b42e97c12a39ea8ce7d889b1487f497de27a49549467fa8dbf9d8ac9cca9e8cc

Analysis

max time kernel
103s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2025, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10.7MB
Sample250915-emta5styfv
SHA256 b42e97c12a39ea8ce7d889b1487f497de27a49549467fa8dbf9d8ac9cca9e8cc
MD5 2a0955539bd323135dd9d1f0dc6cb965
SHA1 c444076370ff0453111a863ea68341f29cb5f605
SHA512 765c5901ecb08eb05a3a1095d555faf614adfa3de1117837ae56a3f8fd06e5066d2ae369d68c7a1c261ee5f0ca189a5b5b784940e8815f300d00b8e12eb80b6f
SSDEEP 49152:epj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1Rqo:
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery execution stealer

Malware Config

Signatures

Detected Nirsoft tools 24 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2312-7-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2312-9-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2312-10-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2312-15-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4392-17-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4392-19-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4392-20-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4392-23-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/348-31-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/348-34-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/348-33-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/348-36-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/948-40-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral1/memory/948-41-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral1/memory/4068-44-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral1/memory/4068-45-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral1/memory/4640-58-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/4640-59-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/4176-66-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral1/memory/4176-67-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral1/memory/3432-70-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/memory/3432-71-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/memory/3400-78-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral1/memory/3400-79-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/3400-78-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral1/memory/3400-79-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 20 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1524	chrome.exe
1604	msedge.exe
5608	msedge.exe
5684	msedge.exe
2876	chrome.exe
3908	chrome.exe
1444	chrome.exe
4020	chrome.exe
2632	chrome.exe
3444	msedge.exe
1332	msedge.exe
836	msedge.exe
1296	msedge.exe
3420	msedge.exe
5552	msedge.exe
5692	msedge.exe
768	chrome.exe
3724	chrome.exe
4708	chrome.exe
4320	chrome.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 2312	4448	file.exe	86
PID 4448 set thread context of 4392	4448	file.exe	87
PID 4448 set thread context of 2544	4448	file.exe	88
PID 4448 set thread context of 348	4448	file.exe	89
PID 4448 set thread context of 948	4448	file.exe	90
PID 4448 set thread context of 4068	4448	file.exe	94
PID 4448 set thread context of 4724	4448	file.exe	96
PID 4448 set thread context of 4640	4448	file.exe	98
PID 4448 set thread context of 3668	4448	file.exe	101
PID 4448 set thread context of 4176	4448	file.exe	102
PID 4448 set thread context of 3432	4448	file.exe	104
PID 4448 set thread context of 2516	4448	file.exe	105
PID 4448 set thread context of 3400	4448	file.exe	107

