00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
Size 1.5MB
Sample260910-3xqvrshr3x
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3576	wsw.exe
2888	wsw.exe
3260	wsw.exe
2284	wsw.exe
2244	wsw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4116	msedge.exe
436	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335580388252537"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{99EE94D0-03C7-43D0-88AE-5D9F2C805715}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
4720	chrome.exe
4720	chrome.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
3260	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2284	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
4720	chrome.exe
1472	msedge.exe
4720	chrome.exe
1472	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
4720	chrome.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2888	wsw.exe
2888	wsw.exe
5812	chrome.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2888	wsw.exe
2528	msedge.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe
2244	wsw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3576	2704	00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe	87
PID 3576 wrote to memory of 2888	3576	wsw.exe	88
PID 2888 wrote to memory of 4720	2888	wsw.exe	89
PID 4720 wrote to memory of 3012	4720	chrome.exe	90
PID 4720 wrote to memory of 436	4720	chrome.exe	91
PID 4720 wrote to memory of 4220	4720	chrome.exe	92
PID 4720 wrote to memory of 4220	4720	chrome.exe	92
PID 3576 wrote to memory of 3260	3576	wsw.exe	93
PID 4720 wrote to memory of 3136	4720	chrome.exe	94
PID 4720 wrote to memory of 3136	4720	chrome.exe	94
PID 4720 wrote to memory of 3720	4720	chrome.exe	95
PID 4720 wrote to memory of 3720	4720	chrome.exe	95
PID 4720 wrote to memory of 4840	4720	chrome.exe	96
PID 4720 wrote to memory of 4840	4720	chrome.exe	96
PID 4720 wrote to memory of 4044	4720	chrome.exe	97
PID 4720 wrote to memory of 4044	4720	chrome.exe	97
PID 3576 wrote to memory of 2284	3576	wsw.exe	102
PID 3576 wrote to memory of 2244	3576	wsw.exe	105
PID 2244 wrote to memory of 1472	2244	wsw.exe	106
PID 1472 wrote to memory of 1252	1472	msedge.exe	107
PID 1472 wrote to memory of 2104	1472	msedge.exe	108
PID 1472 wrote to memory of 4116	1472	msedge.exe	109
PID 1472 wrote to memory of 2104	1472	msedge.exe	108
PID 1472 wrote to memory of 2104	1472	msedge.exe	108
PID 1472 wrote to memory of 3176	1472	msedge.exe	110
PID 1472 wrote to memory of 3176	1472	msedge.exe	110
PID 1472 wrote to memory of 3280	1472	msedge.exe	112
PID 1472 wrote to memory of 4156	1472	msedge.exe	113
PID 1472 wrote to memory of 3280	1472	msedge.exe	112
PID 1472 wrote to memory of 3280	1472	msedge.exe	112
PID 1472 wrote to memory of 4156	1472	msedge.exe	113
PID 1472 wrote to memory of 4156	1472	msedge.exe	113
PID 1472 wrote to memory of 2044	1472	msedge.exe	114
PID 1472 wrote to memory of 5104	1472	msedge.exe	115
PID 1472 wrote to memory of 2044	1472	msedge.exe	114
PID 1472 wrote to memory of 2044	1472	msedge.exe	114
PID 1472 wrote to memory of 5104	1472	msedge.exe	115
PID 1472 wrote to memory of 5104	1472	msedge.exe	115
PID 1472 wrote to memory of 556	1472	msedge.exe	118
PID 1472 wrote to memory of 556	1472	msedge.exe	118
PID 1472 wrote to memory of 3140	1472	msedge.exe	119
PID 1472 wrote to memory of 3140	1472	msedge.exe	119
PID 4720 wrote to memory of 1864	4720	chrome.exe	120
PID 4720 wrote to memory of 4668	4720	chrome.exe	123
PID 4720 wrote to memory of 4668	4720	chrome.exe	123
PID 1472 wrote to memory of 3104	1472	msedge.exe	124
PID 1472 wrote to memory of 5032	1472	msedge.exe	125
PID 1472 wrote to memory of 3104	1472	msedge.exe	124
PID 1472 wrote to memory of 5032	1472	msedge.exe	125
PID 1472 wrote to memory of 5320	1472	msedge.exe	129
PID 1472 wrote to memory of 5760	1472	msedge.exe	130
PID 1472 wrote to memory of 5768	1472	msedge.exe	131
PID 1472 wrote to memory of 5760	1472	msedge.exe	130
PID 1472 wrote to memory of 5768	1472	msedge.exe	131
PID 1472 wrote to memory of 5936	1472	msedge.exe	132
PID 1472 wrote to memory of 5936	1472	msedge.exe	132
PID 1472 wrote to memory of 5976	1472	msedge.exe	133
PID 1472 wrote to memory of 5976	1472	msedge.exe	133
PID 1472 wrote to memory of 5632	1472	msedge.exe	135
PID 1472 wrote to memory of 5632	1472	msedge.exe	135
PID 1472 wrote to memory of 3196	1472	msedge.exe	136
PID 1472 wrote to memory of 3196	1472	msedge.exe	136
PID 1472 wrote to memory of 3196	1472	msedge.exe	136
PID 4720 wrote to memory of 5812	4720	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
"C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\wsw\wsw.exe
  "C:\Users\Admin\AppData\Local\wsw\wsw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent chrome "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --lang=en --force-renderer-accessibility --no-first-run --no-default-browser-check --disable-default-browser-promo --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff08e5c728,0x7fff08e5c734,0x7fff08e5c740
        5⤵
        
