00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
Size 1.5MB
Sample260831-fdcsgavdkh
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4440	wsw.exe
4272	wsw.exe
5984	wsw.exe
3172	wsw.exe
5764	wsw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3388_671487162\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1316802146\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	chrome.exe
2908	msedge.exe
2528	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326251098116671"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{FFEC456E-C321-479E-A47F-1C288CF45C92}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000064ff3facad0fdd0140fbac2cb80fdd01c608012fb80fdd0114000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
5984	wsw.exe
2536	chrome.exe
2536	chrome.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
3172	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
5764	wsw.exe
5764	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
4272	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe
5764	wsw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
3388	msedge.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
3388	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
3388	msedge.exe
3388	msedge.exe
2536	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4272	wsw.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
4272	wsw.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
2536	chrome.exe
4668	chrome.exe
4668	chrome.exe
2536	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
2536	chrome.exe
2536	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
4668	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4440	3780	00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe	89
PID 4440 wrote to memory of 4272	4440	wsw.exe	90
PID 4272 wrote to memory of 2536	4272	wsw.exe	91
PID 2536 wrote to memory of 1236	2536	chrome.exe	92
PID 4440 wrote to memory of 5984	4440	wsw.exe	93
PID 2536 wrote to memory of 4668	2536	chrome.exe	95
PID 2536 wrote to memory of 4668	2536	chrome.exe	95
PID 2536 wrote to memory of 4204	2536	chrome.exe	97
PID 2536 wrote to memory of 5796	2536	chrome.exe	98
PID 2536 wrote to memory of 5796	2536	chrome.exe	98
PID 2536 wrote to memory of 2720	2536	chrome.exe	99
PID 2536 wrote to memory of 6088	2536	chrome.exe	100
PID 2536 wrote to memory of 2720	2536	chrome.exe	99
PID 2536 wrote to memory of 6088	2536	chrome.exe	100
PID 4440 wrote to memory of 3172	4440	wsw.exe	101
PID 4440 wrote to memory of 5764	4440	wsw.exe	106
PID 5764 wrote to memory of 3388	5764	wsw.exe	107
PID 2536 wrote to memory of 944	2536	chrome.exe	108
PID 2536 wrote to memory of 944	2536	chrome.exe	108
PID 3388 wrote to memory of 5092	3388	msedge.exe	109
PID 3388 wrote to memory of 2908	3388	msedge.exe	110
PID 3388 wrote to memory of 4628	3388	msedge.exe	111
PID 3388 wrote to memory of 2796	3388	msedge.exe	112
PID 3388 wrote to memory of 4628	3388	msedge.exe	111
PID 3388 wrote to memory of 4628	3388	msedge.exe	111
PID 3388 wrote to memory of 2796	3388	msedge.exe	112
PID 3388 wrote to memory of 3360	3388	msedge.exe	115
PID 3388 wrote to memory of 3360	3388	msedge.exe	115
PID 3388 wrote to memory of 2208	3388	msedge.exe	114
PID 3388 wrote to memory of 3360	3388	msedge.exe	115
PID 3388 wrote to memory of 2208	3388	msedge.exe	114
PID 3388 wrote to memory of 2208	3388	msedge.exe	114
PID 3388 wrote to memory of 2732	3388	msedge.exe	116
PID 3388 wrote to memory of 4984	3388	msedge.exe	117
PID 3388 wrote to memory of 2732	3388	msedge.exe	116
PID 3388 wrote to memory of 2732	3388	msedge.exe	116
PID 3388 wrote to memory of 4984	3388	msedge.exe	117
PID 3388 wrote to memory of 4984	3388	msedge.exe	117
PID 3388 wrote to memory of 3524	3388	msedge.exe	118
PID 3388 wrote to memory of 3524	3388	msedge.exe	118
PID 2536 wrote to memory of 3740	2536	chrome.exe	119
PID 2536 wrote to memory of 4352	2536	chrome.exe	120
PID 2536 wrote to memory of 4352	2536	chrome.exe	120
PID 2536 wrote to memory of 404	2536	chrome.exe	121
PID 2536 wrote to memory of 404	2536	chrome.exe	121
PID 3388 wrote to memory of 5540	3388	msedge.exe	125
PID 3388 wrote to memory of 5540	3388	msedge.exe	125
PID 3388 wrote to memory of 3328	3388	msedge.exe	126
PID 3388 wrote to memory of 3328	3388	msedge.exe	126
PID 3388 wrote to memory of 4132	3388	msedge.exe	128
PID 3388 wrote to memory of 5128	3388	msedge.exe	129
PID 3388 wrote to memory of 5128	3388	msedge.exe	129
PID 3388 wrote to memory of 5220	3388	msedge.exe	130
PID 3388 wrote to memory of 5220	3388	msedge.exe	130
PID 2536 wrote to memory of 3684	2536	chrome.exe	131
PID 2536 wrote to memory of 2560	2536	chrome.exe	132
PID 2536 wrote to memory of 4596	2536	chrome.exe	133
PID 2536 wrote to memory of 5264	2536	chrome.exe	134
PID 2536 wrote to memory of 3684	2536	chrome.exe	131
PID 2536 wrote to memory of 2560	2536	chrome.exe	132
PID 2536 wrote to memory of 4596	2536	chrome.exe	133
PID 2536 wrote to memory of 5264	2536	chrome.exe	134
PID 3388 wrote to memory of 5224	3388	msedge.exe	135
PID 3388 wrote to memory of 5224	3388	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
"C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\wsw\wsw.exe
  "C:\Users\Admin\AppData\Local\wsw\wsw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent chrome "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --lang=en --force-renderer-accessibility --no-first-run --no-default-browser-check --disable-default-browser-promo --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9e2b7c728,0x7ff9e2b7c734,0x7ff9e2b7c740
        5⤵
        
