ff6ab6fab389da802db676a2f428f2254eebaef7d95f318360d8e9e1f3629140

Analysis

max time kernel
151s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2025, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrealV8/CrealV8.exe
Size 164.7MB
Sample250705-ntlpbaypx2
SHA256 aca87476850d0cf4269d9ca8a12d18c68f0643cd6c3526ccf7ca5444f8e5bf46
MD5 86d79247618e90a72b16f21ab1102848
SHA1 532d8cc5fc34542301fea2db27ace0347033b622
SHA512 a0dbbc4e36a97cc3e26e894f2d51350e5c51f11ef60ab7ef21ae5a3b7195a5e3dd9f8752f7100849d96ae1542dbc1ed7f518857f1960c4d6019a1c5d1185db46
SSDEEP 1572864:EmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:asFWY7ihS4kVP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
12	discord.com
102	yandex.com
114	drive.google.com
179	api.gofile.io
181	discord.com
3	discord.com
4	api.gofile.io
4	drive.google.com
6	api.gofile.io
11	discord.com
74	yandex.com
108	yandex.com
113	drive.google.com
1	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5572	tasklist.exe
5664	tasklist.exe
4216	tasklist.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1189547549\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1189547549\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_906393597\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_906393597\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\edge_autofill_global_block_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1189547549\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1189547549\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1189547549\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_906393597\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CrealV8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CrealV8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CrealV8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CrealV8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CrealV8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CrealV8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CrealV8.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5124	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 17 IoCs