        PID:3012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,14048989464874727040,5459098036440634484,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,102732800030011161,3959484265530510110,262144 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:4220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,6319377523033987336,6179674988221733600,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:8
        5⤵
        
        PID:3136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,16061109210170807480,2073447462535143062,2097152 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:3720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,4086238597491425668,8001115431734632244,2097152 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:4840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=1280,i,16930529019183909473,3695305984461313336,2097152 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4172 /prefetch:2
        5⤵
        
        PID:4044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,6379430454937280202,2865380066207322349,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:8
        5⤵
        
        PID:1864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5268,i,10334286477657220909,4399102121303432788,2097152 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:4668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,9817056914112264917,5714856542876892468,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6128,i,1022698753284867441,21210761509329283,2097152 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:2
        5⤵
        
        PID:6040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,1119739599229249345,3444426739224762753,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:8
        5⤵
        
        PID:5364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=216,i,2030515490648756236,9106903448745888760,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:8
        5⤵
        
        PID:5556
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,13857516442374975296,9540064565125554038,524288 --field-trial-handle=2040,i,3563982338699497400,1589932606647794206,262144 --disable-features=Translate --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
        5⤵
        
        PID:5648
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent opera "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3260
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent brave "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent edge "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --lang=en --force-renderer-accessibility=complete --no-first-run --no-default-browser-check --disable-default-browser-promo --disable-features=msEdgeFirstRunExperience --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffef8d5c188,0x7ffef8d5c194,0x7ffef8d5c1a0
        5⤵
        
        PID:1252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,4511494682832014412,16749799358172123718,262144 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2731144121851618886,16624326738545033313,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8787962078993767817,4791503758640166279,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:8
        5⤵
        
        PID:3176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,4532074265587408318,16980329843772236639,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:3280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,17102283891724611441,37991745266699589,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        5⤵
        
        PID:4156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,1724095455005253355,8631662217687629941,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
        5⤵
        
        PID:2044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,10619134484564817977,13432629656235749235,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
        5⤵
        
        PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4102593229174467657,14468806342986130199,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,2557592958077364819,14328799899748405647,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17331736152254817978,5871043186263593732,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4762939752177374775,14038649191389478360,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4770109231633393182,4222776969030900312,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4770109231633393182,4222776969030900312,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9188706027331748195,1062640895840786677,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
        5⤵
        
        PID:5760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,417592112374044193,11350728024116231796,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
        5⤵
        
        PID:5768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,363908457985268601,7938308839108081741,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
        5⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14343515509630783311,11176926013343432603,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11967998008402335723,2167463078506658840,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6256,i,17743447734604592614,12934153724100697802,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
        5⤵
        
        PID:3196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,15597093116162908063,10787543789110007527,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4268,i,15100637810995163096,10895126677575975857,2097152 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:2
        5⤵
        
        PID:5268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,13440387422516302163,17182756582965755086,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        5⤵
        
        PID:780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,128500648608516369,5413487908375971673,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,4224271592397384131,11981931840585611828,524288 --field-trial-handle=2320,i,1080505915187046541,10726315581545159938,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
        5⤵
        
        PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9184d1b82e80783e31c46ba4f2bade0c1c48611b8f486b98dc7229be225e8e1e
MD5 c1698b53cc81af69ced91de1dc41eb5f
SHA1 147a30e4511c8567891b1b852b107b15f97972ad
SHA512 c9b9eb636ea40c22a1e454cbe4de2693f78184883916f2333ac9a5ff05faa908d82c193a5f354395a9561282081c5b05dd375e6d9c010e3883df1ddc0d8825bc
TLSH
T147E02BEDD821AC271CFD1B2824140645E79003167F90C94F3B3DC2098FF5A7B8566D6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 54126b57a1d039ba06ae31e48c58cb5a6fbcebf65557dda98a51f61b0b134151
MD5 11e190400752a2a53d89d0e10cbe8e21
SHA1 e1ccf3c7aabd98fa4a80579b638ad6e44f189d50
SHA512 e1fb1395b668cfd2f234f2da2e49497f65de5574e7b2ee6ebef9b67e16cccd0ba91bc9410de1321fbe17e285585a3b18688e075f31080e458c2f2c9f3fcaaea8
TLSH
T11FB0126203C01600EF846AF00B31CC4410B1099E1197434383D3E8E48C7F8F4F2002C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 568f3d609e9a67f748d35ef214026d9955623caa71736d121ce1772256ac161a
MD5 3ac4bd33e710b3dff7351273bcc3af21
SHA1 8c5bd9499a56ffbff914aacf1bb2243a17c4fbf0
SHA512 d27d4988dfd8b7eabca4fa898a3c3133a7da09c135b61eb20d7a1e9d6b2289063c2b99c9e77aa4e2f5b725a9f8704e95f86d2d4034d751944fd410949dcd09b5
TLSH
T16441B0F793B4867E8A1196F4DB156E2FCE790524132C3CA689D46E2743F28B2D10174F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 ed8643e3acc21c3044f93e90cbf64401aa6bf9888e97cf17b817483a9b6e3e6e
MD5 0174e6a35096957b99ac36c4cf7726dd
SHA1 12924e52615f2d0fd62df9507ddbc4ff83413370
SHA512 a539e0c5da80b7d7009524b00b72c643683da7dff53c988555c7e01a61eb491e857ffec2ed9d15d02fbfd822948b2463a87d468e30ad68e602296e092bb2e744
TLSH
T191014767AABE742750B946A61D05B80A6975A4300281B9A9DA6A926CA0D34F31712463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 03b52ee2cd42ae073bc4323ba83d65f645ddca76f7debbc42627c7a153d61cde
MD5 32e41fb32f77576b0d8af9688c6cc11c
SHA1 cdd79cbca8de99beed6d813c3c09d4da7d47f072
SHA512 2697cd2b882be4d11bb7655275e3bd112fbf8231e9497140113707414bfde75d40b8b7c6f046f73391a86e2d8ff1ad4444ca691663b74772e6f5e9d4ae09a6ae
SSDEEP 192:4RIfI4blUlEv7cpAPRp2qg9BHsb+WNNoZG1rGP/aCkwnnzVyIsnAUgtaJ:4RIfwgwUXlgrwN3QPCCHV8
TLSH
T12842D83EAD10697B9CDBC215F9267B53E7F5102225902E84E6FC8E2C24E76CD221751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 192B
SHA256 77dfe2380fbdc138ab1eb40c15ce460221ed635e6534d3566518f070f95c22a3
MD5 e9df38cce498643d3b758db1abe0da83
SHA1 f63fd246f4b47e8d8f27c170bca8d51b5dc44537
SHA512 a2a4a324da639dd6e0e6c50d79bde593be98135b309d4d4d743c0560685e779342d9743eca3dd764264488ec4757a52ca4447a406d7680f696f5b2ae7b56a5e1
TLSH
T149C02B1381502100C052067C0103F4F8130CDE72D00D334043E0F727EC74121D00D156
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 24410a5c5ac4f069c0a4e228defa405d12de4db8c3a504350f6ac07727bb4f49
MD5 4276e6f5fa984eb6e1c8aab871003407
SHA1 366d404fbfb2696b925c31419463ba0a1302e7f8
SHA512 35afa7952de2272ef3e800126c22f7acd36c9accf7d855ba0d4fa756b83b4a97810c1a6ab4024b050ae718e76e7d8f7be1c1adc4a014bd052e1b2c413e5f9ad8
TLSH
T1F3B0120084415101C08303B151562488B26C5F10970A1B2573E4E922C826161C014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59117b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59117b.TMP
Size 96B
SHA256 ac0f5cc510ec89a8e125851ca7023ca1b12a0aa1e5afcf1bfed5db145ab8146f
MD5 16b73718055d3634216a18459128c9d6
SHA1 6030d360778c3c13b9126494baec6030acaf499e
SHA512 5b4c5026ca04d7715e1f14ba44961d9192ba2491f4e940faf0588efc93f5f0e7509ce8ba0aa044ebfe73a52d9384b18222ba920fe1dbbb9e045d41a4429d4732
TLSH
T16DB002A5C2126213C05203B1769997E87160DF35DA43D61293E05B66DC2DB75C525174
MD5 SHA1 SHA512 TLSH

