057d6a38794f62c77db0231e6385e972d53af942ac15e3ccf141b422927ae1c3df0
TLSH
T1E551F8B9F9C1099DF306223F61A03218BD2AC8E8FD9A0DE11E505138E9C3B24C5359C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\manifest.json
Size 2KB
SHA256 9868c63c1f5df8ebcb0ebaffc98ee98565c3f4f94e1a3cabdf88673b94324c7c
MD5 ed77ab7b140b004e5d1cce5bad9b80c8
SHA1 b4f1406ff0ab9ca15aefcdc15f8a6cf440dd5e7c
SHA512 16759fd8c4c341a219982fa83c047ed80bed989c171d788edc2773da7237cac24189eec4534440d936ef5fcce8c2827735618570afbb8010aacadca16b3bbb92
TLSH
T17B516DFBBC10AC6347B08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\lbfidjcieckmadgononplcmngglejjgd\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\lbfidjcieckmadgononplcmngglejjgd\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c49a14abf73dcbdf161447f76168be93d43eb072a0600d355eae543cb1ee85ce
MD5 4204bf6891853354bd7fcf21a6d1c9b3
SHA1 e8083d92e687a4b050ffa80aca6cc181089e3f11
SHA512 ee45a3fe6283d295f35a7a6ecf525b0f8f5eb33e96c25806fa4e35187351d55180ef4bd2d8dfb7572b0fa64982d1085ae5ae0502de4dbf64707a8e66df2e3eb4
TLSH
T18141E0F783F8C66ECA1195F0EA187E2BCE1D0551432C7D9A85E4AE2B93E3471E041A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 be1bdc9c5ebeb71692d29a938bfe04413b163731fe554b61bacc8e73ad8d1979
MD5 028c6f87cc6064d88be320c64fd615cc
SHA1 61eceafd92d407abca92de81fc8f2ff1b5bd82ec
SHA512 9d2fb40db3a68a3907fd1e475bd313291b902fb91ef794d76955e521e4688c40b49c5c205a31fca4ba19e841e6cf0dd14fa42485f86e4d90f9224e2684789d78
SSDEEP 384:sxZL10zb/fSs/8WvPJ0IKY2jLHbhf/OwV6:sj6//fF8YPJ0PHbpOl
TLSH
T1C972F906AA34697B8CEBD21DFA597F53D6F90123A1905E4459FC8E1C00EB7EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f9eea586f61af18c0ec0259d81530b332dd121e0ffb2134a73b59081bcc25be2
MD5 b44087daaf301686f32c7cda8f5cfab3
SHA1 1ad50df5b12c9df123ed3a3d6b7c7e773873e4d6
SHA512 273fda666d6329910e6a6e030417074d40203c84903f7d3308dbfb8f88ed1a2661b22afd4db25d5807e52edadae5a754d39d85f8cb7794328839ece3b2c392b8
SSDEEP 192:sxZ3EvRc4QsPrss901ndIaRuvScYIrpLHW6+WNGYv0V/Fhgi/J:sxZ3EvaTsPrss901dIKYScrLHbG7oiB
TLSH
T13632B5476E28987B4CC7E21DBB59BB53E3F9102262D45E489AFC8B0C05DB6DD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d68617d424d4277269aaccf5214e5ade6447f2000e49d3bb3cebc86474394a74
MD5 41dee875d5b8ac18f68ec9e7f7627536
SHA1 49bf6ebde91a018f69cc9376570377eebeb73f99
SHA512 e6995c010cc0f0310945800573655ebb5ad161e26b463e9e3d0d9e023e7025eb0f0ebf04d7aae746a16a0ff32ae372a92a5fd174591a8f95b0b96b5f9d75cc80
SSDEEP 384:sxZL1qzb/fSss2dXa0IKY2jLHbhf/e9jB:sj4//f22dXa0PHbper
TLSH
T10F62F9066A24697B8CDBD21DFA59BB53D6F90163A1904E4459FCCA0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 65f561381a94a436c0c8d96b34ec85c5243dd2bb474a9c02943ab733460c4500