defense_evasion

pid	Process
3884	taskkill.exe
3680	taskkill.exe
3576	taskkill.exe
1304	taskkill.exe
1972	taskkill.exe
112	taskkill.exe
3368	taskkill.exe
4420	taskkill.exe
3656	taskkill.exe
1456	taskkill.exe
2680	taskkill.exe
5580	taskkill.exe
2984	taskkill.exe
940	taskkill.exe
5236	taskkill.exe
4956	taskkill.exe
2992	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133961894568224849"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4024151881-1944119507-1574723210-1000\{D7852995-FFE1-452B-B8B9-570A5512DBA1}	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Chrome_cookies.txt:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\dc1caa39-dc27-4473-ba5f-085b14ef8961\fallback-cookies\Chrome_cookies.txt\:Zone.Identifier:$DATA	CrealV8.exe
File created	C:\Users\Admin\AppData\Local\Temp\dc1caa39-dc27-4473-ba5f-085b14ef8961\fallback-cookies\Edge_cookies.txt\:Zone.Identifier:$DATA	CrealV8.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
5124	CrealV8.exe
5124	CrealV8.exe
5124	CrealV8.exe
5124	CrealV8.exe
6052	msedge.exe
6052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5896	msedge.exe
5896	msedge.exe
3356	chrome.exe
3356	chrome.exe
5896	msedge.exe
3356	chrome.exe
3356	chrome.exe
5896	msedge.exe
5896	msedge.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
5896	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5124	WMIC.exe
Token: SeSecurityPrivilege	5124	WMIC.exe
Token: SeTakeOwnershipPrivilege	5124	WMIC.exe
Token: SeLoadDriverPrivilege	5124	WMIC.exe
Token: SeSystemProfilePrivilege	5124	WMIC.exe
Token: SeSystemtimePrivilege	5124	WMIC.exe
Token: SeProfSingleProcessPrivilege	5124	WMIC.exe
Token: SeIncBasePriorityPrivilege	5124	WMIC.exe
Token: SeCreatePagefilePrivilege	5124	WMIC.exe
Token: SeBackupPrivilege	5124	WMIC.exe
Token: SeRestorePrivilege	5124	WMIC.exe
Token: SeShutdownPrivilege	5124	WMIC.exe
Token: SeDebugPrivilege	5124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5124	WMIC.exe
Token: SeRemoteShutdownPrivilege	5124	WMIC.exe
Token: SeUndockPrivilege	5124	WMIC.exe
Token: SeManageVolumePrivilege	5124	WMIC.exe
Token: 33	5124	WMIC.exe
Token: 34	5124	WMIC.exe
Token: 35	5124	WMIC.exe
Token: 36	5124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5124	WMIC.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
5896	msedge.exe
3356	chrome.exe
3356	chrome.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe
3356	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5104	3364	CrealV8.exe	78
PID 3364 wrote to memory of 5104	3364	CrealV8.exe	78
PID 5104 wrote to memory of 1580	5104	cmd.exe	80
PID 5104 wrote to memory of 1580	5104	cmd.exe	80
PID 3364 wrote to memory of 1628	3364	CrealV8.exe	82
PID 3364 wrote to memory of 1628	3364	CrealV8.exe	82
PID 1628 wrote to memory of 5124	1628	cmd.exe	84
PID 1628 wrote to memory of 5124	1628	cmd.exe	84
PID 3364 wrote to memory of 2604	3364	CrealV8.exe	85
PID 3364 wrote to memory of 2604	3364	CrealV8.exe	85
PID 2604 wrote to memory of 5448	2604	cmd.exe	87
PID 2604 wrote to memory of 5448	2604	cmd.exe	87
PID 3364 wrote to memory of 6004	3364	CrealV8.exe	88
PID 3364 wrote to memory of 6004	3364	CrealV8.exe	88
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4764	3364	CrealV8.exe	90
PID 3364 wrote to memory of 4716	3364	CrealV8.exe	91
PID 3364 wrote to memory of 4716	3364	CrealV8.exe	91
PID 6004 wrote to memory of 4956	6004	cmd.exe	92
PID 6004 wrote to memory of 4956	6004	cmd.exe	92
PID 3364 wrote to memory of 4988	3364	CrealV8.exe	93
PID 3364 wrote to memory of 4988	3364	CrealV8.exe	93
PID 4988 wrote to memory of 3680	4988	cmd.exe	95
PID 4988 wrote to memory of 3680	4988	cmd.exe	95
PID 3364 wrote to memory of 5180	3364	CrealV8.exe	96
PID 3364 wrote to memory of 5180	3364	CrealV8.exe	96
PID 5180 wrote to memory of 3368	5180	cmd.exe	98
PID 5180 wrote to memory of 3368	5180	cmd.exe	98
PID 3364 wrote to memory of 4188	3364	CrealV8.exe	99
PID 3364 wrote to memory of 4188	3364	CrealV8.exe	99
PID 4188 wrote to memory of 4420	4188	cmd.exe	101
PID 4188 wrote to memory of 4420	4188	cmd.exe	101
PID 3364 wrote to memory of 5012	3364	CrealV8.exe	102
PID 3364 wrote to memory of 5012	3364	CrealV8.exe	102
PID 5012 wrote to memory of 3576	5012	cmd.exe	104
PID 5012 wrote to memory of 3576	5012	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe
"C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe"
1⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic os get Caption"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get Size,FreeSpace,Caption /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get Size,FreeSpace,Caption /format:csv
    3⤵
    - Collects information from the system
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4956
- C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe
  "C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\crealv8" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,6648429050773915750,5573461240827589340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe
  "C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\crealv8" --mojo-platform-channel-handle=2156 --field-trial-handle=1844,i,6648429050773915750,5573461240827589340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:4780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:2692
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:3560
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:5952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:1868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:1556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:704
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:1944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:32
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:1692
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "--load-extension=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:3356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4bcedcf8,0x7ffc4bcedd04,0x7ffc4bcedd10
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2560,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2548 /prefetch:2
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1672,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2612 /prefetch:11
    3⤵
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1980,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2648 /prefetch:13
    3⤵
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3376,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4164,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3716 /prefetch:9
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4532,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1552 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4560,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5712,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:1264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5724,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:2060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5768,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5740,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5840,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5812,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6196,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6288 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6320,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6360 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6368,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6480 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6492,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6652 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6992,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=7012 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=7132,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=7164 /prefetch:1
    3⤵
    PID:340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=7340,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=7316 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7360,i,6261579804135801747,1830292373818355009,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=7628 /prefetch:14
    3⤵
    - NTFS ADS
    PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x300,0x7ffc47f6f208,0x7ffc47f6f214,0x7ffc47f6f220
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1732,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2180,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2452,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4732,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4736,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5328,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4108,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:72
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6528,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6588,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6588,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4592,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7016,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5080,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6468,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5476,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6500,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,10138952163498878751,15599878416500405626,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:14
    3⤵
    PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://mail.google.com https://google.com https://outlook.live.com https://yandex.com/mail/ https://mail.com/ https://mail.yahoo.com/ https://proton.me/ https://drive.google.com/
  2⤵
  PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc4bcedcf8,0x7ffc4bcedd04,0x7ffc4bcedd10
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:6004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4216
- C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe
  "C:\Users\Admin\AppData\Local\Temp\CrealV8\CrealV8.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\crealv8" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2580 --field-trial-handle=1844,i,6648429050773915750,5573461240827589340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1176