Submit Download

ff320801-3219-4757-b295-9fce8ac38eed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff320801-3219-4757-b295-9fce8ac38eed.tmp
Size 17KB
SHA256 3d88c3c6cbabdbf9bc7a5a0997f679a891df679cbe5e6e4dee557461f220d948
MD5 510ccda02a84f4bf9b684640c15b3a35
SHA1 dc7f78fe3471e2605a5e8a0a335b2a7153b85120
SHA512 aa11455c3cf0a02f201499e6fa76e2c491908ac245499a2e833ffec48f02b046f42b2b1471a8b0e4a9787485f88ed02070120ee84ab7b5da7ddceb912a1fbfa1
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLhLcSjzOXODR0+ErU3DyHGYNt3Yw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7pm
TLSH
T1F172D9676C4C9A770F94C6CCD8277F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 5b1de2931ff7f81a54224a867f11e6a4e1671002541e39ff84a957fff0e36d9d
MD5 031882b3f89799d7732a81cc1bf05698
SHA1 ea5288f587c1237555a9c6809b9f118310b62225
SHA512 79c0ac0efd82167750137fe2be0832b2817daa5b658c515be445622d102939149d27c38b45da349454276187f6f3bfc20c28af5a212779f0332c18a9b2d8b39e
SSDEEP 6144:elC949PSmzO3XvANUPVFmUi21rSm8uUVNSlzYX:ICW9PXzOHINGfi21b8j8zW
TLSH
T1FA342220A9E63CB6BEB8A14C75DF9B055E7845C08641C5C613A7F591A1CE38B2F3EE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0085ae47a565fb7fef28e4129cec77755722a5ade59521547831732638ebc124
MD5 a8cb8694252ab0d84a6dcd717ce12346
SHA1 3ad2bf94b3a7e4e428daf84c7c1c9f6dd165acd3
SHA512 ca4b57a3daf134cb5db5df2a7836e3efbde211f895ac748739f87321fa5442a8fea37a0fe347a271f132675a78cff847d14bbd5196400de1707e1e62e09e3d9d
SSDEEP 3072:StFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:UFmUi21rSm8uUVNSlzY/
TLSH
T150C313007AE3F8F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 205a8e71325307d9a2951e408c11e2f211abe5fbe36d1d1273828c66342c27b8
MD5 1c5c8ebe3927a679a35777ad1963c7ad
SHA1 561e653c872c0798cddcd1218ad67ca93e81354c
SHA512 27c14b9b3b0b614e56972c7e387d0c9a58e258e65ffac24a42a280768a81bec74aec99399ffe4d81278459195c5bd4daa9b0352dee5e9a03a9236c414979430b
SSDEEP 6144:SlC949PSmzO3XvANUPVFmUi21rSm8uUVNSlzYX:8CW9PXzOHINGfi21b8j8zW
TLSH
T1AB342220A9E63CB6BEB8A14C75DF9B055E7845C08641C5C613A7F591A1CE38B2F3EE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9830b22680415f5cc0b61991050f6ed5022c33dad62c6f24bb06df55d8fe23a9
MD5 870edeb260ae30ccc2de38f6db977ce8
SHA1 f7b6ef0401269e536fa5a3bc27581124c896effc
SHA512 94120603bd66e246b0464a6bb8c6768ab9ccafd7a1544138307864688595c2e0f261b9740d6b7d1899bf24ae89be6db49ba68155f0e10dff2e362c1072337865
TLSH
T11F712B1800F10F91E7B26FF2CFE21ADA3D720D988AA74D3302D49BBE993772084E5645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6660a9736d2b20f0289852201da2298e8c9dfe27440e4ab6f9421d8c2f11c386
MD5 f92bbe31edd7c33791ce8b81d6f4ebbc
SHA1 50993fb7879f7ef8e18f70be7d89a27d939d5fc4
SHA512 17d1ffe9dd5e97dc9e3b62cea4d63270a421a1bf05eeaeef2b065a99f33f75e138f12252b17abb50cc5139177e495a38d9453140c2289658e5a4f5cf5f8aac4a
TLSH
T1FB713C1800F10F91E3B26FF2CFE216DA3D734D888AA34D3202C49BBE5A3772084E5546
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59163d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59163d.TMP
Size 3KB
SHA256 ff76984a8be50d586b0a85860116b07916ca1b5bf18ac38c95f02435fdc652e3
MD5 1fcc01077cb87262b03ddbdf45691c4d
SHA1 b5fad41eb57f7ea1010a559fad1a49ec0235b0d4
SHA512 53a20cdcc4567804067fa55904331da00303be36a95664a38f1fcb187019bd36ba081bc2fc626029457cb7e87388c22b1350050acbe92d521781db164eb8e9a2
TLSH
T1F3713C1805F10F91E3B26FF2CFE21ADA3D734D888AA74D3202C49BBE993772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\lbfidjcieckmadgononplcmngglejjgd\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\lbfidjcieckmadgononplcmngglejjgd\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4f711ce3ab4f00926deed06576d7e46896007ccc70afea1b94fbbc55fe3a21a6