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5116	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134023826743826249"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3008489981-1977616533-741913813-1000\{F5816F7F-1143-41FD-A74D-A3C6815C8C82}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3008489981-1977616533-741913813-1000\{A44053F3-5C43-4C1E-BC9A-11A982D2CB95}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4448	file.exe
4448	file.exe
2312	grpconv.exe
2312	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4068	grpconv.exe
4448	file.exe
4448	file.exe
4640	grpconv.exe
4640	grpconv.exe
4448	file.exe
4448	file.exe
4448	file.exe
4448	file.exe
3400	grpconv.exe
3400	grpconv.exe
3400	grpconv.exe
3400	grpconv.exe
4448	file.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
1444	chrome.exe
1444	chrome.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
3908	chrome.exe
3908	chrome.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	file.exe
Token: SeDebugPrivilege	4640	grpconv.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1444	chrome.exe
3908	chrome.exe
1604	msedge.exe
1604	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2040	4448	file.exe	85
PID 4448 wrote to memory of 2040	4448	file.exe	85
PID 4448 wrote to memory of 2040	4448	file.exe	85
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 2312	4448	file.exe	86
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 4392	4448	file.exe	87
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 2544	4448	file.exe	88
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 348	4448	file.exe	89
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 948	4448	file.exe	90
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 4068	4448	file.exe	94
PID 4448 wrote to memory of 1884	4448	file.exe	95
PID 4448 wrote to memory of 1884	4448	file.exe	95
PID 4448 wrote to memory of 1884	4448	file.exe	95
PID 4448 wrote to memory of 4724	4448	file.exe	96
PID 4448 wrote to memory of 4724	4448	file.exe	96
PID 4448 wrote to memory of 4724	4448	file.exe	96
PID 4448 wrote to memory of 4724	4448	file.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20250915040355.txt"
  2⤵
  PID:2040
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20250915040355.html"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:348
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:948
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20250915040355.txt"
  2⤵
  PID:1884
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4724
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3668
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20250915040355.txt"
  2⤵
  PID:920
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3432
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20250915040355.txt"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_c0573233\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc44e2dcf8,0x7ffc44e2dd04,0x7ffc44e2dd10
      4⤵
      PID:2716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1972,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:3408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=1896,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1576 /prefetch:3
      4⤵
      PID:4032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2292,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2156 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2868,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2864 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2972,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2968 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3700,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3200 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4020,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2780 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4620,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4616 /prefetch:8
      4⤵
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4716,i,17378357399001385304,9952148234120030050,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4712 /prefetch:8
      4⤵
      PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc44e2dcf8,0x7ffc44e2dd04,0x7ffc44e2dd10
      4⤵
      PID:4432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1988,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:2400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2072,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1600 /prefetch:3
      4⤵
      PID:2840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2500,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2704 /prefetch:8
      4⤵
      PID:2396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2972,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3728 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3988,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4080 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4604,i,3328643445079081982,5406975547075698410,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4600 /prefetch:8
      4⤵
      PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x254,0x258,0x25c,0x250,0x278,0x7ffc44e0f208,0x7ffc44e0f214,0x7ffc44e0f220
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2188,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2196,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2508,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3316,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3424,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3752,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3872,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3272,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:8
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4584,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4524,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4704,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5268,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5268,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5392,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5452,i,3220251323284935248,2618514011633813947,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x254,0x258,0x25c,0x250,0x278,0x7ffc44e0f208,0x7ffc44e0f214,0x7ffc44e0f220
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2208,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2296,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2976,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3280,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3708,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3740,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4524,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4604,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4744,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4792,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5520,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5520,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5660,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5716,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5936,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5960,i,3802705184309316233,4787664308831575302,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
      4⤵
      PID:5764

