00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
Size 1.5MB
Sample260910-3xqvrshr3x
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5860	wsw.exe
3968	wsw.exe
884	wsw.exe
6112	wsw.exe
3188	wsw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	chrome.exe
5928	msedge.exe
4816	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335580410806317"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{E457A67A-FDC6-4D91-8796-9DC973319A09}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000003ca843adad0fdd01745845c3b70fdd01ca5cadc4b70fdd0114000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{0AFE00BB-0234-40A0-B92B-4FC1CB026A05}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
916	chrome.exe
916	chrome.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
884	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
6112	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3968	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe
3188	wsw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
5672	msedge.exe
916	chrome.exe
5672	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
5672	msedge.exe
5672	msedge.exe
916	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3968	wsw.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
3968	wsw.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
916	chrome.exe
2236	chrome.exe
2236	chrome.exe
916	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
916	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
2236	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 5860	2428	00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe	89
PID 5860 wrote to memory of 3968	5860	wsw.exe	90
PID 3968 wrote to memory of 916	3968	wsw.exe	91
PID 916 wrote to memory of 2440	916	chrome.exe	92
PID 5860 wrote to memory of 884	5860	wsw.exe	93
PID 916 wrote to memory of 2236	916	chrome.exe	94
PID 916 wrote to memory of 2236	916	chrome.exe	94
PID 916 wrote to memory of 4236	916	chrome.exe	96
PID 916 wrote to memory of 5904	916	chrome.exe	97
PID 916 wrote to memory of 5904	916	chrome.exe	97
PID 916 wrote to memory of 5028	916	chrome.exe	98
PID 916 wrote to memory of 5028	916	chrome.exe	98
PID 916 wrote to memory of 3692	916	chrome.exe	99
PID 916 wrote to memory of 3692	916	chrome.exe	99
PID 916 wrote to memory of 6016	916	chrome.exe	101
PID 916 wrote to memory of 6016	916	chrome.exe	101
PID 5860 wrote to memory of 6112	5860	wsw.exe	102
PID 5860 wrote to memory of 3188	5860	wsw.exe	107
PID 3188 wrote to memory of 5672	3188	wsw.exe	108
PID 5672 wrote to memory of 2812	5672	msedge.exe	109
PID 5672 wrote to memory of 3964	5672	msedge.exe	111
PID 5672 wrote to memory of 5928	5672	msedge.exe	112
PID 5672 wrote to memory of 3964	5672	msedge.exe	111
PID 5672 wrote to memory of 3964	5672	msedge.exe	111
PID 5672 wrote to memory of 2832	5672	msedge.exe	113
PID 5672 wrote to memory of 2832	5672	msedge.exe	113
PID 5672 wrote to memory of 2820	5672	msedge.exe	138
PID 5672 wrote to memory of 2820	5672	msedge.exe	138
PID 5672 wrote to memory of 2820	5672	msedge.exe	138
PID 5672 wrote to memory of 4560	5672	msedge.exe	115
PID 5672 wrote to memory of 4560	5672	msedge.exe	115
PID 5672 wrote to memory of 4560	5672	msedge.exe	115
PID 5672 wrote to memory of 3172	5672	msedge.exe	116
PID 5672 wrote to memory of 3172	5672	msedge.exe	116
PID 5672 wrote to memory of 3172	5672	msedge.exe	116
PID 5672 wrote to memory of 804	5672	msedge.exe	117
PID 5672 wrote to memory of 804	5672	msedge.exe	117
PID 5672 wrote to memory of 804	5672	msedge.exe	117
PID 5672 wrote to memory of 1448	5672	msedge.exe	118
PID 5672 wrote to memory of 1448	5672	msedge.exe	118
PID 916 wrote to memory of 52	916	chrome.exe	119
PID 916 wrote to memory of 416	916	chrome.exe	120
PID 916 wrote to memory of 1520	916	chrome.exe	121
PID 916 wrote to memory of 416	916	chrome.exe	120
PID 916 wrote to memory of 1520	916	chrome.exe	121
PID 916 wrote to memory of 2952	916	chrome.exe	123
PID 916 wrote to memory of 1968	916	chrome.exe	124
PID 916 wrote to memory of 2952	916	chrome.exe	123
PID 916 wrote to memory of 980	916	chrome.exe	125
PID 916 wrote to memory of 1968	916	chrome.exe	124
PID 916 wrote to memory of 980	916	chrome.exe	125
PID 5672 wrote to memory of 3248	5672	msedge.exe	127
PID 5672 wrote to memory of 2580	5672	msedge.exe	128
PID 5672 wrote to memory of 3248	5672	msedge.exe	127
PID 5672 wrote to memory of 2580	5672	msedge.exe	128
PID 5672 wrote to memory of 2516	5672	msedge.exe	131
PID 5672 wrote to memory of 5240	5672	msedge.exe	132
PID 5672 wrote to memory of 5240	5672	msedge.exe	132
PID 916 wrote to memory of 3792	916	chrome.exe	133
PID 916 wrote to memory of 2800	916	chrome.exe	134
PID 916 wrote to memory of 3792	916	chrome.exe	133
PID 916 wrote to memory of 2800	916	chrome.exe	134
PID 916 wrote to memory of 4696	916	chrome.exe	135
PID 916 wrote to memory of 4696	916	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe
"C:\Users\Admin\AppData\Local\Temp\00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\wsw\wsw.exe
  "C:\Users\Admin\AppData\Local\wsw\wsw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent chrome "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --lang=en --force-renderer-accessibility --no-first-run --no-default-browser-check --disable-default-browser-promo --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0x108,0x138,0x7ff8b1c7c728,0x7ff8b1c7c734,0x7ff8b1c7c740
        5⤵
        