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\d466c90afe4f152a\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 e1c57d9aaee9765dfa2e1f0f42b909609d3a11233950c66096b44eca5a323f61
MD5 15ba394ac8954d308406f65d98ee9eae
SHA1 68d2c75a6e456aec2f72259ddaab73eb512d7800
SHA512 acbccd44297bc26d80a1f1e2dba49bf2c165027fcad024058f1d3a84a645df80b0377a6d0f47e198f39a873191a7d4d38fb6581c662122e088d304ac6684ced5
SSDEEP 3:TKvHllGlll/l/lXp9ZjrPBY0HlA/HOlXlZP:TKfl0dPBY0RlXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\d466c90afe4f152a\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\d466c90afe4f152a\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1008B
SHA256 018ed09268a9414aa7fff08fb1804848fb99b09feefe76f1098176631948193e
MD5 fd1a85b6526dfb16da9e5ceec24ded4c
SHA1 85ead52d8f05592a217353b6f3bdd2304a410681
SHA512 037b1c02895aa3e129ba81c2cc7af2de22ec2065f3229588bde18b00c7f47e91e21401eb8061cbc17a1c59452e90a4dddabe9b77a00ee970657f080f9dc53592
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bc197a3a6bcc3c99aea95d0b003b3608061a8e5612883c50f38c464ed1a97a67
MD5 dd9767b8212019577e54a0a176b22e18
SHA1 58b7b159eea40f0f7145e2adb997d09f6e3b2713
SHA512 632f0f6979070af9ee260530be4e4639019c8f338c87069e51d8d6b95619774f067ff6d3299dee8de7aad0d437e6f980f4383ec2146e11a51134d764366f43ba
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 204903a5b1f4385e15f7691b21020bc15dd232b15efeef50ab62f57d4a18a4a1
MD5 f13b5a2b266c3ab950277faeb6a99384
SHA1 d330bcc6c203de9270876beab1a2947116d132f2
SHA512 de641ae852119d12da3e873cdf0de06a6cd2da58a639b51ff6c3683093f7a8094ffdbe684b46cefc2aa35441174bf0166edb34277e5c1373cc22fa889d889829
MD5 SHA1 SHA512

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome\index.js
Size 1KB
SHA256 efc6f95d818058560fbd6b03375c5c284fdef7dbdcc8276cd9b4c9250f9599d6
MD5 35bd945857261889c2379306d9ad9625
SHA1 6a8dbf7a0c0467f6e1f643468fade1c0d6b4ef6e
SHA512 6a7ca504e75d0f80085a897769cad395c4867eba64164b5c24db65552496bf9496b3506da945f73137074af5ba5283aa2242b0b37c39763bbfe3bb74c3dd2265
MD5 SHA1 SHA512