MD5 20b9354291cc7bf67d0084622ba2507f
SHA1 6585447c8bbf10c68299516b632d1c7040b56ede
SHA512 16473a19ff60ea65b274244e443c17cb8d99b3b5cfcfdd4edbdf767e62a9461651d28bc9c55e0dfd9568392b1e9bb5e7f7d48914799abe5636dffd9caa3e715f
TLSH
T1E641E4F7C3E8867D890155F4AE146E1BCE1D0914536C3D4AC5E8AF2B93F24B1E18094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 3KB
SHA256 814fd76e235187b4216371c755350f9c1ee267f7eb826af7be2462a0f189fdbd
MD5 18b7da0f524fcc5aad494f130af76fd4
SHA1 66b519cca4945ef70f52eae48b8fd2f62c77f236
SHA512 812d13a5fe7106cd01902318b0d2687be7f8f31484b0fe6044d77cffcab47bc9db64b78dc9017fdac4c171051a453dc2c7e7c728032aaf88ef1c209ebb56d64e
TLSH
T18871AA456E14A97F4CD6E51C7B2A7703E1F2152126891D88CAF89E1C0D9F9CD135781B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b0bbbededabdc2f158de5319e9a7185ac1510ae1d8b9ac2fec154e50f1fb55c6
MD5 16c5964e7f8f6cb99788f29b9fbbd53c
SHA1 1782aa4e98a648b9d03dbba0a2fb546c9e58725b
SHA512 6388585d7ee2bc27eec4f0fae841fa147a3e37bfdaf4a810916b675c28d0da4fe469ece1e63c4f9a262d1a09c2a98848962daca16d3f8666b0b24bc5a34a9899
SSDEEP 192:sxZURIyM/jK1Ml8oZ9/fZsqWpVENFUTIdpJHW6+WNhoJR/YIzGT7IgbKJ:sxZUWz9/fZsqWvENaMJHbh4/qi
TLSH
T1A352E616BA24AD7B8CDBD20CFA557F53D6F9446292901E4499FCCA1C01E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 36772dc8e99e64bac019c0d149f438f7263531ff86d343a4dd45e8205e47a703
MD5 60deb89f423f6416bb36288b55c6298c
SHA1 543ec5e8137d42711f4e0ea7f7cddd75ecd88ec2
SHA512 e8f8b2e84b55d810ee8e8c21f3a611a2e902779e6d989f1432434c994c698391635aed35b14b1b03af451a6a82f69f4d11dd0a2d565d037a03010b8400fc0cfb
SSDEEP 192:sxZURIyM/jK1Ml8Ms9/fZsRFUTIdpJHW6+WNhoJR/Yw9eh7Ig4J:sxZUWE9/fZsRaMJHbh4/Oc
TLSH
T10452F716AA34AD7BCCDBD20CBA55BB53D6F5456292900E4499FCDA0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 af7ccd211bf5fdee9ba038cdd370e694ffa042b306b854e7cb31ec6ee4ff1bf5
MD5 e187ff93f24ec964e9cd950645a92218
SHA1 6930d0d7e9bacece194b85f6914cd29c45d764e0
SHA512 28236e227ae57c3bf27dc2652ea3b2461ff90e72c0535229d5066d8d88b4fecba7950b7e276ce2bdfe02ba64e8599682513ba188b69b8d883c6b0239550095be
SSDEEP 768:5+4jevt7pLhLbmmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9KcPLlrZ+dKro3:5+4jevbdbmmWvmKLEu1jaoKcPLZQdhr7
TLSH
T1BFF2FC3B680CCF7E4F844E9CED2ABE8B6DE801CB5A98895447FA444C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fb5ef999727da9b72cc9803811f6e394acffa6c7d1f8f3fe72697b3da8742256
MD5 62b2c47bd0d28d91bcf886f30769148b
SHA1 b69c27dbe325882f13e701a4939bbe2c89c59223
SHA512 248f138b5ad35280d10c595898a4fec77f66dfee0a75461c960b92be6538e1e044a5c21e93b871993bd97d12b6f8cbbf08819c0ea7ea1afe06f756f0896d8df5
SSDEEP 768:5wOjevt7pLhLbEmWvmKnE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9KGPLlrZ+xKro8:5wOjevbdbEmWvmKnEu1jaoKGPLZQxhRe
TLSH
T15FF20B3B780CCF7E4F844E9CDD2AAE9B2DE8028B5A98894447F9844C03C66EF51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 616aeca47c3d8aeb4219bd4d3829165526e9b9f28639cf8f80f936ba1a8ddc6c
MD5 30b0811bfdf7666de6b19eefca0fd15a
SHA1 7e2634a88f39fdda18087bef20b62c2a42047bbc
SHA512 5b811021ea1bf3a06b2135a2b6c1642416df6096cd92c58109dd7c1ebad9a401f5c493665f756603f35c96e7b29c72a0eee4008b2fcee3ab0c3e3573a50e8824
TLSH
T142B0120323282080C09403FA890AC084430858B240251392216561308C361418016041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593d6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593d6d.TMP
Size 48B
SHA256 fca9f8a5a0fa98882d1a14f1b80c70b6bd2c4108c086736dcb4ae508a3dc9b9d
MD5 ffc6258deacbf7c5cd09d5b7372c38a3
SHA1 78e3bef0491b78a4d838f32df88c2b2b2bf7b522