        PID:2440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5645499572223582477,3556157820447445389,262144 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1336,i,8512390244961440609,1991744499973731695,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,11964756232942538988,6212416522125017237,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
        5⤵
        
        PID:5904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,10247832123822132438,9289768663443258570,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:5028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,11738501092378059809,3241639245509354691,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:3692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,4326474199771306599,2334975688583096605,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
        5⤵
        
        PID:6016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,5970695200513071219,645687102430593058,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
        5⤵
        
        PID:52
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5252,i,10523478993189359267,11790184446710913628,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
        5⤵
        
        PID:416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5264,i,11118632615087006045,3048507379604781387,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
        5⤵
        
        PID:1520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,1505431503941616032,15584940852915509075,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
        5⤵
        
        PID:2952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,12747442289930992634,9352469610695973351,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
        5⤵
        
        PID:1968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5552,i,13866843175960632402,15181079931200947231,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
        5⤵
        
        PID:980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5256,i,15634528425011438306,6408929808541331965,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
        5⤵
        
        PID:3792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,7076574698831445875,473760940614885793,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
        5⤵
        
        PID:2800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5472,i,8572015461667056524,14298043413992692804,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
        5⤵
        
        PID:4696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5660,i,3838730210439404371,10841917272103381932,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
        5⤵
        
        PID:3212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6036,i,13211276003328846818,2936900418305570898,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,7637564082396252753,1045955812641059131,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
        5⤵
        
        PID:244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,11657719396624987685,18412943941339191459,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
        5⤵
        
        PID:5864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5296,i,7247404784958382541,12865121497561154494,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:4868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3464,i,16424114368121203033,17549079353971522227,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:9
        5⤵
        
        PID:5004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,13838333118473208314,4078312928073373452,524288 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:2544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5560,i,11058964843254625899,12764930778969706160,2097152 --field-trial-handle=1932,i,5995915795714676971,9650362865913139761,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:9
        5⤵
        
        PID:6220
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent opera "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:884
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent brave "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6112
- - C:\Users\Admin\AppData\Local\wsw\wsw.exe
    "C:\Users\Admin\AppData\Local\wsw\wsw.exe" --agent edge "C:\Users\Admin\AppData\Local\main_extension\extension"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --lang=en --force-renderer-accessibility=complete --no-first-run --no-default-browser-check --disable-default-browser-promo --disable-features=msEdgeFirstRunExperience --hide-crash-restore-bubble --disable-session-crashed-bubble --disable-features=Translate --new-window about:blank --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7ff8967dc188,0x7ff8967dc194,0x7ff8967dc1a0
        5⤵
        
        PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,5467270262999167342,16149963664720833883,262144 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,5266241506028033623,2511645617558823905,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,7191798854727691619,16076060735849913837,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
        5⤵
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,17742754787314242714,9304746341959658843,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:2820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,16033697482257904923,4814485629461671876,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,5048374019636181137,14456552436987800623,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
        5⤵
        
        PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,1148518141122390652,5811083071588752969,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
        5⤵
        
        PID:804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,9489033846046281356,2675425013280058913,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,7251934218848113148,2781603102834862787,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
        5⤵
        
        PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,41787121525180812,2913622527145352583,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
        5⤵
        
        PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6762243776647907048,12421347740419301096,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6762243776647907048,12421347740419301096,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
        5⤵
        
        PID:2516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,9394255967591981966,6103810997912189752,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
        5⤵
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,8894805974934025568,7121146130409144053,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
        5⤵
        
        PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6856,i,17728776479634106142,14656140899376594108,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,12883033091340782923,1510524174065064181,524288 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3712,i,10137997663655275410,7583691516011453463,2097152 --field-trial-handle=2364,i,17404706733735812821,14524205650290208930,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
        5⤵
        
        PID:6396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:7164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff8967dc188,0x7ff8967dc194,0x7ff8967dc1a0
        6⤵
        
        PID:4468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,16189192527009076623,18025915457288634151,524288 --field-trial-handle=2416,i,16281123978851329913,4795363398378839436,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11201401982341326322,4667883459541507456,262144 --field-trial-handle=2416,i,16281123978851329913,4795363398378839436,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
        6⤵
        
        PID:5796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,1343122455534642342,17346715305476074685,524288 --field-trial-handle=2416,i,16281123978851329913,4795363398378839436,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
        6⤵
        
        PID:3900
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,2698652565736033972,5902560894915405467,524288 --field-trial-handle=2416,i,16281123978851329913,4795363398378839436,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
        6⤵
        
        PID:7060
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,2698652565736033972,5902560894915405467,524288 --field-trial-handle=2416,i,16281123978851329913,4795363398378839436,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
        6⤵
        