Submit Download

Cookies.query

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.query
Size 20KB
SHA256 72d049174f8bb874a5db67735ce76cab400f25a72391ec557ef2720785b4c4ac
MD5 febe8b30c72b9ed5786ae265ebaf844a
SHA1 010452344e00fcf8609b9df083803311efe683e9
SHA512 01863fd726d2bb344f368673a31df809a58c810940200a8cf02d1be09ce92f1d097419fffabbada9651d2977948111e0916e2012d92974f96ce7c942ef01732e
SSDEEP 24:TLP91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:Tr9aw/aHLopFMavU1iB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 2b6f0f9d67f3a4d4ecce4c107c54d77e58742fdb21053198aeeeb3838ff1acf6
MD5 21eefd4cfe47824f7f391fef0811cba0
SHA1 cb8c9ed0676b9d20ae815580185800da42d18b4c
SHA512 2bc91bb23516d2e3c07047614b73662fa648b03b601be0f12bad28d00e66a932c48bb71e45df4188dc3402a5abc8347efbfe6773a487b318a9897f4e4dd52195
SSDEEP 192:TYsVdfctzZ8PRpYpHS+WNZ9o75JkwEQX+pQyIsnA/g4:TYKdAgXYxcrorbX4Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 a30bcfaeaf81302523a316d7ee013968b50765a884ba2d88c72eb3710164bb20
MD5 f523ebfc220f9a6bcea380ba85ccd0f3
SHA1 01a4997808ee57117df4ff8de28724cc03cc0e9b
SHA512 cdaa90c4bf3aa4eaa126d24924e8f669d28d9bd7344584ac7563c4d2bf15694bf91c0d6dc2d73c6dbe95d01e8c0d3be06ce881bb794352db1f6e35ce7e20fae8
SSDEEP 384:CuHh7pLuLceiomPunXUhPkXqKf/pUZNCgVLH2Hf12vrU46COCYZu:CIh7pLuL77mGXUhPkXqKf/pUZNCgVLHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 da68069cc2e24086bc381e986f611e41d7e18e3c598c1d99fe84ac7073cce11a
MD5 43ee7381039c5624c81348d9e042b204
SHA1 69d998d712e8f4531985c6f7300f98a1af4b2a17
SHA512 8862293af81c225cfd1e52bbdc891aeae9f197c288f5423e7b1ae94c9f7234b96a81f235fa472dc90d29caf18799bc1f26b0f611b6047bf6b634b0bed771b9cb
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe583e3d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583e3d.TMP
Size 72B
SHA256 427d6f7358e0e44fbbfdf9cd8f520d7169fc06be135db937b97418bce532f101
MD5 2bdf7c9d4deaaed4343967e60b33bfe7
SHA1 37aa359c28525c4a24be0f1dbe5ebf2023d5c906
SHA512 78f4761ee879695cd40be4baf8bd4e49c67ed2c225dc2a5659479cd7d62c98315ab52ca554da2e7ba796aba7e40e3e627e7ae5a1bf57d7e96aedd5199f793b32
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 166KB
SHA256 d2b9c6ec631b4b4f7888c2300a757163a344bb5ebc965db5f5397b8e0e1f730b
MD5 cca6fe57de80d7bcdab316a214fca5bd
SHA1 0cc21284d95d65869bc1a82557c90aec03de0bf9
SHA512 ad67b89db7c636792a718a27696431aa1922b467fe2edace97205cca800a9618b6fada965534bc556bc91bf23270a7c2cef0579ef71cad96fba6b2fdcebf217b
SSDEEP 3072:sKLwzxQL3nBBKYzrVP/FUfJZhw/dXjM4rTmN5eWvStRNoV8cWK7XF+TwMp:H53nXdzNFUdCJrTnGfzF+TwMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 9e90ea6c9dc81aea1e7bd966d02a143845de4c06de76a5e6a5d7bad6bc6cca51
MD5 833c058a33f7ad45a90f02d60126cbdb
SHA1 4c92cb709b3c3c9c4117b9bbedb2268577d8a0ed
SHA512 f37f1d25792f109870b6628076e46515609a3f47c82055393525aaac3d1679399288bd63e9c4c38a1b3f37e0f16052abcaa804a33d3877a9eafdbaa69c883f16