MD5 31c7a2dc427786a7fb7ec919da3c4ae2
SHA1 9573370ea4f001ae5f1d2851bfef072712b2f650
SHA512 0aa33f54a729479b0c3c48456ccf5afba50b6843015ff20a6d84372b70532449192fbd96bc002de6dbecab060450a28beb9773ddd129d23a2b1ceb278a7665f8
SSDEEP 768:ZYsZIOdVsv7pLhLzyhWvFvqX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuysyz0Ll/NM:e0IOdipdzyhWvFvqXu1jaStz0LRNH2nj
TLSH
T1C2F2FA3B6C0CCB7E4F804E9DED2ABF9E2DE8018B5698895447FA844C02C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 326c677cf043397a1a21864cb36803466aa4594fde9f09ac735979bb0085be89
MD5 add458c0c608f645610fd3dd449a5a82
SHA1 fc1019e55c9366758e38651d4c7cb8796dfbc3a8
SHA512 b0b6cf305a793c9936cdfd5170a6d0995c290494309bc15911de1a51025b5459b69ce412c4121717e02d8f12167e80484ca442d46060d7f8ee840be337baa992
SSDEEP 768:ZYsZIOdF6ssi7pLhLnjhWvFvqX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzysyz0LlC:e0IOd/HdnjhWvFvqXu1jaLtz0Lm2nu1d
TLSH
T111F2FA3B6C0CCB7E4F804D9DED2A6F9E2DE802CB56988D5447FA884C02C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 949219f43b309dc699dee4268598c08ff7244c7ccb2058ed3f8d1cd93ac39142
MD5 d959a70e46fa6a909ab534de03235df9
SHA1 6c6599bd45a4689f3149ccf1be1d84ffbd344154
SHA512 d274e1349b3aac944eb379e9031028f95bfe7cb7481faef3c2e98f63d6b2ee3a6025d9e209e3a1bc545f0104d63efc6334a4a30e0c53698946028e4d83b002e2
SSDEEP 768:ZYsv8OdF6ssi7pLhLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzysy10LlI:eY8Od/HdnFhWvFvmXu1jaLt10Lm2Nu8+
TLSH
T1A3F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 5KB
SHA256 9a4d65c657a477e15c492ac0cd76e07ead44c70e9f4ea220e56064f238709579
MD5 75be6877d4d16a5da8ac9b42ef68aff2
SHA1 bdbeec003cc923494b1701c17e36631c08295ae8
SHA512 e1239af212db48d872560f903faca73ee6088adab5bd217638cabf3a571aafb4d571ed14ba4b3152f08f114a45db2d13e3613c8c02d9abd75af3a0c80d19708f
SSDEEP 48:F2em5HdNJp6Yf5oOujpRomp6D5oObpd5oO5qQC0CiTmplFORrfS6emp8:F1m5HPJp6YAjpRbp6BpQuZlYZ
TLSH
T17DB12FA39A048093D8C866FB6436F2D9542ECA067BFF476651BC8F6D9240392332DB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 7f5e9112d337f082ae84e4a201418672f19cb1d71b84075f36cc677991aa530b
MD5 00482e3ca06bae589a5b09234abeb5db
SHA1 56cca8a2a6948041236148d2e66a9df1496806ad
SHA512 ad0426ad55c7c780aa48786fd5ead39e97895ca09ab6280548c29d0e7d5e16086f2fbd2e4b6c97303b4b8a28cf8a54566ea4fa1bee808121c36adcf920f914d6
TLSH
T160E086505ADDC2FE685760874664970CD2E8B41BD7C87D0B3F94CA4972C7548B29E983
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 6a75a30c8306c2ec535ce907bef0c513aa2e43ac481855f2f3a720826e368969
MD5 c97a9158c0e13d151a73bc675cbf147e
SHA1 56a124a0ff6d5e05cd9b15ef5c7da4e6c76b8316
SHA512 0e25affafd21d02fa8e95b543fb2eb4f5d54ed74e8c840a543ea9c80e8631622d891136931d66c2994a7354032889cfaca43c6e183290a714b47d2a9cf21113b
TLSH