        PID:7064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 317582309e400e781e42dffeaad7a8241c7c336d0f5609807f23438a4f8e9640
MD5 bcef1d5b86218e33fd8ea2f90a845e61
SHA1 9d304a3516a842ca4acc6351985e84858c20018d
SHA512 51bc5cb638dd95039336645844f647c84325b445689a7b3077a9b6590bb0294f8e0fff671b20c9fe8ad7468428055e7a8caf26e704bf9448acec362a7174e9ce
TLSH
T1FFB0127337C02A01FBD05E704FA16D142524494DC19B4307C3F0C7CC8C23CE0C220101
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1b047db934b6506bbb69344395df68a09259e3327c94a28ca009e5dfb3ac5f10
MD5 b39fef668d7223a04f33ea242994ea38
SHA1 7fb5fb7283f4fb7757741c3eef573a825633ea2f
SHA512 9bfde23f2d95abd0d58af7a527182bd9ae64d3eb867f94fbcf1645bb649a2933ec518b71ace8fc509358bc90b72c25a8d2c156811cf89734aa51cd923a20c5f4
TLSH
T18E31C2F793A48A7E8A1156E4DF116F2FCE7A0514132C3C6688D86E1B53F2872D10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 9d4678fa8b1d3f592d00c45cdbfacd1cf6b9f94ae503094eecbf395e16fffe4b
MD5 5140b48f1c6c99d67fac7618576f2cf4
SHA1 bba04f6e1ea9848bf1ee14ba065398096ad664bc
SHA512 08b8b8535d15c2a91ff7d58fc30d88e62bcf181b1d78fede8036953006f2437f15bbab1101c170e16c6fc1febe1dd4297db83dde23e6de58851bc982cc8a8677
TLSH
T141017BFBA7AD74A710B949AFDD04780A78B2E43512406CE5CF7A826CE083CF71B02413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 855ef49cbeb3e72dd44f7d815b82b0e2b5b8431f5b5d80786ef97f9ffb9eae78
MD5 5c7b6d6b1fd5eef0ac3202b00b847256
SHA1 8f26f5e64d24a3b20e69325eabf94a9dc1efc212
SHA512 4fc156e4fcf68c7ef0704c53cc14ba822e3d033c1f305bee0a84e8f0a881cc60add3de9418ab2a214487abddce8f6aa9103043438387a11e4ac04cde1153d826
SSDEEP 192:vRtk+/Yv7MvAPRp279gHsb+WNNox6Nm1wQPtN+Ekw7UrafuVyIsnAUge:vRtkgEQ6XcqwNcBPbbeaOe
TLSH
T1DB42B42EBD25793B6CDBD21AFE617653E7F5102221902E84EBFC892C14DB5CC2227507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 97d79869f300f887964aed07b670baff7f6cd69e7de20475c65e651185262301
MD5 172ea9acbb625bf8782caa81c2d38c27
SHA1 2812827a5f36b95fdf39333044dc112e41c0909a
SHA512 2945d7ad5a089a050c920010f550d85c33e54b348650956afc0053f111ea18a7dbb93e37114168a005ca9e9579780c9a74657cad466f64f3e48261ef2a38ee7f
SSDEEP 384:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCXODID+ErU3JJHGOo5q4Mff8lWK:pPIf7KxkXqKf/pUZNCgVLH2HfgsjQO8n
TLSH
T17D520767684D8A7B0FD8D58CDC267F8FADF6015762A84D2453FA5C0803A97CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 60cd1262df81056c6b3aa8317b34eedd553e066cd18b6b81fe12693326e033ad
MD5 796530783c053b1c70f980f8828391b4
SHA1 c49c7e0c439b8b3b6ecb2f1a6de3ce9ca8ac4989
SHA512 8da975821875f4fa334ca6e28513b86af5596beae87d4bb3c9d690fbe9dcde5eec0947edd9d8a4131b2c948cb0621d9731622794acf4bd53e6545616c7ed07ae
TLSH
T17AC09B52C456A180C44051B85D66504D1309E9A5C804770552F49655DC550515596551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2475c962ee29fcf1ca43d5e7800f32908a509113604e972603bb8d816e32894e
MD5 3aad5053ee9d272a1e996c15dfa34ef0
SHA1 79d3f911b92d496325b03fe3353baaec6a06e9d7
SHA512 0276877d496196279252f5588bef8ba0081808cd295d574c8bf503da35cd3c4a7f45503d9068eb5bf56920f183a1643000a4deb24ed6d5cf427a485131527889
TLSH
T108A0029151D44514ED51457474A1695532964D6DD4506B4386E1D645AA9B0C1C591102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597248.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe597248.TMP
Size 48B
SHA256 4efbcefd8288d8491667c3af909f4d12b60a5c48fbde5df38dfb593e1bb87708
MD5 621662cf9ededffe28b3c14704089721
SHA1 aab2c7deff30a08881ff0d745fc59a6b1de7740c
SHA512 6903a1ea58ccfd472116e7ef6b8c7a8c0787a4c0c1a22807c93ed7aedb4044ed648eb44915ed050d1b6c150dd5c9a775ed0a6ebcb90d843128c6a8779d48f0b4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe597352.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe597352.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 63a1ab0b5e7ad0edf9f483283176173e52788b224cb9baba165cd491cd08771b
MD5 4d36a2ff960ec991a60913057baaca53
SHA1 004874c74ca05c51b0d5938d4a18318191c617ab
SHA512 f2cfe9e0c669372df7279073b890a656bde8058b8d64044ded466152bde01ddebf606174212bfd53160d75c6a582869e9ba019419bb5215f7340c09cfc26dd71
SSDEEP 3072:Gyna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPv:flC949PSmzO3XvANUPv
TLSH
T1A0D322B1D8F93D9971B4CA8E90C7CB471E70A1D9860185DE12DEF165A1CAE4F2E2EC0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dc08f1139ca34d4b8429db04fb7d6341b396a81dbdda4cf081b9870d999d134c
MD5 8b71026e5ff2c8350128bbc25c5cb56b
SHA1 8ba56c62161398b8c878929f31fd635588582454
SHA512 6ee1291ae9f98b86ca9aa220f693b764b4c43335536ffd4441364bb0ad9bb0fb5dc831e030be806cfdac6bdb9ccd4cb415e7398d7607eb1144ae6e2084612222
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5S6DBB6gGyvXNQ3rbfyYv4a:RC0G4DkG/FZ9kGDUDl3MAQ3rbfX
TLSH
T14BA1F871A46D8EB7A976C448F5933A03DEA4A0ABA611EF44DEDD0E0C11FB1DD1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 6344012c40e7d63bf586d89bd7e9b7af2d06cbce6bb12315a1ec957f90909daf
MD5 0737190ef6c5266c84be25628ab12f55
SHA1 5ac409548df2371c4260c962a45d8899a0d73224
SHA512 a6e2ff24a87f228aadb4f6a93949fcfb8c929916fcd68b65adbfd266e6858d4ae2bfcf9c79385c1b7432608454020097dbb99dabf72e6f3a75d2f3153dc9182c
SSDEEP 3072:Gwna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPv:3lC949PSmzO3XvANUPv
TLSH
T15DD322B1E8F93D997174CA8E90C7CB471E70A1D9860185DE12DEF165A1CAE4F2E2EC0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19e22fa9cd2b373acee675d45fd42e4a25f155143bc50ce74f6b1f18ec6a687b
MD5 3df4f5556f9720ddd5a92138e76fce4d
SHA1 4cd88327687bc7f49a40fe8deb1dd6166ff0fd22
SHA512 f1767b6755cf2e67ae005a4bc377aeccc6c4f1cb8a5331b8e1fce60a4ad5a55bf49b8bd95755dff18b84ec82ce3366e6d2ea8c0adcd5c0d56629ce5bc237603a
TLSH
T1BED080245FB45FD0E035107D0130454071D85752B90F1109919117356CB5DD20779DB4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0cee8656f18cfd2e7ed5cd0f451a25cb57768c81c1ee70514a7f775421165375
MD5 738839dfcdd8871e1002d11264735a1b
SHA1 9de449cd31fd6e50e3aad6d92b7246249be642a9
SHA512 64c31b11d5f34908356da77fa4743a115ceac1f0714d19a522784b9bb8833fd1ecba794157b9eb8a27f65e3c0198e05af3bab647e74e1b4e68801e8ba57cf6fd
TLSH
T1F2D08CA8BB948FA0F56614B816208A6D73EA9B10BC0F2028A4E233A83885D62037D464
MD5 SHA1 SHA512 TLSH