SHA512 4d368a30f801c279936eb43f25b2ebd928d1b2c23b42fa140d5b53b05d4a0602aa14d7e53f1df8fc471e0b29804cfc904a5a6783d67047f87361ffc48042b2a9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5a28dde3ee89e15044f1de11ef266192ccb10f2dc1893c4f310f0ff8e95cd7a4
MD5 005ccfc6c41355f37ca0519cc760c9ea
SHA1 9257c99945b34441feb5c0b286e0642760bd0da9
SHA512 4810a89d6e773595be00e81f6a55f7f276151667526cfcfd72a9666d6b6e867cc0fde3855a482785007b951259cf435e184e12496f096b3457163580025516a6
SSDEEP 48:KA7IVKMMAQyFpIxKCkUKmIXKDqc3yl5IlK6Y4c:KA7aKMMtOpOKCklmIKDqWW5eK6Yb
TLSH
T133B11212717712133C7D294891D6BB5E4A8171633018F96F7FA904B9CE26E680CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e451dd9cf3991095256f5704a5b24735c65eb2909f391029f297e8d9b804f053
MD5 829d12d74478487283eab708ebd5c6bb
SHA1 3aa16c9cf23f2d996bfc991422e9381e1677111b
SHA512 32497d8a0e4432be6855673769643eac45d96721c2da7c69038b04f014ec89bb3dd804d97fc51940c78529f3efdafa430d6ab3baac1cca51e78f05bdd5b2762c
SSDEEP 384:ntZcIhsNCXES/Brhbuf+o8hy9XPqpFhU7O6R2FeoIZoN:1hyS/j63PqDhU7TR/m
TLSH
T150829E3268786CA799F6DA46F44736034FF8507B96D56B80E9FC5B2E008AA9D1317C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 be9d433a1a0a2c75fc3f9ed608ffc6748c51842aea546f038943a603fddb5b8f
MD5 cc4a7f60a2d4b1abef3ba1bb026c3749
SHA1 3005afe5e9960672e41c13f2f64c6281dec39218
SHA512 ad5e9762c4a034eb79ed2822e302b1f2f916331cecc2d6218ea547ecdbb05e7e802ccf96daeff7584c8702f9b1573fedc60a21111020973c55186495367ce46d
SSDEEP 384:nVZcIasN7qES/BrUbuf+o8hy9XPqpFWcMt/E2lFQE9jRmM7O6R2FeoIZoN:taqS/263PqD7MZFQE9jRF7TR/m
TLSH
T1B0B27C7194A56CE744E5E9CAA546F6031DF8513786CD5A0CE6F87B3E309F9F80312C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ff0fc505d14d05253933f48c8557f410e46af983c5f7699fb14a04fa41894f9
MD5 53ef6e82170d32950e717fb8f516dfe7
SHA1 92bfc0b60d2d891b88b1f6feefee2433e81638c9
SHA512 fbe92d04575a31b3722aa827b1d810f67475af0c07dd11229416d3d7d8bbe0927ac1e42eb0b0afd315d01b39b81f93af178fd182b5db438ba0b7300121b4e914
SSDEEP 192:EONT6hZ0QmiUyfzpc/+jVSjzorh8F45wOZhSjU6:EONT6oopu+o8hyH2h4U6
TLSH
T11502D93568787C778EE2AE45F48727235FE5116BAA956F84EAF81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 838e6d2ba8c035dd854e4fb2420cbed2e66bbc6f396e9da9e3fdbe7371dbb3b7
MD5 e959584d8b0dc694c8cc20c247ea19bd
SHA1 cd115213704b604f07ad9df07d860a7d8d8eb3f4
SHA512 3cd24180678a08b29608f2d25fb49dc4c2cb47b1e3a2997b498293e43ee912e46340e792db839c4e24f02705c8a562c562be291032bae44da1e6d467ba4e046b
SSDEEP 192:HON/6hZ6QmiUz0zOc/+jVSjzorh8F9XMEqj5cOqhWqIU6:HON/6asOu+o8hy9XPqe9hUU6
TLSH
T161120A356478BCA79EE2AE45F48726135FE4112BA9D66F84EAE81F1D00CB69C1306C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 4f43abd186074571cae377ede1bf806f7ba3b8861377980aca8dd77a2997216a
MD5 e41f2cbe80c8282b444b89769c5e54b2
SHA1 e1abaee5da55bee7f2e0a4bc2d0da303e9077a34
SHA512 26fb353f46ca74b9f5c0d30abb5829b6e7ce56aaac46f56755693b56df5f4941aad8e0baf7512b8cbf7e0bb0e97d4b30ce570c50d1986d23d6f4721c86356906
SSDEEP 3:MsEllllkEthXllkl2zEklu/KX:/M/xT02znu/q
TLSH
T1674404047FC0140DC50014704151C3500371F415053557433C53C4135FD5541DD05040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2efb8815-9469-4c7b-af9b-ed1715cf7969.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2efb8815-9469-4c7b-af9b-ed1715cf7969.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c54efe78d46ee2d41edfd5082e4d2908247d115b55d434c583e503fd24561fd7
MD5 f352aea284af029c9632c3fee157be24
SHA1 68e74504aac9db833f226c388096fb0891d68704
SHA512 19c270afaccdda33b2abc30fafd07b24de586b3c9a8e69b8d5ad914bc22177eadcfd024a5c09bed79828b1a712764f5caf216fee6a73fce609cbb62b88e4250f
TLSH
T1E5411859AAEA1118B3B76F0AABF6786E447A79772E0AC45D10110E4E0A77F41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

