0dc214d49756e7f5b7a1ae60034792950e7a40eab3199c71f967e7a6789c9b58

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample261011-3cd1gabb42
SHA256 0dc214d49756e7f5b7a1ae60034792950e7a40eab3199c71f967e7a6789c9b58
MD5 9a681fe7b412232dd769638a40c20d34
SHA1 bd5fdfbd6db392f72ccd567626f9a7d4438fb9aa
SHA512 19142457831fb2edcf8882634745cd0156f11a150db586754a208ee2585921e961210de1934d2f738d41b96e7cd72f5bb7567d49fcf258547ab1127dd19c6e7d
SSDEEP 49152:3pqNCT3rhtYVyQhvqgYCXmGoytjcEqsn17T6FoQPkpOzcbmxqDNr7qSmnc3KQK12:3p0E7ytt7OobE5Jh5vygiEs
TLSH
T11B763917EC5924E8C0BED271896692227F217C491B7127D72FA0F7242F76BD06E7A780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bd835a9e-77c2-4845-9d88-215f9836c850.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3776_13436234547269208_3776.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\414b7299-279f-4a09-9e49-a2d549fa1dbe.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2064_13436234547367716_2064.pma	setup.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_783047119\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_960376234\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_2096842054\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_2135556044\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_960376234\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_783047119\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_783047119\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_2135556044\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_783047119\smart_switch_list.json	msedge.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{9064578E-155B-4041-9538-9AEACBAD8C70}	msedge.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4160	5724	2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4160 wrote to memory of 3324	4160	msedge.exe	90
PID 4160 wrote to memory of 3396	4160	msedge.exe	91
PID 4160 wrote to memory of 1840	4160	msedge.exe	92
PID 4160 wrote to memory of 3396	4160	msedge.exe	91
PID 4160 wrote to memory of 3396	4160	msedge.exe	91
PID 4160 wrote to memory of 2168	4160	msedge.exe	93
PID 4160 wrote to memory of 2168	4160	msedge.exe	93
PID 4160 wrote to memory of 2280	4160	msedge.exe	111
PID 4160 wrote to memory of 2380	4160	msedge.exe	94
PID 4160 wrote to memory of 2280	4160	msedge.exe	111
PID 4160 wrote to memory of 2280	4160	msedge.exe	111
PID 4160 wrote to memory of 2380	4160	msedge.exe	94
PID 4160 wrote to memory of 2380	4160	msedge.exe	94
PID 4160 wrote to memory of 3600	4160	msedge.exe	96
PID 4160 wrote to memory of 1360	4160	msedge.exe	97
PID 4160 wrote to memory of 3868	4160	msedge.exe	98
PID 4160 wrote to memory of 1856	4160	msedge.exe	99
PID 4160 wrote to memory of 5412	4160	msedge.exe	100
PID 4160 wrote to memory of 2180	4160	msedge.exe	101
PID 4160 wrote to memory of 1856	4160	msedge.exe	99
PID 4160 wrote to memory of 1856	4160	msedge.exe	99
PID 4160 wrote to memory of 5508	4160	msedge.exe	102
PID 4160 wrote to memory of 5428	4160	msedge.exe	105
PID 4160 wrote to memory of 840	4160	msedge.exe	106
PID 4160 wrote to memory of 1572	4160	msedge.exe	107
PID 4160 wrote to memory of 5412	4160	msedge.exe	100
PID 4160 wrote to memory of 5412	4160	msedge.exe	100
PID 4160 wrote to memory of 5504	4160	msedge.exe	103
PID 4160 wrote to memory of 2180	4160	msedge.exe	101
PID 4160 wrote to memory of 2180	4160	msedge.exe	101
PID 4160 wrote to memory of 5192	4160	msedge.exe	108
PID 4160 wrote to memory of 5508	4160	msedge.exe	102
PID 4160 wrote to memory of 5508	4160	msedge.exe	102
PID 4160 wrote to memory of 1516	4160	msedge.exe	104
PID 4160 wrote to memory of 5428	4160	msedge.exe	105
PID 4160 wrote to memory of 5428	4160	msedge.exe	105
PID 4160 wrote to memory of 840	4160	msedge.exe	106
PID 4160 wrote to memory of 840	4160	msedge.exe	106
PID 4160 wrote to memory of 1572	4160	msedge.exe	107
PID 4160 wrote to memory of 1572	4160	msedge.exe	107
PID 4160 wrote to memory of 5504	4160	msedge.exe	103
PID 4160 wrote to memory of 5504	4160	msedge.exe	103
PID 4160 wrote to memory of 5192	4160	msedge.exe	108
PID 4160 wrote to memory of 5192	4160	msedge.exe	108
PID 4160 wrote to memory of 1516	4160	msedge.exe	104
PID 4160 wrote to memory of 1516	4160	msedge.exe	104
PID 4160 wrote to memory of 2400	4160	msedge.exe	109
PID 4160 wrote to memory of 2552	4160	msedge.exe	110
PID 4160 wrote to memory of 2400	4160	msedge.exe	109
PID 4160 wrote to memory of 2552	4160	msedge.exe	110
PID 4160 wrote to memory of 2904	4160	msedge.exe	112
PID 4160 wrote to memory of 2064	4160	msedge.exe	113
PID 2064 wrote to memory of 5524	2064	setup.exe	114
PID 2064 wrote to memory of 3776	2064	setup.exe	115
PID 3776 wrote to memory of 940	3776	setup.exe	116
PID 4160 wrote to memory of 6016	4160	msedge.exe	119
PID 4160 wrote to memory of 6016	4160	msedge.exe	119
PID 4160 wrote to memory of 1380	4160	msedge.exe	123
PID 4160 wrote to memory of 1380	4160	msedge.exe	123
PID 4160 wrote to memory of 2304	4160	msedge.exe	124
PID 4160 wrote to memory of 2304	4160	msedge.exe	124
PID 4160 wrote to memory of 5132	4160	msedge.exe	125
PID 4160 wrote to memory of 5132	4160	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_9a681fe7b412232dd769638a40c20d34_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --app=http://127.0.0.1:18583 --window-size=1320,880 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile --disable-extensions
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x270,0x274,0x278,0x26c,0x280,0x7fff8919c188,0x7fff8919c194,0x7fff8919c1a0
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,16023389754154784365,13602930221086713232,262144 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,9061678387591409485,4142546303842219001,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,1103883603672044362,14533402739384683464,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:13
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,7317779567029300122,12943480112039615236,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,11763637232626431346,3053577416727939252,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,6969474653349897989,11344491563682589693,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,3773948400814091658,5642187337747752910,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,14082023378047730183,11840409060801015444,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4272,i,10624750232712315454,1122248131044000980,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4320,i,2571952484840990739,1367931663190994770,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4332,i,17935492985616678088,15540225910854296369,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:9
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4352,i,10950032736362634282,14926494938807402576,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4368,i,14565840697059231272,1574141001013052238,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4384,i,6089754920306683254,7949064576798882152,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:9
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4412,i,15891347272182341385,10023250863164441746,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:9
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4292,i,4339522014855822187,10140141059651968385,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:9
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4356,i,1114034432805036348,15705306100829589952,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:9
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4400,i,3362455142070427224,17642103134674682262,2097152 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,13902009180947425207,6428192161033148193,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,6771148181523148723,14502931908294733070,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6445288346453985150,4358256613557091635,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6445288346453985150,4358256613557091635,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff6ade904c8,0x7ff6ade904d4,0x7ff6ade904e0
      4⤵
      Drops file in Windows directory
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x214,0x240,0x7ff6ade904c8,0x7ff6ade904d4,0x7ff6ade904e0
        5⤵
        Drops file in Windows directory
        
        PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,15132539483887873742,9094575842470609810,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17959749001237217908,8338518182207303290,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,17257193008609045221,11270676709489418101,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,14900055923201751145,2658056616911477582,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5944,i,8189465323487959140,85304449181736112,262144 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,16905474779216711133,14454297190842339932,524288 --field-trial-handle=2520,i,10481447645915797909,2510177943477650269,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2064_13436234547367716_2064.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2064_13436234547367716_2064.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3776_13436234547269208_3776.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3776_13436234547269208_3776.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

28bcf186-d44d-4013-98d9-84744fdfc231.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\28bcf186-d44d-4013-98d9-84744fdfc231.tmp
Size 13KB
SHA256 f59c1fa7e953273148d7893a76cd105a22961a664992f7a16e1a699af7509778
MD5 9840b301e2f7eaac1e673c5f1fc54464
SHA1 379254824ea126fed55f428ef14283143a473342
SHA512 40fcb0340ef513b2d5db2e6aefec043fbdde3001152ad0b2a5e59dc74285347bc5e8d2b9515bbfaebf587aed61188a0ef53dde544db0751991fc87aad0071c2c
SSDEEP 192:uuHq+xasuheOwQxMG8N7Y1gE9FbEooDUuONXEBbDR+8quM31CyealQfI6k4+jrdN:nQZcIN8N7XE9RiipEZDs8W/9sI
TLSH
T118525C72A9B4693794EA9546F88835038EF4D223E1DDBF88D0DD5B1D05EB6EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29a404cb-7022-41f0-9f10-d8a98ae0ec33.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\29a404cb-7022-41f0-9f10-d8a98ae0ec33.tmp
Size 5KB
SHA256 2a4140772cfea61eb9b07ba7e3baf17bdc77c4b3b6e9c0aa81e482b61372eff8
MD5 2f350a9ae0530188ec142be21715b023
SHA1 5c99035308448aea85cabc995513a1b583138074
SHA512 ce34184e28e8d716c703ffb0c0f59cb809d2594360a0f994e4630adeac0780da646b3e7f5f8ac0f82379eaf7544373bbd56fbd89431b7d7b7fbbf262541c48e8
SSDEEP 96:JqGNknuQsFfe4clw7UY3Z58Frh/cInURoDotovk55yDEkBnP4vrc6gb80eUnnaSw:wGNavgYooDUwguNPCgb8q6
TLSH
T11DB1C872A8B4ED274DE16946B48932039EB59323E689BF98D1DC1F1C01EF2DC5346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b09f3d-4831-4d81-9ee3-c5f84da069bf.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\65b09f3d-4831-4d81-9ee3-c5f84da069bf.tmp
Size 13KB
SHA256 f2eaabb46ade9f591099981a7df6b38b26d746ced248058eaf69bcce3783387e
MD5 d90963205e7829e7d1a149a357422d2f
SHA1 44388c497b9d08108cadf81c90bcb1682d67d9ea
SHA512 ae0a4724915628a6700e9ecb532a3bafcea22a7145926789aba80b10a46056c4bdb7c8d6ae197f939d7a1d01d0b7767fc9b233915ba89c76da0de61370a26955
SSDEEP 192:uulq+xasuheOwQxMG8N7YQgE9FbEooDUuONXEBbDR+8quM31CyealQfI6k4+jrdN:n+ZcIN8N7SE9RiipEZDs8W/9sI
TLSH
T11E525C72A9B4693794EA9546F88835038EF4D223E1D9BF88D0DD5B1D05EB6EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c554450-8749-44f8-85f7-d563e323b8e5.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\7c554450-8749-44f8-85f7-d563e323b8e5.tmp
Size 13KB
SHA256 913036e6e9f928ea8b24fa4c4e8f1787d96d3c0824c32f439373d6424aeae9aa
MD5 9926a1d5f9b26c5bdd2aa7187ad232c4
SHA1 2e92580367e735efac009bb7f33f35c17fd615c2
SHA512 3eeeb534dff3fd240e9ef4fda93759aa11caf961b9e1bd7d9ea24e3c5fa5d98ebdc0bdbf2f6627f282aa68358eb1ebeadfae237bc9aca0543db2b39c4345341a
SSDEEP 192:uulm+xasuheOwQxMG8N7FgE9FbEooDUuONXEBbDR+8quM31CyealQfI6k4+jrdYy:n2ZcIN8N7+E9RiipEZDs8W/9sI
TLSH