Submit Download

6553d4c4-81d1-4642-a078-a91bd74b135f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6553d4c4-81d1-4642-a078-a91bd74b135f.tmp
Size 29KB
SHA256 dd4954b7454dc56817765eed0968ebfd256cd40374b876b2202f00d0c276db5b
MD5 bb3e1c876d495ea7735f954abfaac0a5
SHA1 3fbffd5e355879a61ef4ab942839cae1ba1c0f6c
SHA512 28c50a20a9250431d5430c35c8da7907ac000cc89fe563d9268c46b0bc3ab3ed7cf0cdf40a9edea2b34ab073a157068ee94334a0495b32f222be61032a97b45f
SSDEEP 768:Fb1pdD7pLhL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVNapJ8IcroSF0p:Fb1pd1d7otWgikfq4u1ja+apyIHZp
TLSH
T10AD2DA3B240DCA7F4F804ADDEC197A9B6DA802CB96D8C98447FA951C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

712773c0-60a5-443e-a6b5-691932993721.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\712773c0-60a5-443e-a6b5-691932993721.tmp
Size 414B
SHA256 9e9fd7943734c1307d211324d7a9a1e69c1d0c6fef454ae5b30654a0a0907b05
MD5 34047fcf891a086492544cec0ae64b64
SHA1 e46c0e2998d87f8ecdd43872bb13ef0e645562a7
SHA512 a7b201ae3517329e924a8f6253971564e3e6e98f62593dac48f2830316db0a3ae22d3957707824c181c9326a43d53a6256447744f9445319297b6d0617763998
TLSH
T1D1E02BEACD21BC2709FD175958540B45EF9003271641850F763D810A4FF073A429585D
MD5 SHA1 SHA512 TLSH