SSDEEP 1536:hJXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMgJ:HXjM4rTmN5eWvStRNoV8cWK7XF+TwMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\autofill_bypass_cache_forms.json
Size 146B
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\edge_autofill_global_block_list.json
Size 5KB
SHA256 7655c9afb5f2ea39b18e302498b34009ca02b72451f82a6d4e7fb4d8d954f050
MD5 adb5f6058f82680a26d6ed02b44e5a21
SHA1 6197ee74e40c742e184357dcb6dfcc7e32818cae
SHA512 742dd8f6eaf1bd5f24b37e90d7a3dce7bd0a8edf399c2dec25cd92d2bd6e1d663ebab3c68234812f0144061d4f22f0c2c43de890f60e24d93133bbfe23a6d1c5
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lydMsSRa4/i:MYL7O9FnLk25+tF4B8K5b+QiGoztWuDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9f64241015f38224418e393d7238bb902fdd41237b18ce98e8a178ab436c93e9
MD5 6017e3f3fcca2244a025a1359b9706d8
SHA1 93a1336b70343a2ce6acb73deba1a1872060be6e
SHA512 2fe4daf85a84038ac8160fc2756b3c6fe1870272a80ca4ed3e3109f77c4e70e49f3165be0eece206bec74995f41a083932c4bceeefb2459f4109bf1730e42cc8
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0f0425ad0de580ec6e0546c774b1964986d9cb58d526adf4a9dffdcdb396ca5c
MD5 d2adc4bc92eacbea5cbca5581a071268
SHA1 a1b9c90e967627109b6c3aa60e8ca016e0c58038
SHA512 883845ace1df3f6e14e9cea30f24632bda652861fd89e49c68120d104442500cf4b020ede88fac7ae2a123c9dc8c97d1bed54033c26ec1b4405d7d1f6045070e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 34d010b1c40df7cd8fadef7f01bd4f7cb112e704ad80652f740fab26e274d82d
MD5 973bb4eb12d690d27d480ce7459ff0d7
SHA1 c99648c421314fb528ef82fc8c0d0f551cbc0948
SHA512 087c3456aae631ec74b73e31331fec0f626e0ecad10d428408bd7f9ebc4e3b0fa33e599baf91bf2feeac9ec95fe425e0323a3e45b4be83f953abe0ee9ee9e22c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe584486.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584486.TMP
Size 3KB
SHA256 d84d55481606c85d4af103f733c2937b941a43922758d52ff13ad804aa72b62b
MD5 f735b77191bd2083d040f6ff8b541190
SHA1 d0d11717222a5247bc59bc04a02e92be43cab363
SHA512 06e21ba459c35b2b9129c879d45181641b6163107625518aeaf24c178c78fc90b38a157c8eaadf77b5de5814aeed78808e767482262ece900d3aae96c846014f
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge\index.js
Size 1KB
SHA256 c5a386a7c641a30bfc23e6e251fffd0e045b299a30329893724cd5c2fee7097a
MD5 be1901d5c7631d0765afa739ee0536f0
SHA1 ebf45ef773d9ffda4e840d44a177734cdb0b4ee9
SHA512 13aa3d337d79235182b9f9c2e9567ca26c889f1bbf280e81a98b00ed831c7993e4fa95663436a297ff0ad151eb294562990bbd20cf834691ba053e872deb6c73
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge\manifest.json
Size 247B
SHA256 70ffc0755a03646a0d99019c761d4d782cd8cff6854bf2259c117b7542c37fea
MD5 70161399426f8c5a120bfa6cc964f850
SHA1 3aedc37f29030adf561214a8281425081e3f275e
SHA512 701d4624702858956e6fa186be15349a66bbd07ffc76fd16a271fe16e38cb60d2e9805cd956725b5942cc09190168697c01f9aaa3623f559cfbd0e21f71282d7
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies.query