T1D8525C72A9B4693794EA9546F8883A038EF4D223E1D9BF88D0DD5B1D05EF5EC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Crashpad\settings.dat
Size 280B
SHA256 c308fcbea3790e5e431f0a16e074d2b18b81ff9561dced657a54aff67d48ce4d
MD5 c7fd75d2d7644ebed51d2b0ff70c9c1a
SHA1 c3c7035885044c9a1d592965be8d0bf98633f6b1
SHA512 4896f1f3a8230606a36b697670aff05c9d131f7258f84a7ed3ba5d81d77d6f13f10cdbbb0adc8b74b6257ce6d1fe33e47b4bb7923c4556cb701cccb5dc03170d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Crashpad\settings.dat
Size 280B
SHA256 354f828839700b742c4d3ce1c24a382eddc2ac6eaeaeadec1aa5231904a51309
MD5 107ce779b198bd7370e3ff6cc8608954
SHA1 3f348058bbbb7c45fba34a4d82eb32b95d00266f
SHA512 d6a07c2ebcd85143c71e15eb1ddbc2e72eda006427be2124aa9b2f8ad30d09bf8807242cfbef1b62531acefcc8df23d6d6922cec8ff3164f7430fc07779abb5c
TLSH
T101D002557614B454C05D647DD77A7D4106855A1173574555416746085A46241100F9B1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8cdef6eb-4f65-4161-9dcd-b73e90bf3292.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\8cdef6eb-4f65-4161-9dcd-b73e90bf3292.tmp
Size 9KB
SHA256 6ac1e209f18e472f0df60da15c59f9d530883c669f119dfec1497049dae86bc8
MD5 1e160632aefdafd87e5cda9710338652
SHA1 7316de7de4affd38cd8448a4e386786cc11348ac
SHA512 8a77041c25444573ddfaa9ba93c4b36b88d3278d72ee52ef74787db9e74e81752b5f5afdfec370abc0bb500f155de18cbe5395652e69b3af7dea6595dabedc33
SSDEEP 192:sxRRROV/fmsWhfIdpW4/gb+WNBml/dM/bhChg7J:sxRRUV/fmsWhQz/cC/SjN
TLSH
T1EE12C945BE68697B8CCBE20DBA65BF52E2F55022A1D51E48EBFCC61C04E76CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bd758a9-e3bb-40a9-9de3-82f3a62e89a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\9bd758a9-e3bb-40a9-9de3-82f3a62e89a5.tmp
Size 9KB
SHA256 63f1debd880d3aa8ae490149d1b257dd0a179889841b58f92a30c537ecc9fd5d
MD5 ce20a93da468d7130211afa9d6bdd3b1
SHA1 c582fa52f6e179a0148c8bf36cc8849017a0c474
SHA512 708133403b04ebf49b181ee40b2e8bab6409e713e09e37341dbc62ce3cc4d51644f6b9ff39d243945292e7e436334dc3d2df7b1dba171f2037217a68f20785c2
SSDEEP 192:sxRRROV/fmsWhfIdpw4/gb+WNBml/dMm6hChg7J:sxRRUV/fmsWhQh/cC/zqN
TLSH
T1A912C945BE28697B8CCBF20EBA657F52E2F55122A1D51E48EBFCC61C04E76CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Cache\Cache_Data\f_000006
Size 36KB
SHA256 6e139765a5bd1bd95bb4a5b96ab2fdd5011c9957089ad39dff1126999bb54478
MD5 86154eba2d7a62563b56e63ece4e6e41
SHA1 e2aceed5c1f8157bb6664e74203e3aebb911398e
SHA512 ddab71971a942486e8621a7269b6743069ca9cdc03e79f88cc554ba3a5d9b9dd2a49df221d4cfa05bbb80fca4486992c946033e7c715c1e959672368eb4eb252
SSDEEP 768:H2sM9ls68aNttInhXWGv5pNH1OXWGrIwGmi028FtynkPK4nZ+Dq9Y9sVut5f9m:ugx4msGv5pbOXWGKmia9Th+d8
TLSH
T107F2017690806F9CFBF33652A3DA2CE271E6C901C571CA0A2568A1AE77DFCD43143E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Code Cache\js\index-dir\temp-index
Size 408B
SHA256 52482b4e50745f7d2ab304cc0e622ec59467f49dd5418a40949bcf8420c9b210
MD5 a143ba0c5156fed093a4301184c4d4cf
SHA1 c6714c84e8f9b2c09e8164700ce61e159801f19f
SHA512 0b4381444107881073bf3888f188882c943a57927c67386f9f0d8435d8d81239cd3bbc20e6954e329e4abefb341ea17fde3b4f55fa8d06904ad98a34be7c5d75
TLSH
T176E02EB083D02C82CF1198B0EC4C8CF8398462713486237B8ACC71BDD023EF609104AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ea614106ab1c051b69a67f7458cd7fd1b8b3f2d09f63537666b9b29748164254
MD5 45461e4e3cdf35855bda03072e0b9877
SHA1 bb6fbaab1303e5bd41ebc6b03b4b6f4f0635dcbc
SHA512 0591dd8c922bf4f9b6543f3e881320ee33db3d7a7dd5309d6137a4fecd74b369a8e6a09490cddcfe7bfa70189bf6ea7f60f7530c9cebd77a0fe9eff7189e2d5f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