T10AC01257C83AF044C0C400B96473585D1319EE5D8514330580BCB065DC6801241AA515
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 81cdd4ebbc4fbd73d20338a787a28fb7dd9278d64cd8e8c92ce08dd794ca1125
MD5 37c2de740df892ba0a003aa111a337d5
SHA1 a5960152a124b0c33b9a64939de4d316674bf335
SHA512 dc5c931556760bfe5f284a7b2d8474c1c7b4657d3f0d4209505aeba393a1a638378dee8b05b71dfa53e4717e1cb346f2aa8768a694dc5622119ded5796734407
TLSH
T1E5E0D86156CDC36B614620C79614E348C2A37406D7C96B193F18A584734B140724FD42
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0d05dca1e1b3d2a24fbd29ba0d6e6269c73f8a0557055faf92a48179f930e36b
MD5 e3d9ce75cf254a93c4df4260a6531250
SHA1 22abd972e920c21260f4b66254a0b249b78421f6
SHA512 0f6a5e7ca04f5c42b834ef7d221be6c0c3d0bb241344fd0327bc104105492f27a4bd3bf616b92da4e44cde838609b7ded89f7de5d3bb5c1dbf1faf5ed0f3c495
TLSH
T15AE0267056CCC37B944070C3C364A74DC2F1784AD3C93B0EAB984484B242100B2EED82
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e88edae0b952feae13e4feb961ea4fa0ea427c5cb43265e9627286420e611507
MD5 3890c24a45c320b8c611b15251cb8fe2
SHA1 89a9a1192256954db211925772a7e7e504772bc4
SHA512 dc76f7ba12554b97b30b776773dfd5e14db99b7fe5aa107fdda63db80b389993e5a7064fd437197d15abefcb69be58ae96608f1e94df4e7fe2d188c4bfef8e1e
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGF:05ppxnY753RNBvRJJdt7p5J97rpb
TLSH
T1A1B26B5A703E0212393E2988B39696364F4135A37058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 1e8f74f8a3621b1883527129561dfcd34d65fbf8c8766fef45562ac5a1f8c237
MD5 1a493c33ea28afb4448020d36dc9fb5a
SHA1 bad62016e858041bb846e4068305f61d2edfc4f6
SHA512 d2ba85fc97008fb3c5f50682ec9943e99f15252061f530c2b38ee6856ac1e6b65ac2fd287e1355ba4c1989eb6775caf4d9e17d422f856a83576e4a6976d37f18
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzB0jkUwS78Hn:f7doKsKuKZKlZNmu46yjUKM
TLSH
T19F030E8F666890F3D0F6C63AEC8255D6FC79212893127CC045F807B69D59132B06E5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 85e6006ea4a8af5edee82b3fd04dca11470227673c4f0105d37d84cf855cd813
MD5 9e8a63103abd50a3b4fccb400c08c1e5
SHA1 c2a4389be939c4c8fab0a63e6b019ade048a9e84
SHA512 4a2139387e80bf0ac38340f7d19540aae7eab75fb9a87a2f906fb0942b4c967c470ab71e445913ecb25bd4db78927d6b9565a14e6810fd4b3e4c286a19b96b99
SSDEEP 6:UqVkbftos+sXrWc/qoqNoqnLDEKR0tdndX8O:UqVkBoLERgfLDEE0ttJ
TLSH
T10B02C2A73880D091D8A912BD84D3ACCD121704B928C2B84185AC468BA837132E49E668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 db8d555deef9f1ada4b7d4dc341aa10d46253f96ff8bda4a87a985c46cb7a5bc
MD5 170157a1c8cfb3b10775ad1571b5fc27
SHA1 9ef529fb6f9e4e747fce48f69a719c6ae29e06ea
SHA512 dfb0af3d7fec9eaba1f68fcc752b6e8d8b5766654ef4359e6e6d93bdda4c1ba92db1848cd9424bc442d3feb85a6c11fcdb9050bd3ef8ba7eb3be387c6e8b482e
TLSH