084cd4cf-4176-403e-a542-1453f46b760d.tmp

Path C:\Users\Admin\AppData\Local\Temp\084cd4cf-4176-403e-a542-1453f46b760d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ff5b4ca-58ef-43d6-ab77-7216b994f5ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ff5b4ca-58ef-43d6-ab77-7216b994f5ab.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

960f2bac-26ca-4117-9a9c-8e8f4456cdf2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_1389577831\960f2bac-26ca-4117-9a9c-8e8f4456cdf2.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_1389577831\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_1795384767\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\background.js
Size 11KB
SHA256 326d9688b7211fb1d363f1ae7554dcadfdf0511277ef591d43d4dd487c19ae77
MD5 bb4d515fbe39c04c3b85842d13cd087a
SHA1 2f5ae70405b61404325542e993da21d7678f86bb
SHA512 f7aa9494aa0e88fcf0897c3b21da7b12db954e40633e5001bd85f11462ad96aa3193de260e48e07b22f9564a77f0c6753c0b26919efe3786dc5c2f96c8370531
SSDEEP 192:v5XVFv9SqIjiphSA35qM4dbdUSVd0Ud9p4U/KpEMo4qQepk/zhqE8g5GjOXl5:RIUDn/STEdwQT7oEoqXj
TLSH
T1C032646A58370939657237BDAB33A046FE23413B2500878A7FBC59501F796E646E0FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\content.js
Size 1KB
SHA256 cae68eb9e63245b9b3d67de03e06cb28b7b30f886ea7485368fdf92d3f5f0c57
MD5 4353b8bcffb1a35320c8b4cd9c8f36cf
SHA1 6a7375ff1b03853b3f6687a416fb2805a88fbea5
SHA512 cf393e48176f850cf5124ab2b5634d6475d28133bdae97108501464fb11d58654a7c7eb7a320128eb9a75f85b9708879d2d3d34ddaa8ad57030856c9f6652ba4
TLSH
T1C4310DC77C9B283A4970DBADEB365945FB2A406725619316F1AC89A43F25FB00150EC9
MD5 SHA1 SHA512 TLSH

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-128.png
Size 1KB
SHA256 f9d1490575602aeb22c282b80fdc6d096d9e7eb783e659a7fb21275c5ee373cc
MD5 87194cc1cdc7d8ef4bed77aed0c02bac
SHA1 8a5498cf0c18353f97c12ea544ced2f0731312f7
SHA512 fa60b4fe72a38f111e1bfcbb932c3a1e0cd751382087eaffabf402d82a30970c2de31f4f034285e324f3da98ff5918edaa9d8408ca62beb5603ffb57bd1e6b60
TLSH
T1D8310983801035CE119A4F93B7D56C31DA2ADE85EC1CDFA0722372BB284A489C856300
MD5 SHA1 SHA512 TLSH