Submit Download

90393bba-f424-403a-b221-6c94c02bc7eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90393bba-f424-403a-b221-6c94c02bc7eb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 acf4dc40d1baeefcbb2b29ab16cf94fbfa82d2632121b0d77d56c69078ceb0b6
MD5 8fdaad71aa7ac27bd66fbd16215ae956
SHA1 fbeea53d46527045d22baa538c95d77f59e7b83f
SHA512 074c57248d0c98238551ade7ee3e7b74f0a2a96df4113139c146757761daeabd597b66b0d3e0ae5fd0a5fc165fbf781558bc001baaf2bcf914781b7f8b6f719a
TLSH
T1E14199A4F32209D2D7E5D8B118D2A08431F84459350B6F39820D1EBC4993F5CE3C81F3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596f3b.TMP
Size 1KB
SHA256 dbf2e1f12ddb4b48067ac6117af5451f47a6c471ae2afea9b9c33fc676009910
MD5 1bd25573e3ffbf30f8e0eecc9365db3e
SHA1 faf53267bff942915c471da492cee5e9bf8afefa
SHA512 08ca5b7db8ec6cb4918707665594d019072adf38ad7e15de4427ed703cbd28015df3a48510fb6696ecc034908ef9ad05d60db06cfafb65ada6db7039f7186b6b
TLSH
T1A34147A8F72609D2D7E5D8B168E2609931F88459750B6F39821D1EBC4A83F5CE3C90F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 455c143e5d12c98af859e2f66c890139b2584d4b728f9e7dfdb03ed8398135a7
MD5 920d9b283eecac9d3b3cceae6c9550af
SHA1 25c31311f0abdbc334c4e18c00a2e20b0c708742
SHA512 856f6eaa35001bb8960d2f5403328230d726de197e7dbfe7cae0064dd3a08dcf3ab75d5f58b90af4b10b50c3860b675f05981db8307deee126063920f7fb1b07
TLSH
T1B741CFF783F4866E8E1196F0EA146E2FCE2C0515436C7D5A85E4AE2793F34B1E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f5c63bbe08a819c9de44a870728c9d6983f1ce0f32452c11872d5226b342140e
MD5 4ab051a7f433f147aa6062a3746d0b41
SHA1 b1652024c228de9f80ea3abc134a4489e846bbcd
SHA512 ba829b008e1845c6c9eaedd6b4fc83ed586d4257e405ea4a4ab619ac0d5f4a239eef540172c5c49a18b76aa92ce2c0bddef3608db94be35df63774665c70d4b0
SSDEEP 192:sxR+RpCr/fcslwFSaEzoA8pi/g6+WNLoVB/YbmZ6LGuB5IgVcJ:sxR+6r/fcsleSali/5Lc/P6pu
TLSH
T18D32A716AE28AD3B5CC7D21DBB56BF53D6F95032A1D01E48B6FC9A0C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 aa274e29e128b70c3b436bee622af27dd131a9379bddab9c8bd99af1e0eeeb5b
MD5 c45357b61b73e8c68e2604eb2123342f
SHA1 d025b23d7fa31415db4ce1e2b1bf064af1d03dbe
SHA512 542e540352dd55cf0607faed836d66212cbe29ef3db0ca63ba690395d31408107f078e684145a97a5becc0f726c4fd11042a5f3dfc2e688b640006f86126a0e6
SSDEEP 96:stHJeZVj5i2scmHbD/hrX1bSaOHhV3oo5h16ZZs7/x+6MhmuecmjetK+gTuVt28x:stwv5PsrhrFSa+3oo+sV+Fijf16tGOHJ
TLSH
T1D412B7155A28687B8CCAD21DBB6A7F53D6F9607271E46A44F7FC8B0C04E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 250f9ab11c170e1fddd4ecf926b8a3db1fb478a64374988e0c0722384b6f9485
MD5 b82fd382e3ae908cc8a3d4137a8cfc8a
SHA1 9fe75c8aa57ddd4cb12151a24671929873246f1a
SHA512 707fd588bfeb5ebdbd26e41647f74170ccbc08752378f6cb7c41903dba532bcdaa3a5fa73fb06a879f6d99ff2e6102c55c21c753d07a11e0f8c60d7c13696549
SSDEEP 192:sxRZRtCr/fcsGWpVwwFSaEzoA8pi/g6+WNLoVB/Y7kZ6uguB5IgDicJ:sxRZWr/fcsGWvweSali/5Lc/L6ov
TLSH
T16C42C716BD28AD3B5CC7D21DFB567F53D6F91032A1912E48A6FC9A1C14EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 392c67887b27a3a168fd742cb2cc5caa2d80d8bc4d8897773303bf94abd9a631
MD5 faa51c2dcb84228ad70aa1e4940cf9d2
SHA1 e9027e3b07d6dfec1d8bdc4c55db27e9181c2c05
SHA512 30b717b24564ad329740bf06f1fb9c35dd208dfa80e020e844677712591adfa58f97b3569e54aeed906177581b79c08bf5a0e2c9aabc9242c15b0b83f0bb9374
SSDEEP 192:sxRZRpCr/fcs0wFSaEzoA8pi/g6+WNLoVB/YbmZ6LGuB5IgDicJ:sxRZ6r/fcs0eSali/5Lc/P6pv
TLSH
T10342B716AE28AD3B5CC7D21DBB567F53D6F95032A1901E48B6FC9A0C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5058b699dc1fd9eff576fe7d19bf5172117c4d5b2c8ee3d515fa4a6066f823a0
MD5 d9ef8cd90c2cab63dfb5324a222e4458
SHA1 c1ff3f57c5b40cef6c37b3655adbde3aeda9f0ae
SHA512 c4860358498af09f6b9ff3b1bdf19e76acd86401df071412d6982d7f2b02f89ed56cf8b2a824b3489a87321caba5005ddb1e5db0dfa69d4cc1a05aaf0ad03cb9
SSDEEP 768:Fb1pdD7pLhL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVNaiWlIJ8Icrom5:Fb1pd1d7otWgikfq4u1ja+aiWKyIHwmk
TLSH
T10ED2DA3B240DCB7E4F804ADDDC19BA8F6DA802CB96D8CD4447FA941C02C6BFA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4d7772c26868c5155465c97eba0b4e177aa16bca205f3d53dd526fa9647da0c8
MD5 fd85d928f1cac9e7ef290716f7ca8cf4
SHA1 5621cb3289b453039a426bd7d15ac8cd3383f706
SHA512 7cfd0f7d31a74040de154742939bece82038cd99205cb30c9743ce630612b9594ff359690d80cdf4ca951ba45bb929879ed4a4a8b0d6d76d3b7d0c801e47ff24
TLSH