T1E3E02610B9CCC1AFD81130EBA164A748C295B80BEBC82E0E7F11CD4EB286141B28F683
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eb79cac293445936ef289a2e645e06a759b7c2b7517207d3a69522e37f811ffe
MD5 25d72321c7c6c36ae9383bbb9d0941d3
SHA1 950fb03ba56ed2093487ba3b2fc2beb8717c68cc
SHA512 8c2433e7eecd3a17f90e47db9337d732fd6ba3a555f8f50d7e70113d346fcd43750cb1f41e622629ed8c1ad949a42df679518111e0f6c4ae3e609f616c0e5e00
SSDEEP 384:npziFiZcI63sNr8TUNTUlI4XQckCrCkKpvBftGJXfhT9J8dLRhpK91miBty/7Ig7:peFQ63uwgQkokjGzT9J8/O91mik
TLSH
T1E7C24A35DC68EABBEDFB4FC9A75A7A03AEF04263859C5AD4D9D85D0D008319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 381dc67472901d9ad7e59c509d3e182212d4fcb5ea1bac548f1f470b8fd744ee
MD5 afc86b4e39c30e1d6a50ef3d6085b19f
SHA1 d8644e42cc12228b2eb46e446efe30576b0ba123
SHA512 64a3e153d6221ec15123bf3e709b8a94968fb1cc25bbad4fc1c33fe2c4271d7743f7f91d0cb3f7e969af91c8a2f78a2232f9969764f8120f737894f18c4b76db
SSDEEP 768:+FQ7uwgQkPkjGzT9J8/TMK1Bs1H1i91mik:b7PniKd1Bs1H1iyP
TLSH
T150E24A71D8549DEBA8EBDAC99749F603AEF44233858C899CD6F86D3D309B1F90307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1fefc40051e4110b7918f3ea6e94c5144ad27816cd2fced3f5cce423f9691372
MD5 289650fa429e66880f5d7ed40b10088c
SHA1 b6e436c553c7467abf6bfd308c94fee240baf874
SHA512 40abac4f18026c6568fe0c399027d6ae48d2e2480c0b4bbbbbce4cf73be3b236db3f0748049d7ccaa9cb4dbc202c6824215e66208a0e6ed53bb024e57a381795
SSDEEP 768:+FQ7uwgQk8kjGzT9J8/TMK1Bs1H1i91mik:b7PWiKd1Bs1H1iyP
TLSH
T1B9E24A71D8949DEBA8EBDAC99749F603AEF44233858C899CD6F86D3D309B1F90307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 be0a4b0e721877778dbd09ba66923cd0d941d71c85539c6bad84033d6dac0790
MD5 0b3ffb4ed25885403a6f00628c234d66
SHA1 14114f18de76615f5875120bd214eef35796667b
SHA512 203af096f95a099319f7786a0cb1fcac05d8d719fe1ec8d0a3752bf1633cfc2401d28eb01186c058ca43feceb112e788231a4eaadc8df06407e434d07608329c
SSDEEP 384:npHiF9CcmyWCs3sNr8TUNTUlIm2QckCr9wtLpvBftGJXfhT9J8dLRhpKe4KV8p0h:pCFccps3uwgbkUSljGzT9J8/OI8p0/Z
TLSH
T1B1C25B35DC68DABBEDE74F99B74A7A03DEE0526785CC5AE4DAD85D0C00831DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4402777e469fc3ad3436c95186f49b13da0247df13d875b9dabf80f645d8608a
MD5 fbbd21f753c13a247b228ee5fa51dd2d
SHA1 96a6420ad5b41548428bf4c061757de11257b94b
SHA512 e513bb09a87b7455c54b755fc86b419a809dd8b07d00f76999a19cbb821130ea0872c1794db782197737986f1bc4b741b42f8497c4b7b7f1e2b3dcecca5bd180
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9l6KpvBftGJXfhT9J84opye4KV8p0/HZ:p/Fccps3HwgbkUskjGzT9J84nI8p0/Z
TLSH
T18BB25C35EC68DABBEDE74F89B74A7A03EEE05267859C59E4DAD85D0D00931DC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 192efac61370f102ed7e306a2c3f70f8050e9480988e1cf9b41827a5a430d008