        PID:1236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,18239406765126478539,17902282747806702714,262144 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,5677426984538904816,6753441370382090040,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,2462887629372019907,11160065819829676921,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
        5⤵
        
        PID:5796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,9623317164922349346,14024957811705859533,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
        5⤵
        
        PID:2720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,9576380373194401561,4052765314005209616,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:6088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,4488256570601091866,2620089031917750319,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
        5⤵
        
        PID:944
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,14098604887094110877,14078211971549235198,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
        5⤵
        
        PID:3740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5260,i,7308430652675382103,14506753973314226793,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
        5⤵
        
        PID:4352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5296,i,13058086944011424680,8788263171584058605,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
        5⤵
        
        PID:404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,8709989284132491735,2751334731996985646,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
        5⤵
        
        PID:3684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,13438781071356892188,16832886466420971712,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
        5⤵
        
        PID:2560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5816,i,13972044737107172831,2786888987028057077,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
        5⤵
        
        PID:4596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5856,i,15645646743613435180,18058577702843591788,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        
        PID:5264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5396,i,8911734247712564639,1950757530758828989,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
        5⤵
        
        PID:1384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,2387989000339496625,12052286705354278683,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
        5⤵
        
        PID:3456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5660,i,9448852747081278824,15815904139044368695,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
        5⤵
        
        PID:3480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5356,i,15408311219119197891,16028289964926735640,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
        5⤵
        
        PID:3832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5556,i,14418060637801628610,6827957427555195054,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
        5⤵
        
        PID:5624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,12465209483624594459,3666392304106074904,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
        5⤵
        
        PID:5280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5348,i,17770362813183436071,16936326258865870756,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
        5⤵
        
        PID:3728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5528,i,14381423849550474341,423515668980803569,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:9
        5⤵
        
        PID:5600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,2411589001373871745,13400908719604830692,524288 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:2260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6596,i,1370820021141970449,499905858581036237,2097152 --field-trial-handle=1948,i,5406785372388311521,2483428144826989098,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:9
        5⤵
        
        PID:2760
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent opera "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5984
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent brave "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3172
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent edge "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --lang=en --force-renderer-accessibility=complete --no-first-run --no-default-browser-check --disable-default-browser-promo --disable-features=msEdgeFirstRunExperience --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x164,0x28c,0x7ff9d3e2c188,0x7ff9d3e2c194,0x7ff9d3e2c1a0
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,16500693726025810980,15924088728403926368,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,15258481806700008636,7894925269070669411,262144 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,14651691586082465203,16652589501064848574,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,1696487808926359426,15821643593445881414,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,7227997293831616847,11866526118584489391,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,4667540922707129058,15180751797697965327,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,12560182405988148465,6435578760781595663,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,126930026447768845,1158755632226887221,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,7289695303103565453,9333152460710743040,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,10146262386414109675,4016916114582331542,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
        5⤵
        
        PID:3328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9592960582484148545,6950289532810075214,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
        5⤵
        
        PID:3684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9592960582484148545,6950289532810075214,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
        5⤵
        
        PID:4132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17151509947516790302,4780249766342325733,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:5128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,11411461440332249952,8711316212382435772,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,13655027051630915884,1307712813963077010,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,5523168397485251791,3613876679987928860,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
        5⤵
        
        PID:1220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6964,i,10145917038357118603,2031401235202107713,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,11613461507719817831,12381960058469057421,524288 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:2224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6148,i,15867806348919116624,2844807140207393137,2097152 --field-trial-handle=2468,i,12273075159450653663,14699109218628827555,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff9d3e2c188,0x7ff9d3e2c194,0x7ff9d3e2c1a0
        6⤵
        
        PID:3356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,1909115986351422669,756101008872113487,262144 --field-trial-handle=2912,i,18068508245868236813,16988534382124963439,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
        6⤵
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10970689087834335703,14413822559010639322,524288 --field-trial-handle=2912,i,18068508245868236813,16988534382124963439,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,17758119961870437603,11033623768354918972,524288 --field-trial-handle=2912,i,18068508245868236813,16988534382124963439,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13
        6⤵
        