T1CAB01203412E2240C48400706F03800953205D61C0812302A270D475CC510819111101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596f2b.TMP
Size 72B
SHA256 7d34a5a7b75712f2059a23c3336b8272ff64a396dc580af5cebf70d2332a7331
MD5 c0657bae02f9ccd97af6f617a181d269
SHA1 d85619fc86aba9034183b4d4f9cd4c531607af09
SHA512 c341f89c8639b8efe384663f9e9e3a215f27a04ecebe80ae708ecfdba8e494609333c9dd61190b784d19f4d9b56e120c4d5c3275fa958d34b3a7d4290887d2b2
TLSH
T136A0021447426403D855437469C15A443720DE108702230390A260A5CC542409955640
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6d9a4f777d59594f05f0c9afa45f02aef16cf988b97b9762842bf602a221373f
MD5 e04622e4631d0d77ef61f2539c24141e
SHA1 1779e3ddb36f6b614598982ca0486cc19ae19fcb
SHA512 b4cadb9d77e1b55ba8445621f35dc03d277df0f52158056c395bacf6a4d1fbbbc857ec9d4ae21b8ae1284f6e2a18d2038ebf2bade226374fdbc27e4790830140
TLSH
T11BE0D86029D9CA2E61E722CB8265EB0CC1E27542D7CC2A523F8DD8887246144F247540
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e55b139dbc97cb197fe8f9bff231551787915de54a8be910dc207f8151da98f9
MD5 b083236a5a18568a6da7c41b66ddbbb4
SHA1 56c129f378854dae881dd4dc0b4d2b4f073f4e77
SHA512 ebd72c3d1333ff696aca1bd2989478162dcf5a98e34d3f6a4288825a3cbc87d459377ee01b03a645ec37dbd615da1486bbcd1750d8fcbb2542ac32ec7bfcc666
TLSH
T1FCE086705DD9C67D90A662C783A5AF1CC2F47946DBCD3B475798848CB101145B2BA981
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4edec4144dc20599aa1bf76d3c66985dd0fe9048b1f6d28edde9231888001395
MD5 eb96cd906f248f7a95fb58c2a796858a
SHA1 46421858fe8534de6e8c6fd6770cfcfc93c7bff5
SHA512 cf8119abe1929e3c69921247ae5eab521e6d946817840b563348f4e1caa8511972506473451af035eecf44d71d282bbabed2536e00b242d284b13da6aa6c1866
SSDEEP 96:KRstY826ucWKHHgEcK4JgOccM8nmMBHc9oMmqesWa33gUgRkQiOCYWmG0QKlSmq:CstY826uDKHAEgJgODM8nmMBHc9oMmqj
TLSH
T17C9186C4307A425038BF6A4581BED95ED2C274A33214E92F7BBC419A1F2BE464DFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ab5621f4d045fa2c491c326b5004948cc544f740fde36e9b22986a2f07265187
MD5 a4aedd04979930f8e4092deca795a9bb
SHA1 9cd4847ba81b246f7097047b279378a6dadb06ea
SHA512 8fce11af5559b4905d61aaac0e4185e3f8d98f8bba69350aeb58e8e6777b1aad81814c83a4e1aa5a61c1fa5b384236a5d579fe7538f83f9130e2d99fcdbf3ba2
SSDEEP 768:9rv+4UNbdC399EBqobGSgpZu4aWADIidy8Lq/eVH1S1C:9bsbw3DpZzaNsuVLEEH1d
TLSH
T1A403BF36F85A9A779CF79284B1873A0B7EF8916386890BD088DD1F4E41DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7e5924cc7615a3266b6846e68caa364167e8def0aab9322a01696aa2ecdb82dd
MD5 bb9ff8a277f12fc1dfe34ba371ff14b7
SHA1 0c60ad4e47231ef0f7fc11605af5ee0e158fb5a9
SHA512 1291f046162703853db06f67c0dbce3334ec6c50689983ec9d44ce81194b034c5e6d2f7fb94438265adab27efc2ed4e1422ee0a1eebb60249671668aca03edcd
SSDEEP 768:I13HE4BqobGSeEtZu4aWADIidy8LuRcTRi1:I13ztZzaNsuVLecTRi1
TLSH
T15AF2BF75FC529DB799FBE645B2473A0AAEF891A381C909948CDC1B1F00C79AA1317C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 122615bdec77219f23691974605112a2b45745c5b665162d70097241f020d3a0
MD5 692a42abc55f16d6a72d09892f06f3f0
SHA1 18ea3120c3dab868a4490cec3d111b18acbe435f
SHA512 365e45a495fb4a4ea23cb2d589ad5b451933a4ffda02515de1362b8467f52d6fcbd400ef09ac761762ba9a64341cd26cfdf77ed709396d67b5d371ae642213a6
SSDEEP 768:irv+4UNbdC3n/iBqobGSeTtZu4aWADIidy8LbReVH1S1C:ibsbw3rtZzaNsuVLVEH1d
TLSH
T11803C036F8599A739DF7A744B1877A0B7FF891A381890A94C8DC1B4F418B4AE1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 de787dbbfa4433c28733521754de3b540acc25485d7fbed95a243febb77b5c69
MD5 9e6bb51773b4ad4c006d97fad36754e7
SHA1 d48811cd7640e8499c4e6d263f99721855090e56
SHA512 fedd9ec8e9026ea98550ebb16fd48389c7c96efe45ec857bfd9cf0994e70a745a365576a10ef45352fe8a2e5d563cd506b75f8ad0768327579477123d3306b7b
SSDEEP 768:IA3H44BqobGSeEtZu4aWADIidy8LuIostBwtcTRi1:IA3HtZzaNsuVLtos7wtcTRi1
TLSH
T1A7038D7DAC529D3F48AEB344724E291AACB98173C1B94994CBDC1B0EC0B7969F312C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0762876869e7360e1558b0a252ac41b08c9431cd6b7855a4ea7072b626b6a89f
MD5 d5f27c676c0c9dd90eff929057654008
SHA1 1f938583c60f29655696a2c6946844229dec1b3f
SHA512 d5d7aee305f4275040d9d5ea514bec20edfb87b80427c3f98153e4a46ac016c6a0f6049f4317484762c660b6991afd100de6b2c944c28ad4a123ee8ca0cc3611
SSDEEP 3:MsEllllkEthXllkl2zEfl66/:/M/xT02zf6
TLSH
T1694404457FC0040DD5003034D051C3511370D41005515F4734D104335CC75400D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