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.query
Size 20KB
SHA256 279453264bc60f5035019d49299a049ab98df4421cdc398b5e79db99360c351d
MD5 7b5ec5a54daa9adb7b3469f1f5adaf4d
SHA1 e0c280fa284a785ccfb81af54920c4a66049847d
SHA512 4f9469497fe859430bb4e2c3d36cfaccc0ef24a781ba4d0329d361eb2ea4307354b92eb280c017241fd538f810dead637c098fb5ad2e9f0ec3bc2531a2db3bfb
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBLNm84rtJWnm/:T9LopFMatSaw/auUOt8BLNm/rHWnm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cba5d232aeaac7ce34ebff9ca03bfd0883f6eb050e6f8c2745a657ec557e6165
MD5 c26ee341e891a6d48acacb11305ee0a9
SHA1 f21a5203404607fa512c1cefe3074c6aad50a1e1
SHA512 46e07a07a55172cf53b818a35f396bd6c7d2a657247738952bbcab5d749fd5188ffa2b17ba4be7db9175963eaf69c207f1c3b160da74a929b386bf08b5b02b41
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b38f168f57018934e71201a2fc159e965e80a5d4659331c320a7ea884be0b26c
MD5 d426d3b1a1ae3d15d00c913e7e01462a
SHA1 1c114a95da1ed708bcb415089375c97e13c33449
SHA512 8d2a741938fe928710e225820ce780d2d65efc588331917c3d199e0f9c1a1423e471de493139ea1b27f040c4dfe3a37e46b62c34cadac6c540a2e6d3f533e471
SSDEEP 192:sVyRdyMqv/Ky0Ml8UQCJ+pCsGcwlwIIqmhiJXz2Z8pq/Y+WNFbwY0wP47IxSIgCD:sVy8LqlpCsnAZInsDq/S5w5Tqyk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 33dfa878b613f58f513854f401a1e616277467d67bd058b13181a5a296eed6f8
MD5 bc49da635bc1d611a91e3462638a8306
SHA1 5b9ba16e55c287bb79f870bff746637f4c7b6a9f
SHA512 a8ce901cf4e9d7402f8cf745039fe2c3b6364be48564f60da848357fd43e633732d84fd4f5eb28c13bc558f4f58d65662b3334e12e71ac0c68be0c884a5a8371
SSDEEP 192:sVyRdyMqv/Ky0Ml8MJ+pCsGcwlwIkqmhiJXz2Z8pq/Y+WNFbwY0wPMWD7IxSIgLJ:sVy8LUpCsnAZknsDq/S5w5vWXqyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 a28f7d5f70e2e29b9b280792a6f06b1d44a01315a664ba93e8a2cca6f56b229e
MD5 78a83ec7dda5ff796b3ead27987ccbf5
SHA1 f1143f15d16825d80e3482b8ea35d81dc8b28d5c
SHA512 b398dc4a19e5cbec30e02466be52387648a787439d86f6bb5e2a8e06fb0374c75fce8f0c22c3ead2621ab4787892db521d348f02117f1e5b76cfe211491bef40
SSDEEP 768:l3rCN8oR2ioWRWIAQs88F1+UoAYDCx9Tuqh0VfUC9xbog/OV3aXLl/c20fYWS+rA:l3rCN8oR2ioWRWIAQs8u1jaKaXLpcPfu
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\22c05098-7d31-42a3-9daa-119467696526\index-dir\the-real-index
Size 72B
SHA256 9f2c3e1c48acb24f586affb25bd2e3ec649128342af5f76cfbb473a7401dcc84
MD5 c8d09e9d045fa8c1b5ea0aed20d2152e
SHA1 9abc42aad5d5825a9c0b8962d7aa16c9dc908dde
SHA512 1a43cac6318b81c04e57459de7615c30bfe107456182dacf2e0abda278690a2202667f5d11d6907e03ca439cb3b8ef85e0fd5318822ce7fe1f224e4a2c6906f4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac01df32-88b9-434f-b6ce-94d706338646\index-dir\the-real-index
Size 2KB
SHA256 50476306eceba78f9531169e4ac7610a9efcb17fe60e4b982216d6c6f1c53f80
MD5 646b4991a8a14bf149c913ed83c24f0b
SHA1 f9d67fe1557c305207729810a7e0cf6c2a2ce293
SHA512 d8883e1760376f5be272012aae658d0cc367688bda2e3777f1712b80ce9b2e921480c0bfb51364553529cb1a54cab0fa5e112f3071a93758ad41c7c9b4d80567
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 320B
SHA256 cc31fc7b43542ebdb6d48b50d705f15d197522c8a8857363bdd69c9e92abac67
MD5 45bcde3726c650a644579ad4eb81923c
SHA1 f0cc57d940f1f2e78d7b94325e53c47150715dd6
SHA512 31db22573ae05536ecd56e045c81819f0a1da8cf6c67fab7b0685e04fc1738405f42b24a0ac06d7e38c0d57bbbc737415b4611ce39b23b46208e8cc218040394
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 320B
SHA256 5524443c37c5c1269879c64ef68b857f48092d40ad072ab555f05a99e7a6e280
MD5 b782e221cd5ca6a17ee21d912a3d5204
SHA1 49f282dd09683ac2d995422679e08cd614c4e973
SHA512 9abbae75bc1a16abbf5110b752540b3c2e85839ddf1fa19de99ca4f3b08bc6a79ce434e6700ffcd86ca7d5e03dff3d2d21c7c6c06e8ce1904213d655f19a1fcb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 c05a94b363fd45323e316596259aadebd38fea22bb976d82f4507202cda44298