        PID:2888
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,14185059805668796603,12546106290742769285,524288 --field-trial-handle=2912,i,18068508245868236813,16988534382124963439,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
        6⤵
        
        PID:3328
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,14185059805668796603,12546106290742769285,524288 --field-trial-handle=2912,i,18068508245868236813,16988534382124963439,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
        6⤵
        
        PID:1364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 bea7f2784d3cf468e369f3a5f89a90b4516341e4a77dc90dd93189dd31b72a95
MD5 f98a6750d4e39ad09f05555cb9e241a1
SHA1 4d8d331ab8b9ed5c3fe58018651961f53e163d0e
SHA512 afcb597530204fa22b11dcfdb5d87ecc511be69c141a7fdea8b8cd8825f752970a25b5b544d924a1884d2cda0dd58a68f9069a12be24823bbee072e278394b2f
TLSH
T153B0129212C07604FF4C907016215E0284300D05300B0FC37EE222D45C2B4E04240323
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8830fbbc4fdd7b71e540822d073d811dbb7767402a6afb3f69a8b07d1321ab4b
MD5 3d567fc6f855e1f447fc0740a79600cf
SHA1 884e5cc7e022228b407741ab8fc9a6637349ce7c
SHA512 89119692f0be891a62ec57b27af3ee552c6ebb2f024548455b1a8d2bd2a4d1527f57e1a7add9a9719287d269af53af1448ace530104f39f20365a7242680d90c
TLSH
T1B9319EF7C3E4867D8A1152F4EB156E2FCE6A0524132D3866C8D46E2B93E2871E10469F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 e6f8e7380c026e24fc02a695570f6350a74789ad8bf1535592312590886df254
MD5 d4439a8e1e6f99eb09fc094ebb28c154
SHA1 caa19b68a97d32567385a2944fe80ad42c7afece
SHA512 a17cd9ccd154235bd6de103f796d3ee02e5de07725a8ef0168b6c386e62e0570e1adbb8c2fbe4793272183f2c5d41d3595b02c2e69448f359796435e7292dc08
TLSH
T1CCF059779A7DB17759AC856FAD04BC05B8B5F4B1014018E0CE9BC22CF0578E75B16156
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4c0b163c6769e034d3d857e88b15d8db435847d546fcc3c5115e8daf5b835df1
MD5 87c7cb5d72fb422bd16c6ee6f112b6da
SHA1 de83a6e39eeadc6621ad25112d863c093dbd04c9
SHA512 dd63875025747bf8b9bd9d947eb3eee333592fde24537a3dce4b20a229cc88aae437afc4710e39922aa52c113265aec0c5a437b0a934dd152b1b3dffc567f196
SSDEEP 192:rRf7C/ev7IvAPRp2l98Hsb+WNNoAM1PeP9d626q8kwvXUVVyIsnAUge:rRf7ga86XauwNcYP226DMDe
TLSH
T1B442A32EBE14797B9CDBC219F9257B53E7F5102261942E80E7FC896C14E79CC622B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b971d89928bcf5ca22dad487d8ca7ca1dac30d3989d24a8bee788bba3e2a78d8
MD5 ab4ec1ba664e96ae4dc7e62156574d0f
SHA1 ec559ac92aa4843b7dff3cff3ca427e641b38bfb
SHA512 8cfecc8804d919726aaea15c7b92482cc3c11d184c328c4cdc71931e7c1f0b03b0ec3e5f443b43cfc7deec7e27df30a4d1e57da18e01c09419c5b51e6a796078
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKN91rtumtK7Z:Majm97KxkXqKf/pUZNCgVLH2HfgslN1P
TLSH
T10B32D727A88D9E7F0FD8D518CC136F8B6CB5429362780D24A6FB9D0803A578E115A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 be7aa9b41650959f9a9428a613f34c30dc21eea44b7be05b72f28556cfdbafcd
MD5 0c1ee1020f67aab8e972f075f9347497
SHA1 13b803e032bb80541d3b36481e38194afd6d4410
SHA512 3827071a9e25017ae02c5e07307ad81e0f49da4494a1bb2d4820dc6ee06cf3c58709201c15e6f94a7d4fdeeeb53265fc3d1c3d1fa9bfc1b39bb9ae54dad2bd40
TLSH
T15DC09B42C45A9150C48440B55D66504D1305DE7994047B5596F85575CC65051515A651
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bf5a0a66c83ed28aa8db7026310ccd02fd8d1adb5a7073a7a9c240c67240c2c2
MD5 d6ea63a38dbf5fa11f40ffcd7f2e513a
SHA1 b7523f8a3ca4f219f3e8de6390c14ff5a014bad3
SHA512 6232a82ff6977491029b91bbba7985f9a632ec72c3de33add180b2f49c1898013b0922be94861e577aebbd0c18c86e4b453d2b519957ff9838780567c6159db8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b5a89a39cb14c2b4be0b8223f24c7e226a394d01d80826e4c1347242366a6c63
MD5 4448bcb2e6603859a565342b650efd77
SHA1 48ba0863caa217cdfa7f87719adbab2dbafbb55f
SHA512 9c3fcbd0c5dee188a731061d8e86d016c63524aad6fe52ab5705b7b6021d51c0c118aa210894998afa3f4231868e1f4c1bec52f74018a4faab0f704a0e823e03
TLSH
T16FA0021581D13814DD398370602B064662629C153D54C7434E9105489C6F1D052D1200
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a9c3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe59a9c3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 82de15c69b5b5c0515f1d263cd655dbab4415d3634e207075160c1ad28fd9cfa
MD5 d177872df82c3def8a24581834cabd80
SHA1 a5622d33db05a48d8d12c8275077df5c594401e1
SHA512 c26e95526d84fbb03eae52763c216fc67434f13f3b8d995bbc7789abab73e18f54d95f30f2319e0788e3d85730790aa9cc548c372440a56447a507e3716b96f4
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok58HDVB6eGyvkonlob1v4a:MC0HJm5FHuPgXDUDurW8nlobZ
TLSH
T1C4A12AB1A8A948B759B7D745F8932A83DEA4A22769A0FF80D9DD1E0C11F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8aa09b07442fa63b37c9299890481901a7745d9780138fa4920fe90fe50c8c8a
MD5 7e8c17fcec6eca68ce4e3a89e15f7141
SHA1 cf7f90482cc9a36954b21b0f75e8f0efcdf8a4f2
SHA512 fb1e117ff024d85c2ffce9e749d998a20189cf899c73c3aa392b7d09cbf8c299bb05c7828a1e4d222676cca46d4fb94eaae0863ed90d3a64f6492ee000a9eca0
SSDEEP 3072:vtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgn:E0mAIpUNVS6n
TLSH
T127D31236ECE31D3A37DBAAD2B8802F78643251E2D4484A6889D16E4F7DDBB483507D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 037bc01fb133cf3d93fdb48fe17f63e3caa906a67a4d5a5622a49147cbaad669
MD5 e3a7ff1fc3bad13e5668c6aa5c75c81a
SHA1 6989d5e7550ac632239a373e1bdde23caf650701
SHA512 1d1a4d6d363ad85aa167cbef04f6b78b413ea2891615d05594cfa14af1a7cd10dba38edda5381427d4aedc03bdf38137b1f6952f3fa90e192f5d860a4a933ea0
SSDEEP 3072:StMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgn:30mAIpUNVS6n
TLSH
T19ED31236ECE71D3A33DBAAD2B8802F78643251E2D4484A6889D16E4F7DDBB483507D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a1543e141bcac6845e80f7597bc5a48c52eda15752369839114435c775ff0db
MD5 4b1600eeaf18f9d0d74107f0bf15d9ad
SHA1 a602ab2181073d42638a54721c78ed5654cf91d0
SHA512 391fe5637eb109f2fac0e0ed3da8957edd8cc4b457326349e4a1b00e2d6b2910da17db31c73e8e801aba10f562de1672bafd44a9527a5af010ebaef20434f80c
TLSH
T12BD09718421DAF51F037B23521C67244396F6052A843B492288002180CC720003A18B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb252e5fb54364dc485c5a2dda234602e8e323796f5ff80a98a0147070de4ecc
MD5 d68a52a125fd95cb075c4dd0868cc829
SHA1 05bf3362891eabd332681b7e1fc6217bb24b6f4e
SHA512 6d381cd8c3d2ab0ea15e2ec1745eb55b76cc7f4daa66bf248299e7661858e1965bbb2e561745c0fde9d1e1fb6840d0df67fff15f8c58d79148bfd50c2e89ef31
TLSH
T1F9D097248128BFD2F03BA23C11A1228434AD1083A902A483684002290C6624202F0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