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3512

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dd1402c45f273ef199039dc9bc0bab6b9c696ce68dba9178a50871a004ed9880
MD5 6a50de5217a4231e74e0581344c314da
SHA1 203c2f00a4a341182c998ab6e7575a8332baee2f
SHA512 a4f6263d496c31a1061ac24519d89d7b892e09a23acafdb0734da8ab612daf20f0d5c30460ab6e7d66bc4cdd93f8667f7fb79b0b68bf68ec3cdde00f78d6de44
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ae1836b60767add777bdf404a00835851b9bab4d58891aea4ae75f31b793e79e
MD5 442e20004199e41b72c91948c6261625
SHA1 b54140fedfc80962e81062494af2029341728286
SHA512 95b9b589cf1b8ab6469f1985285d65d95cee0ca9f03e080b584d7d1fb745525d10ce9944742e7bd320e32537151be9685958a3dea0bfc4e7b09953eff0cee843
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d598df1a3bf66c17c162eed4ede23dcbf833f71d68b715789e5dc71526568920
MD5 9b5bf8b0eed5f014bce1210803e92873
SHA1 bc013a8a5dae0f4f8cb81b29c25f9c9d1bdbfbe8
SHA512 e61d5e86abb6a175bb0eabb982fb155cad81a10ccde1cb659c3b94a348822945beba1689a5d1c8170cd1699ed49b8316ee0a0ffb3b061e21b299d8cd9edb14f4
SSDEEP 12:dMBseqBKC942FwxXlLJuIeyStCfOF6wPIkE//:dRwEvFwxXloIe1CfOF6UhE//
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 24ed646a3a95117255e7e44eba16004677148f8ad6c1997141edff3fdc373fea
MD5 d74e2bf6a4a97d5fb813d95354ea6aa1
SHA1 464baaa34c45da0fbb05a1dbc4c4768986c92c33
SHA512 72c56d18e9a0625bd42a4656700b2fd353aa5e59ab93b805fa6fe964b85af7bf5c83fe28a1a38c431fd51c275c1a044b1ab8954f92413a4e4b74b84ee5a94ca8
SSDEEP 96:eXF9X/gpUjD5PDqSCyba30Xfpp/gmDWBaa0YL:ev2CZ34IL3jG
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 1ad370024ab15727680027d6b324ddf4239ce8a4ed7564f03e23eaf62d71203e
MD5 097d63884b018853a6dcfc5ef967e44c
SHA1 bfcec0264398791d7d38abd181d074fd174005e7
SHA512 0bf4b5c95fa60e54a18206d5050cd2e180e30d1b869c455f5c320ca67d7acfdeac56ee8c0931381146e63434a3675164c23fafcd876cf25072e344c1b4a0b7fc
SSDEEP 96:NdxoyojEKTEHmuQUT+KU2nsmAqIAr+B7GHzudBmy82QR2RXuQ0dH4eU:NdefjHsoK1HNy9GCdBZ82QRzTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 3540e6c0cbae36f0e52c3f198933092135701ca0dc17918d68405eec90fb86b6
MD5 a41ed1ca897bd2d0034dc2de90fd6fe3
SHA1 1b0478248008df1deeed31bb3c7985cf424e083e
SHA512 76cabfe2abad03b40f6ac60d62482f1f19cb3d9dba19410cdca21155c317b5b9708c498a02cc40e2054a9f374a30063b4944aff9f29c0de7ec4cb1257c01d3e8
SSDEEP 768:gUfDPLSgcRUv+so4KQ4Kujb4Ojb4Ljb4f4DfDPLSgcRUv+bo4YUfDPLSgcRUv+Qr:2agHXH2HGcfn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 34KB
SHA256 9641ccc6a7dc385bddb520aa4433a235b34463e5d272305bac7af1c913f7c967
MD5 14a378acc2f3c5cd039c3562ba5d8dfa
SHA1 5930bfa159869bffb0848c7353212274ed285c31
SHA512 505b385617b80b080df86a25d680b1611e6bc8fd4fc8703a2d4db602ca5264f640c72d9575298f518ae6d30ed36879d0c89406c5b0bafc2b04dea969e63591b7