MD5 ed1a2a038c05d484cd8803f05281bec0
SHA1 0f3a594d7ae35ab7b02f0978ed8810ae67fd15e9
SHA512 a48e19244edc3a479eb627be078439ae3dc08b65163cdc1d3b26b849a83b2221137927f5cd5c92f6b25b71da09d10852cbb7cfac7694f433cc02a3fe6e553c6e
SSDEEP 3:MsEllllkEthXllkl2zEelDBDIlt:/M/xT02zNp
TLSH
T1DB4402086B846446CD1C2030401183510370DE2005615743289114639CCA5404C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 517c01a0bc44636638312f9f1427b082b57e7fe3b10a19638f2143e7845d99de
MD5 3e39e8dd51ac09819c73fadba1845236
SHA1 a186e8bad9935b36c26c9469c53115b7785d4d5f
SHA512 12ace231153b811f9d5fce81afbfee58740b7712c2b113544cda8a0eb90fc3874624c7b62667fe3dd8fccb754a6e1fde25978be2a1dbef36b85b0da1c308738d
TLSH
T10341EB58BAFA1118B3B76E55ABF3A86D547EF9372F0AD15D00110D8F0A66A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3532_796935661\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\background.js
Size 11KB
SHA256 326d9688b7211fb1d363f1ae7554dcadfdf0511277ef591d43d4dd487c19ae77
MD5 bb4d515fbe39c04c3b85842d13cd087a
SHA1 2f5ae70405b61404325542e993da21d7678f86bb
SHA512 f7aa9494aa0e88fcf0897c3b21da7b12db954e40633e5001bd85f11462ad96aa3193de260e48e07b22f9564a77f0c6753c0b26919efe3786dc5c2f96c8370531
SSDEEP 192:v5XVFv9SqIjiphSA35qM4dbdUSVd0Ud9p4U/KpEMo4qQepk/zhqE8g5GjOXl5:RIUDn/STEdwQT7oEoqXj
TLSH
T1C032646A58370939657237BDAB33A046FE23413B2500878A7FBC59501F796E646E0FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\content.js
Size 1KB
SHA256 cae68eb9e63245b9b3d67de03e06cb28b7b30f886ea7485368fdf92d3f5f0c57
MD5 4353b8bcffb1a35320c8b4cd9c8f36cf
SHA1 6a7375ff1b03853b3f6687a416fb2805a88fbea5
SHA512 cf393e48176f850cf5124ab2b5634d6475d28133bdae97108501464fb11d58654a7c7eb7a320128eb9a75f85b9708879d2d3d34ddaa8ad57030856c9f6652ba4
TLSH
T1C4310DC77C9B283A4970DBADEB365945FB2A406725619316F1AC89A43F25FB00150EC9
MD5 SHA1 SHA512 TLSH

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-128.png
Size 1KB
SHA256 f9d1490575602aeb22c282b80fdc6d096d9e7eb783e659a7fb21275c5ee373cc
MD5 87194cc1cdc7d8ef4bed77aed0c02bac
SHA1 8a5498cf0c18353f97c12ea544ced2f0731312f7
SHA512 fa60b4fe72a38f111e1bfcbb932c3a1e0cd751382087eaffabf402d82a30970c2de31f4f034285e324f3da98ff5918edaa9d8408ca62beb5603ffb57bd1e6b60
TLSH
T1D8310983801035CE119A4F93B7D56C31DA2ADE85EC1CDFA0722372BB284A489C856300
MD5 SHA1 SHA512 TLSH

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-16.png
Size 252B
SHA256 f5be0c047ac80fd71f2875669e8c671d85b023bf43c52dd0c65dc08420f85412
MD5 2e274e9257d4f34f32243418c2acac62
SHA1 3bc52966811647667c0df500d0cddc14a72bdefa
SHA512 20e4756382972a4481dc09dd03192f94d22d99885ad0896d549600ddbdf6e465ba92373f6c97a02cfa45812e9c1cd218c391707456dbc27b8dcd1842d88d5acf
TLSH
T1A5D075DA7126C860CC60CB3ACCBC1013FD09313D4468178015890439022148FD268D77