0b0e082c-6671-49c9-bf82-625b424b0965.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b0e082c-6671-49c9-bf82-625b424b0965.tmp
Size 414B
SHA256 3742638613abf863ab6e16243971761a9cdb6701c9fd7637209d001dfd28c723
MD5 944cbcf829b378d840973e8478468748
SHA1 5623580abe17af38c40879a3d3c4bfaa8ccf6c0c
SHA512 0902b60c9a255411fc25f33734222d54edd9ace79d29dcce389f0451c624b74ac916cd5e55ce37319bec9e29bc3df6278b69d1f65ec5de8e7933019e71d408c4
TLSH
T107E02BE5CCA1EC3B08FC57299494474AE71013572A80498F363C820D8FF463A0586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d4d070eb96a4dcfcc54e7e8bcdfc1d17f3973c33c62fa0a24c0906123f0f7727
MD5 05ef15ce8ccf3691c7a5ac895307719e
SHA1 ce62128e50c0dc4d0a16afb3c134db3d5bbad259
SHA512 06eca56c9f077eef2be55cccaa6ddd7bd25c91ee1e26059350b0871a9ebd281e7aa26f962a3c6d96095389ed63dc3d041306dadeab20de7286241c9ab472fbaf
TLSH
T1EB5162530311CBC1F3E284B261E97549BAF9A8590227AE01834CAD789D36F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a2dd.TMP
Size 2KB
SHA256 f74ea28c27aa9fd2a8bd3eb15e3831bb3e7d84df9cc2eaad13087f85d570c230
MD5 d68e82a61c18c566c4acf0d25b86ca89
SHA1 a288b3aa33826e7c8531a9fc5e9f15390a35eb4f
SHA512 e7ae6960bb9a747f92859baabe0af6c3793b73431e6d1d67b268af26dd110d2ad36af8ddbbb6f6b379dbd1051c9645ba18bb8e5d7a7f1f4484c13965330b78c9
TLSH
T1A05152530311CBC1F3E245B265E97549BEF9A8990227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c5f42f9f1f31b8ee5c9028759f9b3505d88c6061251e3fd80e398e2bd0eb292f
MD5 cdab5cf92aa6736f5658a68fc3da8913
SHA1 1a82d5b48dcd9264084403e3eef9b6ee5b916dc4
SHA512 0f1fc1db47f86c36d2c119bab9d8652b3dc85742f8f061e18a97c30a9ec4e3d0c3b5c178f0cdb7a89448873e972ad9a83910732cf6a7e4be11b363bc4f65fba4
TLSH
T10451C0F3C3F8866DCA0155F4AA146E2BCE1D0915432C7D5A85E49E2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8897dfb044ef51d468e5039a3233d7f9ecd4b1fd82b30e81eb6c7adbb19f38ca
MD5 39fee64f8a6c9c8a551e4d2f09b60cb2
SHA1 dc277cc4a200634291b978ab94ce510150c6312b
SHA512 650ba62d3be42ac4eaacf2864d5cadc22d344f8a52d798522cda6807cbbf41a286e4ceee34f4191360613412a81956859539b53abc0ccea6d6b740c11c6f141e
TLSH
T14151E1F3C3F8866ECA0155F4AA046E2BCE1D0915432C7C5AC5E49E2B93F3471E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 88755ccf8b4ef2887e81c4311782a424cec548b592679769da2a26396bea5f3c
MD5 4108527471725e22ebf074b8e7a950bb
SHA1 eb9ae262cdc30b2d37303d5098ce6b6b9be88e47
SHA512 fa56fb57c794b5d493c47df74b846fbf2b8a34efb491d6ca37959e32c302d8c4b7c764a9bda76c3669c2eac6766a5acddcd5ad1f771e0048b634faf306ddb050
SSDEEP 192:sxRy6RECy/f/Es+QcZAOwCzoD8pi/g6+WNLoQX/YCauOGGDIgVcwqJ:sxR/Fy/fss+QiAb+i/5LX/85A
TLSH
T12B42B8156E29AD3B4CCBD21DFA65BF53D2F9503261902E48EBFC9A1C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 bdb42ed5ab6d44799fbbffb54ba8e6b9db98bb9569b6db462bf100ffb23e7320
MD5 94c85b6618aade52131d96845f2590cd
SHA1 66848500a35f0996bc3efe4a4ef5e4df7a3e8a20
SHA512 cab7c867135260951695f4a90da01ddb3641eb25199a222f41e9d36b1dc02a69cdf750940ad45a3d39ee2637f74b53a4facbbb17aa8f50babb8cdd30f3e37f2a