SSDEEP 768:EFqNiKDiWsiOmtOwsSgLmeUY8q4SYIWWefl1zZTecYRMkb0PV1tYRcPgKf:EgNiY1qLBH8qhsJl196cYRMkbC1GagKf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 68KB
SHA256 569194375d5d79d291195610ec5719bb42a1cb42f58873ee4b62d9beaae54832
MD5 713908d970d7a738f4831a564abd6397
SHA1 4b6cfdca613d695218d481d4ba7f591f759e4507
SHA512 4e7476a3731a6551983b6aa32fe72d58d97d6825f6fbfffc8ca846abbaf610250d857766e8703dfeeadf8f9b2db3f846076045a2db3ccf435723cb444dfe0619
SSDEEP 1536:C+DwDqrDkQ4IU08bp8OBuwWQIYaDnCCdYXGLr/Mqu14UFsvXR5xRn8i:HwagtIj08MY1jXr/ZWzsZvRnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 38KB
SHA256 420ca2eaa32a22f339066e6879d75a60848f8833bb4f10c3ad10a2da78adf04f
MD5 32305e20df23cddaa5ae886b97ba6170
SHA1 461d0572662dea04eada8017b97e2bdeb023b475
SHA512 9763137e96925327189a4cc2fa234fb89342b0f34339ca2bec5baf95b810c6b2b4ce40905224ecd7759cae0fe5c2dcbbc876a509e86a8cd67a6d49d772d73123
SSDEEP 768:vta8A+3yJu2PsUex0BUePLOKRf0peBavs6h88SQxkGxkqDPQIFCvUUPAAnqW1:vE3+CJZURx0BrPcs6m8jDxkqzQIxUPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 bf4b797806406726c9845538ec58308ae8b156326ce92cd40b450324362f6ce9
MD5 816bd76412e0e442deec1910dbd9e06f
SHA1 0a415c1b43011e1a5fdcb1b7cb555e2a771c83d9
SHA512 389186aed75ea3deeba171ce53661418744d938d8c8903f8f0e9dea16b862b0d74e29df09792adf9ee8d0cc4b2cabf66fdc78ae9ba4a2e195cda161e77277adc
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 404B
SHA256 4fe011dbf3f162d99a9581a20dc7c06f8640dcd36d9bcf409777dfebb4cb3a12
MD5 ee39e11eb875c128510bdf964b6c1b74
SHA1 f1ae7e3206d31c49b3ad31a3429f7e3648562162
SHA512 ad6baab5b4473ec6927defafdd98e64a4b33210872a7a31dc5b0fe3a78dbe19301ed98aba6697b9c13dc031cef579f029bb615377a133856b8803a7793b5a5c6
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 3d5004ed525385d175cc5bf7dc0a32e08a78f66c68532817f25f2f1181486e7d
MD5 4d409c83543f602323be9785b853fb8c
SHA1 60632503ffea37403ca77b783b5785fcf1b73f02
SHA512 c3cc90f5daaff2221ab8a9fdd5ab0f9900bd5f5e992a75c18d53bdcd9cb6b318fd6844424193d2ecdee3e1263e99135e2b12c5dbd18702c2e21998679ea38776
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 f6589ecd19f386cab2cb873c6f3ef10d2150cfac1410636edd1a6ef48b9f1766
MD5 145c92e04a3fe5f3f693b863cf00dbbc
SHA1 d80a5bff35ab61d4dd9b5368d2a3102d3560df9e
SHA512 deaa744f34ff26d9a44999a2d8bc0f6023e880acb829142bec665ef01a5afa39f487c24f06da0e5429d36a0800e58f8cb227b1cbc75ef715c074705f97cbd03e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 8e5be95a8c9951aa66de9ea776ea6d1063cfc61160f0539143ba2d7ea328e37f
MD5 36624dda9894d87ab68134fb4519d83c
SHA1 86c6d26109f52c2b1a6997558a9d941d2ccc8de3
SHA512 e7ff73478d4d3f4998e8dd52ff25dec83ff0be4132e089591dd3713f0ccc41e9780ef321da401de511730383164880bf494cf5781b6791a5c9bbd852cb9926ac
MD5 SHA1 SHA512