2b137494-7d7d-4c9d-9f8f-1939faecd19b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b137494-7d7d-4c9d-9f8f-1939faecd19b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5672_1632955924\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir916_690763070\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\background.js
Size 11KB
SHA256 326d9688b7211fb1d363f1ae7554dcadfdf0511277ef591d43d4dd487c19ae77
MD5 bb4d515fbe39c04c3b85842d13cd087a
SHA1 2f5ae70405b61404325542e993da21d7678f86bb
SHA512 f7aa9494aa0e88fcf0897c3b21da7b12db954e40633e5001bd85f11462ad96aa3193de260e48e07b22f9564a77f0c6753c0b26919efe3786dc5c2f96c8370531
SSDEEP 192:v5XVFv9SqIjiphSA35qM4dbdUSVd0Ud9p4U/KpEMo4qQepk/zhqE8g5GjOXl5:RIUDn/STEdwQT7oEoqXj
TLSH
T1C032646A58370939657237BDAB33A046FE23413B2500878A7FBC59501F796E646E0FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\content.js
Size 1KB
SHA256 cae68eb9e63245b9b3d67de03e06cb28b7b30f886ea7485368fdf92d3f5f0c57
MD5 4353b8bcffb1a35320c8b4cd9c8f36cf
SHA1 6a7375ff1b03853b3f6687a416fb2805a88fbea5
SHA512 cf393e48176f850cf5124ab2b5634d6475d28133bdae97108501464fb11d58654a7c7eb7a320128eb9a75f85b9708879d2d3d34ddaa8ad57030856c9f6652ba4
TLSH
T1C4310DC77C9B283A4970DBADEB365945FB2A406725619316F1AC89A43F25FB00150EC9
MD5 SHA1 SHA512 TLSH

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-128.png
Size 1KB
SHA256 f9d1490575602aeb22c282b80fdc6d096d9e7eb783e659a7fb21275c5ee373cc
MD5 87194cc1cdc7d8ef4bed77aed0c02bac
SHA1 8a5498cf0c18353f97c12ea544ced2f0731312f7
SHA512 fa60b4fe72a38f111e1bfcbb932c3a1e0cd751382087eaffabf402d82a30970c2de31f4f034285e324f3da98ff5918edaa9d8408ca62beb5603ffb57bd1e6b60
TLSH
T1D8310983801035CE119A4F93B7D56C31DA2ADE85EC1CDFA0722372BB284A489C856300
MD5 SHA1 SHA512 TLSH