SSDEEP 192:st+v5vsZuXde5lS13oo+sV+Fij+dOWGKHJ:st+RvskY5lxsGiLU
TLSH
T12E12A7155A28983F8CCAE21DBB667F53D2F96072A2A46E54F7FC870C44E66DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dbfc4b9e235ec02d829a8b29710fc0159e067fe0b432ee0e2cebe163d066f026
MD5 87edaa9c7fa8b2d1f0dba5ad61915dbf
SHA1 4c8a2e50c76a32765adc31ebab7b381e182db84c
SHA512 b4824d42d59bc61bcb47f23dcd69d28d9f0a36384862ded983c213bd7c2f09b3f03f27000481a2fdb4d9ec9afe758e5e0a743f3489df243f210bca7656e838bf
SSDEEP 192:sxRt6RubCy/f/EsfWpVfQcZAOwCzoD8pi/g6+WNLoQX/YG8uOBgDIgD4cwqJ:sxRYVy/fssfWvfQiAb+i/5LX/WO9
TLSH
T16C42D9156E29AD3B4CDBD21CFB69BF53D6F9503361902E44A6FC8A1C10E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4894c697be07007634f8577cacd0a4352b464841d717cb43b08bc0ba979e66da
MD5 d69ef062a3d6e4fecdf06092123aa74c
SHA1 56621304ed56792e1ac55ca78b14e9f176b209db
SHA512 44a22d14885ba01771183c51a3968e07a16aa30c637a940f861b4abab032a9df0e498fbff89251f173b38631de028d864c7c90b15306f052f69b35071a3a01ce
SSDEEP 192:sxRt6RECy/f/EsIQcZAOwCzoD8pi/g6+WNLoQX/YCauOGGDIgD4cwqJ:sxRYFy/fssIQiAb+i/5LX/859
TLSH
T1A142C9156E29AD3B4CCBD21DFA65BF53D2F9503261902E48E7FC9A1C14E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3a253037aa25e2e37f2b9390b1bffd4eb3c136c696d8e4a67d0a23a9e2b16905
MD5 e7fe4d702ad6f40f29d6ea44d26c4160
SHA1 3df76ab894ae3f99eac5b8faa900bca004835298
SHA512 ac8e21f39cbbd0548a096407b125edf7a6770ed7c72c498c799771c92fa562c93357c3b742a39c431487bed32ddcf9b5d0f18eafe8de46d7685cf29a0dcafdb1
SSDEEP 768:jC+vbm7pLhLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwyikvpQqc4rolO:jC+vbGdzDQWgQ+f4+u1jazyikhVcD6uI
TLSH
T1EDD2EA7B640DCB7F4F804A9DEC197EDF6DA801CB9698DD4047FA841C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7afc4d83a0b38adaa48838fa68bd1dfa145c79e0935d1ae4876ad4d721cbeda1
MD5 2b5561f262ce640ff2644533d7403479
SHA1 210d4bdc281dbcda913c6ee5014d854ff718a42f
SHA512 abd9f80ce1637bf8a101045818df535d42c68ce751a22f238989f00abec2849060558f93afe930c5eaeb2f0c6f0bac9d1e2967352951add3400a6cc71a7c25bc
SSDEEP 768:jC+vbm7pLhLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwy0Qqc4roZoey:jC+vbGdzDQWgQ+f4+u1jazy0VcDmt
TLSH
T14AD2EA7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD5047FA841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 895ab851229b4b52ab5293e93ad50f7cf139295f5647118afa9963fef8bb5e6f
MD5 b9803aa15902a949bd4532a6283557ae
SHA1 8a6a830b348ab2575bdc05ce9c6d8a0d7d8a16d3
SHA512 6dae670a5c775799d82075477fb2bc009df600b28c95e119dcfe3d5a2ebd701fda024f2dc09180b60b474cc0252bf6330fb0d90cde378b5e04377d994ca99cba
TLSH
T16AB024030D1FF040C55C007C4473404C535D1C51440433113074F074CCFDC417037011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a2af.TMP
Size 48B
SHA256 e0099567480be98e1ba74e053a151c36b8ecde1c2b8beb2bb04efb725ca29770
MD5 edece4c1f1d71a91c19ea1301ee6d642
SHA1 abe0fd9ac06baadc2366922776f41f2054dd1ad5
SHA512 7b20be0df9eb411d1ae899da173e78b086fb63beefe9326918a365d2558d511c82e286657d498e2ae1e1a50a2ab2a021f49c3adf79a42d476026a0a0d842972f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66b7d567f0e64066e2590db35c0b91ce7ec0e0d99b86c66f7aa8ffd81d120e5c