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 134KB
SHA256 7fda253852fe2a2d6c35110ee3e19b4dc408bf1d77cefe42532577620f867d9e
MD5 3c276922baf53c319d7928765415122b
SHA1 58735e8f269db7ea4db915a0b69a6d8b75f38e15
SHA512 256458461311409f0bd045f4d917252252b784ab44a86252b5a20b2a06efc394ffcbfcb714fa5fbd6fb7431f0278213739905eb89a3f827eb6dda1a99ae01bca
SSDEEP 1536:VH4ZbTiQ0KXQeeb5xFrQN7xYXWTK3UwmKJZLc7kGigSNRH06klUpdGsTPl4YDE6V:2b6xDXWLKJS7YUHlUqsTVDgFN0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 352KB
SHA256 cd0a40eddf12003cd6ef3717cb7921140987c2fd45d9644f5e0441722ea21466
MD5 9c67ac885d5fbd3395c3b84ce7f1a751
SHA1 94610dc29817e910f99eb0f8b23f66f502a1a11f
SHA512 9e83351705c25457740e21489fc97dc775b1d495891c2377eea498e671c07962b7074e84486e5b417d7bcfe81ba51cd7e6c0090bcadb869d109cd12d739fee72
SSDEEP 6144:WIlPxS3vG/zvAtSSja0zsrPHqBRFCn1DfCYHRhm:WIlsvG/zvAttHsTHobu1bbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 0e730db91197b478dee4a67cb754f2e4a3e8b458e4ce1878e8ae36fccb105431
MD5 1dce8e62ef55ed215694b7d1601eec25
SHA1 4a8f23c73df434709a34639597cc8b9193141379
SHA512 7e98357c3192894ae3f7f1512884e3b26d2f7d999b143db23fc7e12f8eac82d878b765b3fa7921a9aced24e81c56d29610e4ff6d89adcf66b6aba54b6f333f5b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 ec67eefbafc3ad90ece13a371bcb61017825e6cb031f8c5bd09620e86ef4723e
MD5 1afff55319e264957e135765c6cb209a
SHA1 c55070294a4b68eae8ccc7367c36e9605aa847be
SHA512 10b90f64b8e2a41b1ff2ef27d914f5b2242bd14c0b76ff384ebe97d4d758ab287869dbc9e2177c2d2bafd4e524e13044f3cc136468fb53f643dd233a635088c6
MD5 SHA1 SHA512