MD5 SHA1 SHA512 TLSH

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-32.png
Size 450B
SHA256 81543a9c6b400ae6ee27afa3792433dfb3adf4ac03b99bb98a6fd69bac94c1ac
MD5 6549cb07555e9984b6f8801233d544ae
SHA1 d3c7749a17c87ea99e097db372868d2c5e9ff1c4
SHA512 f14cb10244e21e0c934fe9b9d1076f07606d6403c4a3e1610ad856ed7c84d939fb82d8281f03153819cc4994f1a358c52836a14807e8a980ea38895130fa15ca
TLSH
T130F023E3775865EDA200E307570B52698C331F0C001EA9063180523283B3B1C2593BF8
MD5 SHA1 SHA512 TLSH

Submit Download

icon-48.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-48.png
Size 633B
SHA256 ef04c8124ec47beed0a68b3e2445e65f6bc19b0f00bffe6f31e9c9043317b81b
MD5 c146d15b2a82b696a4d6ea85977a06c3
SHA1 8649ff8e195cbaf93c2891af6077ced9fd416b6e
SHA512 f3f0920437ddf1a240dd3ef783383509ec16dddd3eed044486a38e17164f87eb99e06fdec90c39c322d0171976f09a2a85963e1f5540727bedae29cdb43c325e
TLSH
T108F062D13EC3706CC72F156A9A4220634808033242A3803E86A3213527EED4EB8F82EE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\main_extension\extension\manifest.json
Size 896B
SHA256 d7a007aa1e923dfbd0873d568bdae26c3b92b2de275d2b1c355ed664fe3c97f9
MD5 c1dbba9c98138c355499f2f5076e1fe1
SHA1 db214bb13d7647d91cfe02b3e81a96a4fa0744d3
SHA512 bde29f93c625353e11e6256f93656c0e4ade54675233b69efc3bac4a2e2dc314f86ed20d577d4f7a7e84c2a8c922d458158cb6f104c88b62b47a886a8639d47d
TLSH
T1B2115533E8204E3303B8AB6929B24243FB20078B50D02C8FB9BE90584FB96990557F58
MD5 SHA1 SHA512 TLSH

Submit Download

pr.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\pr.js
Size 980B
SHA256 cded005c7dc6d6d8669fed3540cc12b81a5d4a4d5fc991e4f0e1ea1e038a0ed5
MD5 1f92ef0995d6a9548ea6324b5b5594f1
SHA1 62a22c1db26dea3a25e971567b82d54bd2be2995
SHA512 f086d8ccaa1e474f4ae11324b8a13e101160a2e129ace9259741793b4e4c29b421e3d182744343e6711c7441d7de93bd38750e035d283ce48ef10b5851c8774e
TLSH
T15211BDF3713250220DB5AAE57563A836E623E23F3585C281BA2D44A02F77294C4B1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

socket.io.esm.min.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\socket.io.esm.min.js
Size 39KB
SHA256 56eb37a25aaac55ee1481f278f306008881b645abe1b415ef943db56a42631d0
MD5 fd9c2d32975ac38dbb59055186830659
SHA1 4460c08fd9e3f06b1e05c813ac96a234bdd9b99a
SHA512 abd8d9cae2723e1da1548e8810967f4ffb60c9528a4d99e3af82ac04be76ea63e5a4e8c6e13ff8407c2a949fa36a07708b906d03824b4e2dbdc9fdb1de66561f
SSDEEP 768:cZozDDpC89b6HJhziqfPgC97cLhil9utGFvpk+ymUIOd68IUwGMGl8+/+nHlqUSl:1gHsQ2twsI/4NI0
TLSH
T16E030BC5B2A1506143E251E3C0750503F329A969784580ACBF6CEEF3AC69DCAB277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsw.exe

Path C:\Users\Admin\AppData\Local\wsw\wsw.exe
Size 1.5MB
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download