MD5 c86d14376059ea974f05d143d82ba747
SHA1 509250bc62f8a185a8274867cbe0f02bbae8da6f
SHA512 a1d188c634d34cd60353bd77a58e7a0efc74b8ea161ff02da31233a25f63bc7e074bf690e51b24674f8726fb6f2cd274ede1591dd93aeae42816d0414b76248f
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHIuoIuZIusIu4IuqIu2Iu6IugWIueIuDII:CbEBVj5JAdSp9/EgTK7j6dJOHIuoIuZ5
TLSH
T194911704717A02D1787EB50CC0798C2E86C5B4B33619E52B7BA846661F66F43BEFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ad6d083c0a50a2e0c403661be330ab1fb10119b1768a83c6e41e8516bd2a6776
MD5 346b1680f6b16c843645c9f6826eba34
SHA1 d19b68635ed7f2b9b52fec1f4c648fe66a809fa2
SHA512 ef38f35df17761f64ea46bc937a6452af4f72d1cddac08e8a639055802e28af150ff33503694b2d0a8871e3ea7e7a8a10279be78db7cc31ff69181b0a4304727
SSDEEP 768:9c30nKty9oeEp8+p3bd66j+4BRv86aLIWmVyLhN/:9c36CeS8+p3Z6n4yEiz/
TLSH
T1A0F2AEB1EDA9AD779CF5CB48B29A7B436FF4506392C01D84E8DD6B0D048725E170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 235c6bea369488950c00563c251015a864e68f09c453d17d63ef102fa02a4f19
MD5 21347f28bc611c8fd598a30540867fb0
SHA1 16fc9b94b64f319613714794a5ce97ea68cc0fd3
SHA512 82c9e4884a671f9d0479b9672b993e4e0d1606c8cb18b9095aa15f12a4724a89af5dd62c21a1e768df14fc34b3b319684f435c8ae36da6c2f84b47b5e2f97acf
SSDEEP 768:9B3k0nKty9oeEp8+p3bd66j+4BRv86aLIW/RbLPhOfVyLhN/:9B39CeS8+p3Z6n4yVBLpOfiz/
TLSH
T104038C7DDC54993F88EDF748A24E3A075EA44133D2F41994E7D82B0D907A16DF70B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf9e89aef2c55a353c024359b4a6b761a99814cbb96897acbc6a13c6133ec6f2
MD5 cd8d718a0f796d24c49a27bd7f79721f
SHA1 a29a3ef5b31219e5c84e27bcded92c177031b3ca
SHA512 0c68b82560c2bf28c43b1fe935aed23ca29d7a00c13ebf61fe70ee93b89a08440975d680814df9f88234bbb8304338f8923960252d1f321e46b505a65a725f67
SSDEEP 768:Irv+4UNbdD3hcKtyZNp8+p3bd66j+4BRv86aLIiI2bwCl1:Ibsbp38ZL8+p3Z6n4yS0ww
TLSH
T1FA03CF73F96899339CF6C644B2867B437FF851A396C10AC4E5DD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c6d360e1d7f39f936a243c1092e8068835a7f76b7c434bf0be6ae9b2d1e93d8b
MD5 e0a9af6d5ca6539af014b559463b6433
SHA1 fc50736d8ca9e84ebf5781533c18e935d6aebde9
SHA512 3ef675d7110520d84c528c32eaa458b7550e4b08fa2ec2124eb3d2b4009b328e29b8b31f7c34c9623206881cac1fc77c1f1926d64702788bcbf87c48a9eb61f4
SSDEEP 768:Rrv+4UNbdD3HRKty9oeNp8+p3bd66j+4BRv86aLITm2bwCl1:Rbsbp3bCeL8+p3Z6n4yn0ww
TLSH
T15803CF72E968A973DDF6CA44B1467B437FF851A391C10EC4E8D92B4E409B25E230B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8063e68131496501c18087750c78630f97d725ac2590d0b64d12fc229674d84d
MD5 975270d678ebff3c5589f7ebcc5292d6
SHA1 90f0529c3fabe08c0809b8785f7f16580c0c20a7
SHA512 9279b8b42925dca3fe3e6de260cd6097ed34d1f7ac59f5eb010ea3eeae30f78e2bc74b48bb0eaf9b3d3a4a5c95f0b075522a82c36924272e1a0125659950d9a8
SSDEEP 3:MsEllllkEthXllkl2zEflp5R+/l:/M/xT02z+5R+/
TLSH
T1B44404047FC4144DC5001130D053C3501771F4100571574334D114335CC75401C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