MD5 13fb3122741ad77cda3f39ba877c27c8
SHA1 552534e60f537834ec5f1dec6e30f4941d2c4ab0
SHA512 dfb95efbf3f4696c94c36a352b7f0274f26d3fcad16bdf3ae3d44944d223d56318d6218e44abcc2ec94e282d6ea8f8cf1689db69a726192cbcc94e17ee4928fc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b7b13d55b9634ba386b6ca66b3b5e9742a1981c12bee51b618bfe155cf29a67f
MD5 6805d0064007c97ee12d6d473ad7bf2a
SHA1 90f7100c08666cb5da7e9d9dc75a4c6fff2111d7
SHA512 7d3eb1d08096011efb6737a7d75007ec37a4afcf0d1fc2c9fb3d11da565d0de2a8c99fc637ff342bbf6b0e64b85d1f18c7c7147012ec61edc7d55df951b5213f
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe583bbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583bbc.TMP
Size 72B
SHA256 2d6e604a4475719ea90e2075a22fc9c80307ebba9d3c71dcdeb6a42cd18c2e88
MD5 f31abed1d42ffea80bcd1566c56c132a
SHA1 c94fd7a5280b67f1d2549b092007b4ffc43c5375
SHA512 f086edb8dc4d95882782debd42c19e2336a63654c01a19a420fa05f5e57343167df03a0b96ce6d7c909327d05161d998d50bf5353ca7e23a0c662146c553879b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6ce98191ab6fbe5ebb6794e057869b93df4493b4aa3091c7cb10c92414e5e1fd
MD5 ea071370001a7d506367ce4ede960882
SHA1 7467c4de557e483ceb0e965ac31935e260ecb202
SHA512 c70fabc1fb2895e8fb431e830f3a7f7ffc26ea7aa93323b96830d3be99fd5b620b50fb434b4d3e44d1b1a5def8fe43f510cbf69cfc56661098d904f1e53523c7
SSDEEP 192:A5tKX26YcQxcF+Secw6lYh22d8hAcayyLi/M88O+8HO3li+UdhKrPpjzGXET3VP6:UKX26YcQxcF+Secw6lYh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.11\data.txt
Size 137KB
SHA256 5e4014e267eec120e673cfbc407e4340c234a7898319b35a304ed6ea343a7999
MD5 1bee2c36cebf096d8a559d5c4eeacff7
SHA1 c695eda67f31d729dfc336b8a471ad6346a39031
SHA512 ba520d383be95d8b15140b7e38e4e7ac03077bbbb8ee5326ac4162be9403bc9f0576e53840fc22cd9c4038f19f60bdeb7b4e8e0125da6ed80670238de812b4b5
SSDEEP 3072:iOmkTNO7NHrMziBxfPURO+/bAipYbzVS72Ag7KnM+HfACMR0T4H:i7kMRIziBxfPe/sipYbRfAPfCaTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 2ea2d5537a53332fdd967ce758ef5fdd20f976e3e11ac03beeac2f2bb19f1600
MD5 c67c0538f770a27d167faaf024a5b4e6
SHA1 6bf167312af429e7e345eaff14ce61c1110a8833
SHA512 fdb23f2efef6bf8e9236cfd0058c44c5853196c8d53e498ea7f7f2f857f31be516fae38a522e84b26177208a29ce8c1494a75a830f174c6a2b8731c9f2038ebd
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 4f4793dddd51da0a9b6fe903ddb05c95e195b8f2d7e7a6dcc9d40bc90e39baff
MD5 327fd9b188b2f1d9b3b400a618cc0180
SHA1 678b41a72412702403d32937b324bdddefd60f6b
SHA512 fdf486e9025cbe3ca473f83a2068509b52e9673b2b226219ab93d8b64084e530a13da0e0c37d756f914fed607753a4b0647406eb27cb221ac7080895709d70ac
SSDEEP 768:9FiE6esE8lDldUGN3/Cg5Jyy2Kve0N+qZ+EMu4fj6wE144UEgOZ3fa+v:keB85dF3eV+vM3rRE1NvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 39632028df9113569c31573f8c6f632b213f51a72f93dc954342d6132bf49671
MD5 e68afcaa9cf888d84ec2b9764399e7ae
SHA1 762016bbb27c41cef271598bb13813e6a956d109
SHA512 780e13d6154f0a9c41dff44a1a46a8e2bd363951be04261fc1f0346d27eec6193ac33a447505feb41195247a7e6d464575473ef47b42e9b66facf2ec6da2dcdc
SSDEEP 768:IFiE6esE8lDldUGb3/CgzJyy2Kve0N+q7EMu4fj6wE1VFsEgOZ3fa+r:5eB85dD38VPM3rRE1VFpvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c98568043c0576035280d6a2e2eea438149c674977a31f7dcb09ffe3edf9e7d6
MD5 ab918b624ef5d6a260b14e76e66e90fa
SHA1 9860d7792f8a1276ad25a495f394987234af8dbe
SHA512 3368e1088b4bde2661137f72467d8cb357d4602c8a20677c4f920fbf9cc4171c0ab27e6eae33c77cdbd1001defcf330ec378358bb44314dd7f98bf2493228d5c
SSDEEP 768:wFiE6esE8lDldUGz3UCgzCSy2Kve0N6bfcbP0EgOZ3fajE164K:BeB85d73WFVLbcbPxvmE10
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowserData.zip