bce18c95-5055-4b06-bf5e-f11c97648390.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\DualEngine\bce18c95-5055-4b06-bf5e-f11c97648390.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2619f63f-a520-4e3d-8b2d-aaf0dd061fd6.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Network\2619f63f-a520-4e3d-8b2d-aaf0dd061fd6.tmp
Size 1KB
SHA256 ea1733e9529225762c12126abf4f2db465c6341dc09128da08241c96f417237a
MD5 57661ab99d2240a95c46d6d97030e42a
SHA1 d9ad445064cd9b6b6387a5035318c77ed335d0db
SHA512 97d7ef79ac4c8ac012698f1545c5bcac277247000ae91cdd9949631cc170f59005ec3f06dd3b3cfa5012cd715269f15f607606188914d553bcfe5d1af31fdebe
TLSH
T1ED316BF383E8866E891156F0AA18AE1BDE2D0516531C3D1A88D4EF5B97E3471E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Preferences
Size 8KB
SHA256 8c5095b7929f0e479de22d46bffc02d1ad3fba1a83f66aec99be0495fe75f4de
MD5 66d37bef840b7561ea8bd6709e94cfe6
SHA1 68b809c8cef0abeef074b6a1d0a131fdb0619635
SHA512 e70efc7f0c70b08a0e54423f3fbc4a5feeb1d76bd9d5a8a44a0823d77ad4dfca8b282c0049c3e70773d5f609a440a1f30abbfc03684c9db6f6ac49df989112ce
SSDEEP 192:sxRRROV/fmsBhfIdpw4/gb+WNBml/dMihChgJJ:sxRRUV/fmsBhQh/cC/lz
TLSH
T19002B841BE68A97B4CCBE20DBB65BA53E1F55122A1D51E48EAFCC61C04E76CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 b201adb2a7a887233160f767c5ada465da981a0af29df33b3b943692c24b7c44
MD5 d955ea3d7e56279c3a004de5dabf626d
SHA1 a2b087d750c5acc2535282eae04ab2471c1388b1
SHA512 acf53bbce470f8b2e921e54c5db531fbe137488df9a62378e4f28694ff7259fe03ab2d906d73a5f52b85edc676566faae1bb3d22e96c7027fbfab1b9af2b0e08
TLSH
T1FEA0023406C84841DF424271D58A0ED1373468709517537789E451E8DC931E05616001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 62462f74c1ac27fb13c33cb2be817801b4878f69ac68e72b554dccca5b5ffba9
MD5 6307be5fad9c50532e10a6c757654428
SHA1 750b25d7d58d8f229932b2e22605fe7f08434196
SHA512 f8a53bae8003cf0ea23b797056661a5faa2f60657c35335624624b9fcb345ca62af2e0bc3ec61d73afe1df5a6a94d87eaa8fd76d2c57b7b75e7149ba5b11336b
MD5 SHA1 SHA512