9a6abd44-2a6c-40ee-b21c-571210a729c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9a6abd44-2a6c-40ee-b21c-571210a729c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe597083.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe597083.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

8008e997-1867-4c57-9028-f8afc1f9120d.tmp

Path C:\Users\Admin\AppData\Local\Temp\8008e997-1867-4c57-9028-f8afc1f9120d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2536_990715996\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_487396925\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_895870258\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\background.js
Size 11KB
SHA256 326d9688b7211fb1d363f1ae7554dcadfdf0511277ef591d43d4dd487c19ae77
MD5 bb4d515fbe39c04c3b85842d13cd087a
SHA1 2f5ae70405b61404325542e993da21d7678f86bb
SHA512 f7aa9494aa0e88fcf0897c3b21da7b12db954e40633e5001bd85f11462ad96aa3193de260e48e07b22f9564a77f0c6753c0b26919efe3786dc5c2f96c8370531
SSDEEP 192:v5XVFv9SqIjiphSA35qM4dbdUSVd0Ud9p4U/KpEMo4qQepk/zhqE8g5GjOXl5:RIUDn/STEdwQT7oEoqXj
TLSH
T1C032646A58370939657237BDAB33A046FE23413B2500878A7FBC59501F796E646E0FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\content.js
Size 1KB
SHA256 cae68eb9e63245b9b3d67de03e06cb28b7b30f886ea7485368fdf92d3f5f0c57
MD5 4353b8bcffb1a35320c8b4cd9c8f36cf
SHA1 6a7375ff1b03853b3f6687a416fb2805a88fbea5
SHA512 cf393e48176f850cf5124ab2b5634d6475d28133bdae97108501464fb11d58654a7c7eb7a320128eb9a75f85b9708879d2d3d34ddaa8ad57030856c9f6652ba4
TLSH
T1C4310DC77C9B283A4970DBADEB365945FB2A406725619316F1AC89A43F25FB00150EC9
MD5 SHA1 SHA512 TLSH