Submit Download

Session_13402382674367212

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13402382674367212
Size 2KB
SHA256 f746fbbca885dbf25acd51c4b35a4364fc5fbc3d875ef7522f10ba433b04721a
MD5 b91f1358dfccfa4e70ebdc3d7ca145d6
SHA1 09d0ea99ff599e1bb04163c1a87adced1c0cb1e2
SHA512 974a685b895b1377fe98ad6e67dff8f33668ec1d2a089a8ba584301274cb4bca629cfc563674d8fe75382ce6f506dc8726ee6174cfd61faa989ccf07092883a0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 3962c451e19a3c88b17d964fc9773c83259c0d5ff5d4fd96b2d4cd89adfd911b
MD5 d78c90a6000fb1fe3925ead5d0bc4d80
SHA1 5a077e78b646bb3dc57b4b4d98e98e53130206a2
SHA512 6a74a3f03bff2b4682d3ed46964c178c8893881717c8068b48a7eedaca896fb2e13b2c2f81026bc5df9db1d0c186a4c0cbeacf75e83379f1ed8468273099367f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 ca00d7c34a19a54c8cbbcdcb00451d8cb7a55960ee7a4c83a53e64f71b6a8222
MD5 ff072b3ef79812d8858d35225dc37262
SHA1 3d78fa44fb874c951d2216ab995788f87b3e38cb
SHA512 3bf08461da8cccfd781e2dc69e90a78fa5fa4c3787b838e3d228b5e77e2da39eca7615318e7626cff759d798685f3df9cd467a39ac799f124e3eea475eb831ce
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 130KB
SHA256 a7f845e0b7ecb05ed7eba858c157ab77c920eede8fee41c44bcad58b585b5f43
MD5 d6fa845eb1eb0e15f60a30f24ae97039
SHA1 e9d2fd1f5b9e9ba50c42791d362d5c9e68729170
SHA512 33986dc1dd784537d4988299ba373f9491c387e20c2c984a5da7ba99a450a5915b3241a5fd53c0faec96ac555d59a529138f3abfac583680f957ad1dab0eb78b
SSDEEP 192:oB4BvnXuvkUUo4nVaIvsb5wSUavpX6NqhVumT:iovXuvepnkIvsb5wSUExVumT
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 37c6d182e093b53586a5fc396da7a4e919077d5a3ef3ea5028b2664d7271f55b
MD5 4e4927066401f97fea46be244f5df7ad
SHA1 6725a73aa4dadbbbbe101af828e4620b32c1614c
SHA512 ea864a4d86c6ee6bbdb36e9c6f5e54c64ada05c0903e8bb99aec85373025d14154727525cf73c49303ea9d4997a5ff2c76405ac6a62d9f0ae60ac247fcee1d9a
SSDEEP 3:Y/9lNllv/etXlBO+zll+qg/G9EZtaXM/RuW3Kb6z/LMQ/iHKb6z/LMQ42FQKbr7L:Yql3MLWc/XKuqHKu42zf7ZVoLlTVo
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 24KB
SHA256 5ec17b0c13e0c698d8c557f0c1815e90a7d6dca85041d87bf7ae6c58dcb01fee
MD5 3180cd605c33085db64cccf6b9810f27
SHA1 2511eb13b7eb9448995a5e769528484917839a06
SHA512 0c4917224d7b0ea951852bf458f3c779bc94ccccfad3142e05484f308bf74fd3b8b36d855eb38c5eed3f185595fbe36e452341f62df8b275ce61808b6f7b15d4
SSDEEP 384:aNoOsdGwibs2q4hQgIIIPbLMIM3HBbJIDfxsdG+r9FY8sdGoZZqs5sdGbdGC2qMH:vidhQZOr0ZNlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 08647df6bbf820bc4d32d8296faacd566f107bbb7be05f0a17918b8e0c98eb61
MD5 03a627a341b86cf2038aa78a2f15e5a8
SHA1 2df3838f973dea63263fe425e99e0bebc65d9027
SHA512 b1350c01a7552164bccfd825c3987ab3303719fb8382afc4c191307294b04ced1169bf3bd3fabb5c5ea4697f5eceb29abd54ebdfe044025fc568ed64b1e4e356
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 753cc0e6955a034401ac1dbefdd34f7f111ca8ef5b9aaf34cf8a4e35a99f0562
MD5 4b7a894765634428046063a45d2f37e1
SHA1 d40d7fd4ac88335da4c89de4c58a48aa58074be0
SHA512 b0cf592b9fac281ebdd72e7499f77ac436d884f1df173cfda3e42f5c32fb3f2e5b566ad596189fa0d8198dabc56950d4e40f1f3e27047da7c28111f974daf5aa
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 5a6bd8c7ddf465222449726795552a2cb9e346297b70c7b0e3cc95ec5e8a0856
MD5 060f7e7451b8d16fa6ac6ae534baad85
SHA1 24cc152ebb16f9c964836b711c82ed0123868697
SHA512 fc0023aa0eec09eca0fb73e5e20cdbde56e2191bec5c592689a1e1a32f99056834818bf81b5efb8d3bd4653fb00cf7529f80d13abf561d3ee78eca57f93b371d
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 a88f5bc3e60fac6e4176171d1c4ed307f322518fb620ffdeecc4db5e8f44e50c
MD5 550754462af03033ed1d785e82aef2a3
SHA1 574de05db8ca0e33b86ebbffe725938440ee9b91
SHA512 086753488126d17e879f9152cb2d88ec1f029d885f09e81d9f8b291ed348393a9d40660bae90af028f66ad29dcd19f3950e70d93257242f9040fb049557d90df
SSDEEP 1536:sprdXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMX:yZXjM4rTmN5eWvStRNoV8cWK7XF+TwMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5cb646a887ad790c27b700c50b39c89faeaf5cd1a4296f101aabb73c000d2140
MD5 3e89f140484351251d7e37c6882b68ef
SHA1 3ec2e5fcaaf7037c2546a8d35f3d5696ad1bc32e
SHA512 c0ab382972e4e42e930c78ab6995d9885832c6b673001038e8bf9a6a86e5092aff47a4db46146de35cb87817e12287d75803bfb41ba7de56b926977d63956638
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 521142680d67ffc710d6dc921740415e840768dc0fcdb1a72b80e6d55b6355db
MD5 2c331f389c779c8c38854c792db3bdaf
SHA1 9dbc270547d3316ff08f06d22b30251faf040341
SHA512 8a590ee501dc40bfb757de9c314be7d65d3117c8245094bf7d92bd469b11f9fb34261d5f9c3a96001fdb79a673467dfd79db3b07b3f52187d58b352dd3a21576
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 158d2342005ff1f3899cb5b55a034923f148de3a55f2d83170f21d3078ca8f9e
MD5 d1568f489cbb1428c8aeed605dad7405
SHA1 5d847bbbb87c7569b89673e1c389b512f1e948d1
SHA512 4749e72e7c3b6e47191e01985eecd61ba7aad90b4c3be30a4b057707eb58f5401aa53394995b8bd55d01639ef04a7241a4a478a25ab29cbda3dcd750164d4a74
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cf22cf1cd06a6fbd109e21279ab1fb14412eb44dffbc1799c3ee70852c7351cf
MD5 ddaa4a0a3578a31948213ff595190621
SHA1 a9141a70a014d8027d997cc2cfa095f6ce21e0d9
SHA512 7af574b76500165da71d6878148f1a970af2bd274fcdbffa0791c0c1ce0e3866495fd68cba012cb8a536a38258b16282785d6dda0f368f016c03d07235ff6f09
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8f07f2beb15bf1db92b243ffc3ebaa47606bfc037d0b6c0fbe83a725bab2afb6
MD5 39634af801eef80ae5919ec648fd99e1
SHA1 570c60d020448e794cedf1817ec898515fe27fa3
SHA512 5af1f801239dbef0ac815663fbf99ead1cc29a6a987dd1e0ad0abd56c595715e81bc4ac4a597bdd585a774d740a0621f3f31af5133c60ea4871027612f93fbb6
MD5 SHA1 SHA512