Submit Download

392061e3-27ea-4c04-9cc8-71a63874a48e.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\392061e3-27ea-4c04-9cc8-71a63874a48e.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 ce6c9030a502662b70662221857efd9d3db695498d53ba08b9165d3651ea2498
MD5 7f5b0c1da266b663a1ef82906f381b6f
SHA1 bf90f7d7cbce46b70f3273b0602cf5456c27e13e
SHA512 aa202dddf4513826ca543607b8e40b28cea7922d06d260bcd4beb103930b94d1f1801d048b17fff277b452ee15f5a5fb38ab0203c67a441cf024ae9acde96be1
TLSH
T1E6214E12A2BF424138FE27C84278D4D68A5170B3383464FE76E889551B6AF505DBECCD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 04179c544f0397d3df04b0d20d681585bebed6d0f2421346a57dbe7cf6843379
MD5 98d0f8649fb52377e3bf37023ab56942
SHA1 337df4300e2fa2db4973201024d84da747b67915
SHA512 264c2fbf1352ea6e236fa90e7b0d22f12942c09e7e68775da7f86281e0bfd3199f18810ec31dcc5ec3c92d47216f3de5d481ea7b05f60814611ea8c9acb12dd8
TLSH
T155516F12B2BE424139FE26884278D4D68A5170B33834A4FE76E989652F2EF105DBDCCD
MD5 SHA1 SHA512 TLSH