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-128.png
Size 1KB
SHA256 f9d1490575602aeb22c282b80fdc6d096d9e7eb783e659a7fb21275c5ee373cc
MD5 87194cc1cdc7d8ef4bed77aed0c02bac
SHA1 8a5498cf0c18353f97c12ea544ced2f0731312f7
SHA512 fa60b4fe72a38f111e1bfcbb932c3a1e0cd751382087eaffabf402d82a30970c2de31f4f034285e324f3da98ff5918edaa9d8408ca62beb5603ffb57bd1e6b60
TLSH
T1D8310983801035CE119A4F93B7D56C31DA2ADE85EC1CDFA0722372BB284A489C856300
MD5 SHA1 SHA512 TLSH

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-16.png
Size 252B
SHA256 f5be0c047ac80fd71f2875669e8c671d85b023bf43c52dd0c65dc08420f85412
MD5 2e274e9257d4f34f32243418c2acac62
SHA1 3bc52966811647667c0df500d0cddc14a72bdefa
SHA512 20e4756382972a4481dc09dd03192f94d22d99885ad0896d549600ddbdf6e465ba92373f6c97a02cfa45812e9c1cd218c391707456dbc27b8dcd1842d88d5acf
TLSH
T1A5D075DA7126C860CC60CB3ACCBC1013FD09313D4468178015890439022148FD268D77
MD5 SHA1 SHA512 TLSH

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-32.png
Size 450B
SHA256 81543a9c6b400ae6ee27afa3792433dfb3adf4ac03b99bb98a6fd69bac94c1ac
MD5 6549cb07555e9984b6f8801233d544ae
SHA1 d3c7749a17c87ea99e097db372868d2c5e9ff1c4
SHA512 f14cb10244e21e0c934fe9b9d1076f07606d6403c4a3e1610ad856ed7c84d939fb82d8281f03153819cc4994f1a358c52836a14807e8a980ea38895130fa15ca
TLSH
T130F023E3775865EDA200E307570B52698C331F0C001EA9063180523283B3B1C2593BF8
MD5 SHA1 SHA512 TLSH

Submit Download

icon-48.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-48.png
Size 633B
SHA256 ef04c8124ec47beed0a68b3e2445e65f6bc19b0f00bffe6f31e9c9043317b81b
MD5 c146d15b2a82b696a4d6ea85977a06c3
SHA1 8649ff8e195cbaf93c2891af6077ced9fd416b6e
SHA512 f3f0920437ddf1a240dd3ef783383509ec16dddd3eed044486a38e17164f87eb99e06fdec90c39c322d0171976f09a2a85963e1f5540727bedae29cdb43c325e
TLSH
T108F062D13EC3706CC72F156A9A4220634808033242A3803E86A3213527EED4EB8F82EE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\main_extension\extension\manifest.json
Size 896B
SHA256 d7a007aa1e923dfbd0873d568bdae26c3b92b2de275d2b1c355ed664fe3c97f9
MD5 c1dbba9c98138c355499f2f5076e1fe1
SHA1 db214bb13d7647d91cfe02b3e81a96a4fa0744d3
SHA512 bde29f93c625353e11e6256f93656c0e4ade54675233b69efc3bac4a2e2dc314f86ed20d577d4f7a7e84c2a8c922d458158cb6f104c88b62b47a886a8639d47d
TLSH
T1B2115533E8204E3303B8AB6929B24243FB20078B50D02C8FB9BE90584FB96990557F58
MD5 SHA1 SHA512 TLSH

Submit Download

pr.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\pr.js
Size 980B
SHA256 cded005c7dc6d6d8669fed3540cc12b81a5d4a4d5fc991e4f0e1ea1e038a0ed5
MD5 1f92ef0995d6a9548ea6324b5b5594f1
SHA1 62a22c1db26dea3a25e971567b82d54bd2be2995
SHA512 f086d8ccaa1e474f4ae11324b8a13e101160a2e129ace9259741793b4e4c29b421e3d182744343e6711c7441d7de93bd38750e035d283ce48ef10b5851c8774e
TLSH
T15211BDF3713250220DB5AAE57563A836E623E23F3585C281BA2D44A02F77294C4B1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

socket.io.esm.min.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\socket.io.esm.min.js
Size 39KB
SHA256 56eb37a25aaac55ee1481f278f306008881b645abe1b415ef943db56a42631d0
MD5 fd9c2d32975ac38dbb59055186830659
SHA1 4460c08fd9e3f06b1e05c813ac96a234bdd9b99a
SHA512 abd8d9cae2723e1da1548e8810967f4ffb60c9528a4d99e3af82ac04be76ea63e5a4e8c6e13ff8407c2a949fa36a07708b906d03824b4e2dbdc9fdb1de66561f
SSDEEP 768:cZozDDpC89b6HJhziqfPgC97cLhil9utGFvpk+ymUIOd68IUwGMGl8+/+nHlqUSl:1gHsQ2twsI/4NI0
TLSH
T16E030BC5B2A1506143E251E3C0750503F329A969784580ACBF6CEEF3AC69DCAB277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsw.exe

Path C:\Users\Admin\AppData\Local\wsw\wsw.exe
Size 1.5MB
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download