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-16.png
Size 252B
SHA256 f5be0c047ac80fd71f2875669e8c671d85b023bf43c52dd0c65dc08420f85412
MD5 2e274e9257d4f34f32243418c2acac62
SHA1 3bc52966811647667c0df500d0cddc14a72bdefa
SHA512 20e4756382972a4481dc09dd03192f94d22d99885ad0896d549600ddbdf6e465ba92373f6c97a02cfa45812e9c1cd218c391707456dbc27b8dcd1842d88d5acf
TLSH
T1A5D075DA7126C860CC60CB3ACCBC1013FD09313D4468178015890439022148FD268D77
MD5 SHA1 SHA512 TLSH

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-32.png
Size 450B
SHA256 81543a9c6b400ae6ee27afa3792433dfb3adf4ac03b99bb98a6fd69bac94c1ac
MD5 6549cb07555e9984b6f8801233d544ae
SHA1 d3c7749a17c87ea99e097db372868d2c5e9ff1c4
SHA512 f14cb10244e21e0c934fe9b9d1076f07606d6403c4a3e1610ad856ed7c84d939fb82d8281f03153819cc4994f1a358c52836a14807e8a980ea38895130fa15ca
TLSH
T130F023E3775865EDA200E307570B52698C331F0C001EA9063180523283B3B1C2593BF8
MD5 SHA1 SHA512 TLSH

Submit Download

icon-48.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-48.png
Size 633B
SHA256 ef04c8124ec47beed0a68b3e2445e65f6bc19b0f00bffe6f31e9c9043317b81b
MD5 c146d15b2a82b696a4d6ea85977a06c3
SHA1 8649ff8e195cbaf93c2891af6077ced9fd416b6e
SHA512 f3f0920437ddf1a240dd3ef783383509ec16dddd3eed044486a38e17164f87eb99e06fdec90c39c322d0171976f09a2a85963e1f5540727bedae29cdb43c325e
TLSH
T108F062D13EC3706CC72F156A9A4220634808033242A3803E86A3213527EED4EB8F82EE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\main_extension\extension\manifest.json
Size 896B
SHA256 d7a007aa1e923dfbd0873d568bdae26c3b92b2de275d2b1c355ed664fe3c97f9
MD5 c1dbba9c98138c355499f2f5076e1fe1
SHA1 db214bb13d7647d91cfe02b3e81a96a4fa0744d3
SHA512 bde29f93c625353e11e6256f93656c0e4ade54675233b69efc3bac4a2e2dc314f86ed20d577d4f7a7e84c2a8c922d458158cb6f104c88b62b47a886a8639d47d
TLSH
T1B2115533E8204E3303B8AB6929B24243FB20078B50D02C8FB9BE90584FB96990557F58
MD5 SHA1 SHA512 TLSH

Submit Download

pr.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\pr.js
Size 980B
SHA256 cded005c7dc6d6d8669fed3540cc12b81a5d4a4d5fc991e4f0e1ea1e038a0ed5
MD5 1f92ef0995d6a9548ea6324b5b5594f1
SHA1 62a22c1db26dea3a25e971567b82d54bd2be2995
SHA512 f086d8ccaa1e474f4ae11324b8a13e101160a2e129ace9259741793b4e4c29b421e3d182744343e6711c7441d7de93bd38750e035d283ce48ef10b5851c8774e
TLSH
T15211BDF3713250220DB5AAE57563A836E623E23F3585C281BA2D44A02F77294C4B1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

socket.io.esm.min.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\socket.io.esm.min.js
Size 39KB
SHA256 56eb37a25aaac55ee1481f278f306008881b645abe1b415ef943db56a42631d0
MD5 fd9c2d32975ac38dbb59055186830659
SHA1 4460c08fd9e3f06b1e05c813ac96a234bdd9b99a
SHA512 abd8d9cae2723e1da1548e8810967f4ffb60c9528a4d99e3af82ac04be76ea63e5a4e8c6e13ff8407c2a949fa36a07708b906d03824b4e2dbdc9fdb1de66561f
SSDEEP 768:cZozDDpC89b6HJhziqfPgC97cLhil9utGFvpk+ymUIOd68IUwGMGl8+/+nHlqUSl:1gHsQ2twsI/4NI0
TLSH
T16E030BC5B2A1506143E251E3C0750503F329A969784580ACBF6CEEF3AC69DCAB277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsw.exe

Path C:\Users\Admin\AppData\Local\wsw\wsw.exe
Size 1.5MB
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download