Submit Download

ebf96b2c-405d-46f8-b4bf-8596f2569f5a.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\ebf96b2c-405d-46f8-b4bf-8596f2569f5a.tmp
Size 8KB
SHA256 91c6e459197b12c5faddf7aea70303b44b3c6133b27d47a119b148e7f4e4c487
MD5 33a47ba37caa4123e18a94dfed167b4f
SHA1 9ca35eecd4adead744b474962a7df9ba6490bfe2
SHA512 4ae290f1c89fcb6aade7c2026cebf83eb2561653bb56c9145965fde229f31abcd45a672f2a9dfc911383b5efbb651470d97409f741606954d10e6b6f76a64d66
SSDEEP 192:sxRRROV/fmsNhfIdpw4/gb+WNBml/dMfhChgJJ:sxRRUV/fmsNhQh/cC/2z
TLSH
T1A012B945BE38A97B4CCBE20EBA657B52E1F55122A1D51E48DBFCC61C04E76CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f371e80a-acb0-4075-9413-fa73c430a32a.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Default\f371e80a-acb0-4075-9413-fa73c430a32a.tmp
Size 24KB
SHA256 9db8de0e4f95e7df11ea64353a108055c96a965dc1266c801614731bbad8ddf9
MD5 a3cbb9d10541a20a0a8de8d780d3ec38
SHA1 52cb1a5ea02762f7070f9b5b8f6aa30586e8ba47
SHA512 42a8d180788d6488936314bee0d55d24bbbd7c65d7da3c68c5589a6b94b75bacdd09b4e3db5323833a880bb9dadda08cb06802d9d0bcf814176db4b68fa39c8a
SSDEEP 768:KnyIo1WDfdfdx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxrbrUroLnjS:KnyIo1WDfdfdxu1jaEPr/LjS
TLSH
T13CB2FA2F704CCB7E8F804A9ED8597F9B6E6C01C7A6588D4047FA994C03C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d81cc89-f5f3-4e28-abd6-45ed80976771.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Edge Cloud Config\7d81cc89-f5f3-4e28-abd6-45ed80976771.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\Local State
Size 1KB
SHA256 95ebfc0ca67bd8aeb28abe56e8ca09ff9fa4ab01ec4cc689750514f803961d00
MD5 8121f51f9e8901d08f6658afc1d67f32
SHA1 a5c139829cf81aeb8ecf4d0ef9d4dc6e5aaf22f4
SHA512 c8903a5cc6caf01d88209bb83e70bd99e343d3b4f03779899df223579eba29b854cf9e87ff2770d40927783e08a06a73b618914d3d1974db173c7d52c558957d
TLSH
T1D23196B0A8E83D339851568A934DB6D39A705332D156AD4851DD4B1C00E77DC525AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

149beb87-2d82-4971-92c7-1586e4e6e50e.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\component_crx_cache\149beb87-2d82-4971-92c7-1586e4e6e50e.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

175e7dde-c6af-45d8-9040-6072716773a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\component_crx_cache\175e7dde-c6af-45d8-9040-6072716773a8.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

6e8352f1-801a-4b13-8447-40df52a08dc7.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\component_crx_cache\6e8352f1-801a-4b13-8447-40df52a08dc7.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