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-16.png
Size 252B
SHA256 f5be0c047ac80fd71f2875669e8c671d85b023bf43c52dd0c65dc08420f85412
MD5 2e274e9257d4f34f32243418c2acac62
SHA1 3bc52966811647667c0df500d0cddc14a72bdefa
SHA512 20e4756382972a4481dc09dd03192f94d22d99885ad0896d549600ddbdf6e465ba92373f6c97a02cfa45812e9c1cd218c391707456dbc27b8dcd1842d88d5acf
TLSH
T1A5D075DA7126C860CC60CB3ACCBC1013FD09313D4468178015890439022148FD268D77
MD5 SHA1 SHA512 TLSH

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-32.png
Size 450B
SHA256 81543a9c6b400ae6ee27afa3792433dfb3adf4ac03b99bb98a6fd69bac94c1ac
MD5 6549cb07555e9984b6f8801233d544ae
SHA1 d3c7749a17c87ea99e097db372868d2c5e9ff1c4
SHA512 f14cb10244e21e0c934fe9b9d1076f07606d6403c4a3e1610ad856ed7c84d939fb82d8281f03153819cc4994f1a358c52836a14807e8a980ea38895130fa15ca
TLSH
T130F023E3775865EDA200E307570B52698C331F0C001EA9063180523283B3B1C2593BF8
MD5 SHA1 SHA512 TLSH

Submit Download

icon-48.png

Path C:\Users\Admin\AppData\Local\main_extension\extension\icon-48.png
Size 633B
SHA256 ef04c8124ec47beed0a68b3e2445e65f6bc19b0f00bffe6f31e9c9043317b81b
MD5 c146d15b2a82b696a4d6ea85977a06c3
SHA1 8649ff8e195cbaf93c2891af6077ced9fd416b6e
SHA512 f3f0920437ddf1a240dd3ef783383509ec16dddd3eed044486a38e17164f87eb99e06fdec90c39c322d0171976f09a2a85963e1f5540727bedae29cdb43c325e
TLSH
T108F062D13EC3706CC72F156A9A4220634808033242A3803E86A3213527EED4EB8F82EE
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\main_extension\extension\manifest.json
Size 896B
SHA256 d7a007aa1e923dfbd0873d568bdae26c3b92b2de275d2b1c355ed664fe3c97f9
MD5 c1dbba9c98138c355499f2f5076e1fe1
SHA1 db214bb13d7647d91cfe02b3e81a96a4fa0744d3
SHA512 bde29f93c625353e11e6256f93656c0e4ade54675233b69efc3bac4a2e2dc314f86ed20d577d4f7a7e84c2a8c922d458158cb6f104c88b62b47a886a8639d47d
TLSH
T1B2115533E8204E3303B8AB6929B24243FB20078B50D02C8FB9BE90584FB96990557F58
MD5 SHA1 SHA512 TLSH

Submit Download

pr.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\pr.js
Size 980B
SHA256 cded005c7dc6d6d8669fed3540cc12b81a5d4a4d5fc991e4f0e1ea1e038a0ed5
MD5 1f92ef0995d6a9548ea6324b5b5594f1
SHA1 62a22c1db26dea3a25e971567b82d54bd2be2995
SHA512 f086d8ccaa1e474f4ae11324b8a13e101160a2e129ace9259741793b4e4c29b421e3d182744343e6711c7441d7de93bd38750e035d283ce48ef10b5851c8774e
TLSH
T15211BDF3713250220DB5AAE57563A836E623E23F3585C281BA2D44A02F77294C4B1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

socket.io.esm.min.js

Path C:\Users\Admin\AppData\Local\main_extension\extension\socket.io.esm.min.js
Size 39KB
SHA256 56eb37a25aaac55ee1481f278f306008881b645abe1b415ef943db56a42631d0
MD5 fd9c2d32975ac38dbb59055186830659
SHA1 4460c08fd9e3f06b1e05c813ac96a234bdd9b99a
SHA512 abd8d9cae2723e1da1548e8810967f4ffb60c9528a4d99e3af82ac04be76ea63e5a4e8c6e13ff8407c2a949fa36a07708b906d03824b4e2dbdc9fdb1de66561f
SSDEEP 768:cZozDDpC89b6HJhziqfPgC97cLhil9utGFvpk+ymUIOd68IUwGMGl8+/+nHlqUSl:1gHsQ2twsI/4NI0
TLSH
T16E030BC5B2A1506143E251E3C0750503F329A969784580ACBF6CEEF3AC69DCAB277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsw.exe

Path C:\Users\Admin\AppData\Local\wsw\wsw.exe
Size 1.5MB
SHA256 00db0069c47264e52beef505d4e559c7fa7f28fd4206599ab88cf9b473676f58
MD5 9fc690a5cf09317f8d9a6342d0ad3c89
SHA1 ed8f13f0bc7a4d1aac4c16fc220592d07f053397
SHA512 0bf32911350ae1c199731524fc944318ff609140b60c8787e5c822b9bd1d26056c73dc3bbac6a96f8baa9ca2b4f9342dc6a74424d1b67991714c346ccdf7f8b7
SSDEEP 24576:7v9OARqRo8+vwoe4UCMsgxVH06euV2osLl6vUuXcoBCzU/mdoQra7GH8eWO9SKML:e2MRBC/dNrNJMZRg
TLSH
T1B4758D696C02936CF95780B6C101C252592074820F2A6EFF55EDC3750A2A9F6EF367FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download