Path C:\Users\Admin\AppData\Local\Temp\BrowserData.zip
Size 694B
SHA256 44eaaf77bd865680ca5c161e31cf754991c2d58d6bdfb8ae41f9fcdfb5854da0
MD5 a6bad6f41c8336247fae70100c5b7a51
SHA1 1cbb289d1289e4674ce481abf67cd1fba6a31bb3
SHA512 f061e90287ea195975611dac2199f91352a92670aef174acd04d12496971b27a90a07ec85bc9eb575237724a205622e2211e45c23c126c44f8380c60891353c0
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\Users\Admin\AppData\Local\Temp\BrowserData\Browser\note.txt
Size 142B
SHA256 a5cc75b040d4a0f5694c5d6dcf44c4742214c9c5711eacd40af8b289d820426e
MD5 ef01302f9cf08109ffd85d89a9b0efa2
SHA1 22d42e948585b0e4aaee917ce3e36eda636098a0
SHA512 a4e0b39657e1ea9d55f03db67aac0c581e970e534cedf2994ca04eafb925299857808c2eb7b564da067f51d0436ff496c8b52f2bcd6d304a1f6a6053a477beee
MD5 SHA1 SHA512

Submit Download

Chrome_cookies.txt

Path C:\Users\Admin\Downloads\Chrome_cookies.txt
Size 3KB
SHA256 c31d84931486c994b46d779c6f6d85d55a6d1e0294c1ff85734e6b8eecc372e7
MD5 e4e5c1d7f886a594829d2440714d8b6d
SHA1 1e2663b207ddcd901a3795acf82741ac69349751
SHA512 35acdea86cf6bcd376a9f59187f50e22561c60059161a3bb8f96c1b04977f00772f80efe7f63d49dd911ccf9a62a2e811ad0199a8090af324db101896de50fa1
MD5 SHA1 SHA512

Submit Download

Edge_cookies.txt

Path C:\Users\Admin\Downloads\Edge_cookies.txt
Size 921B
SHA256 b9a9b2061a05243017626d99d9cc01d30d923693468d5c6328e5b9a4ab028a6c
MD5 f160a301bb7896f173e91a9936aa468d
SHA1 ccd6b20f512ec9537f50f3ac3b758197bcfc01df
SHA512 d5d5718d06748e317c84cd9087e9331827388e639bde202875cd0091b51d0b1a388c50934ef0a0c4024dbdb0d6a3bb9bbd35a6e96fe01572f6aff66d3f315f2a
MD5 SHA1 SHA512

Submit Download

Edge_cookies.txt:Zone.Identifier

Path C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier
Size 50B
SHA256 86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
MD5 dce5191790621b5e424478ca69c47f55
SHA1 ae356a67d337afa5933e3e679e84854deeace048
SHA512 a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1495066477\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_187590534\manifest.json
Size 119B
SHA256 1148c28e540b9b96237b35170a547a13165d6c7c039b8fff9e4b2cd774b92f5a
MD5 390af74c5ae643320cad0cef4fa8fee1
SHA1 22ce727f9bcff9a914eb1d58ba8384de6fbda7e1
SHA512 deaeeeffdddea1a9047e97d82e3bb701fb865adcd77ef9e985bb0ec5e4057155e7b83cad4f9f3dd256edf89f19d1075349cea5005dffff8420da4d0646be413a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_906393597\manifest.json
Size 53B
SHA256 0f8ee89c4a420bda691d058cdd96c874c2edeec84145c81c957e98d05e351d3c
MD5 b4d869dd7052d78d29b3e439565f1600
SHA1 caa2cfa31729f4348a02514eba0235e72b88ce5a
SHA512 1fda3488df8c43ad413b2e69a5e2292322fe837f7b27b88302b4e591e7e13fdceacb0af9b8bb92ca7c0d2b39abffc776c6cc35d18abb86ce91f55c719b43480e
MD5 SHA1 SHA512

Submit Download

memory/5124-1157-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1155-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1156-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1152-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1153-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1151-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1145-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1146-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1154-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download

memory/5124-1147-0x0000021C0E5F0000-0x0000021C0E5F1000-memory.dmp

Download