83f93a9e-0b3b-424c-b510-84e83d2df86a.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\component_crx_cache\83f93a9e-0b3b-424c-b510-84e83d2df86a.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d08eafcc-b891-45b0-af61-ec16fa27aea6.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\d08eafcc-b891-45b0-af61-ec16fa27aea6.tmp
Size 4KB
SHA256 a04544bf32a10cfdf893adb238a62be4b4d3cd6de811aacd289a77b8d785ec52
MD5 fac91070d02a6de13744fbeb1d43117a
SHA1 279733b27d415d2c3a131593a4c9eebfc5c51962
SHA512 1af3e747d9414c29b9d42e720c730d6f4e078817dd4431cea1e156216e261a19d3d7c7078e325a0666b3abff535ce1105fcaae5db03a2f1c4b0c85d68a5736bf
SSDEEP 96:JqGNknZsFfe4clw7UY3Z1B8ryDELBnP4vrc6gb80eUnnaSDS4SYSuSDSDSAq4a:wGN6vgLSwYPCgb8q6
TLSH
T1AA81C772A8A4BD2749D11A86B5493543CE75D323E649BF9461CD271C00EF1EC930AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeba9c7d-dea5-4aa3-9086-7ed5a78dbf78.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\eeba9c7d-dea5-4aa3-9086-7ed5a78dbf78.tmp
Size 23KB
SHA256 0233014ce74eb6c64c46dc2fb7cd2027e612d24531ca2fdb41854278d1f51b8d
MD5 a8a0438382249e04f1f15a1893e9ea2c
SHA1 99eff8dfdc8ea9291e329a9b9cbdc39d270d8a05
SHA512 e5034c8522e85cdbcfb3a35018bc8e5a14d4a10475f657d6db1ffa32e283fcc234128445445960ea3df2c9e80d9594a6f005f0d3d8b67acfaa68fda13de40beb
SSDEEP 384:nriFqZcI88NV8TUNTUlIVXE9RiizEZzDf4Zs8W/9sI:GFI8YwgeJpZsj9D
TLSH
T126B272F298D39637E8AE4787A77D6D4289BCC153B188A984B7C85E4CCC971BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9707cec1-da84-4a3a-b6d9-728d511ba1ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\aflowcast_edge_profile\extensions_crx_cache\9707cec1-da84-4a3a-b6d9-728d511ba1ab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

TNRH7LJFE3S98T5UT1OB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TNRH7LJFE3S98T5UT1OB.temp
Size 4KB
SHA256 32f763e73c6bf778deb8d0fb16a82756c9d8fb7cb83005696df9d5e05bc3a17e
MD5 fbaba75cec4644e6dd589958234944b1
SHA1 9b848418a6f87740bbc916cc697c2d6b6612b245
SHA512 53706bcae83e6bad30a7c611fc620fee3068beaa271371d7aec4df839f7fd6c84f152f4773b8ae7674504d99baeddef27610bd7dbf92837602863b50b7adeb9a
SSDEEP 48:i1hdOvW84C4PJ9z2Y1dLXuH7f3Jpn8hdOvW84C4PJ9z1YOgdLXuH7f3g2s:i8qJ2KubhNbqJ1xIubc
TLSH
T13691CE105FD54A16F3F7AE7255726B106E7BFE9959088F0D008942090C72B18CABDFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 574caedc5ce0bdafa737d3bd66a8f6cd5c4c86d033b5afcfd45423dc257cb21f
MD5 3e3c06b53e8af304f617093bee6af744
SHA1 19bd620bc7756ca88165628683d19b8b3bcb3347
SHA512 121ce02c6c14ba36dde2305975b3e7c3b038d1b11f4106d9e73fa4ceed0c9a140338f4f0d741091c88417c46a801a1f5aa84e5d08078e4ab40efe6051b7cdf8a
TLSH
T17741DE105FE54B29F3F6AD7259B36B21AA37BD45E5184F1E008A03090C67B09C9BCFA3
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_2096842054\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_2135556044\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_783047119\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_960376234\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 7b756037842d4a60fb9f80a1495dd35d3792a5ee12451efa188b2291b8a59b28
MD5 4e03aa3d46757ff6de23156e793b5c05
SHA1 cb590c57bf8cf490654e716071a69918e8e4a2ff
SHA512 356d4c8dbf68aa81e9b483126d9e0c2ed8117aee78d1a193587e52da7e2c6942097cc2f95016f1d9bedb044821057adcb5a33c236894c9bdabaf42664da965da
SSDEEP 3072:zVGdA80IPW9cIwkgMjfRl5rhxvC1BfTJtyT/i/:zVGdA80IPW9cILgMjfRl5q1BfTJtyT/E
TLSH
T147C343107B0B417B7B067EDA35037A3579BE2283EAC426DD7B9E2540B0C69A6415F0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download