Submit Download

7cdfbce4-3224-4ab1-aeea-ddcc297084bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7cdfbce4-3224-4ab1-aeea-ddcc297084bf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0ffba06-09e4-4ff5-880d-d33bdc0b5e13\index-dir\the-real-index
Size 1KB
SHA256 516a4365ff0f210fd3fd1eb83227e9159c9ab8df74613a7ffb1bb96c69334b3f
MD5 f9406152edd40e428160f14d734a8fcd
SHA1 ba4583ed084cf8cf368b341fdbfeef6f2010e41e
SHA512 afa4bd86bd8d6b31015efaffa79292a48e80cfe9b0d4627651cf4a3126785af50cd717f3e3ed55e4544f4f1df73e0fb15df0f3a3d79c5d93ba1ca9c9cacd4da0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0ffba06-09e4-4ff5-880d-d33bdc0b5e13\index-dir\the-real-index
Size 2KB
SHA256 a03dfa772fb1674813623529c95aed3f1daecf0a36c453a6fee62ba1f6c26bf5
MD5 58cba65e8bde897be73a15b546d7fef4
SHA1 b21e80800adbd2ed52a62b9c3a20fc266de491d7
SHA512 429089a27ec69b34592c80a3afa873f1dde3b815c209790722d688570c82fab9ac97cde684602d8db7056ac06ad5beef1afa1fcd28f7276645fcae19e2f2eac2
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5848db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0ffba06-09e4-4ff5-880d-d33bdc0b5e13\index-dir\the-real-index~RFe5848db.TMP
Size 1KB
SHA256 0c76413c7f9ce566a7aaeb5c746d9cf1f842e03c6b34a14ba15c01bd9bf28acc
MD5 ed6da5afd2320481687f09d23b6072e3
SHA1 59adc793599748d0a33fe3363702dc851bca61b1
SHA512 57372bc093522e1a00ad9c339097dcd8773b885f116dfe24b8bf88229f00cddc7cb5276e86ab8e90438ecfc30fee9825897ceb760a7626777366406461924e7b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe586414.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0ffba06-09e4-4ff5-880d-d33bdc0b5e13\index-dir\the-real-index~RFe586414.TMP
Size 2KB
SHA256 dc4ff33e552c7b6549d389d81435f6a4de98b3c24a2c72ec635b8f4f6662f27c
MD5 2be099b3abda5c675fd552cb5631c216
SHA1 9a25ccdd010d53cec924c8d5131ee450c699cf3b
SHA512 8b01abfaeac1628fb72d6df04871143fa562f85811c5e35c8db682ac7f10d7cffe1e1a743bbf99ae22e4b7428c5a65ae21f30ed75ee899c91fa0209b56173694
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d3c72bb272df2609528b51a9bd337c5a2c34f4a6b4070b87da91acf4b9ca68a5
MD5 8844411072cf971d6eedf8f03e9ed90b
SHA1 0a8fc9aa7c0a25e5aa8e355e32d1088c4e9f5e7a
SHA512 9fffe12e0204a4e3f1525a592b8c259580431532a7469cb3aa36a6437a8577bb149ccc6c5c424395dc260ce953cdc4d16d09ffc5a0abb06b7e8f8dcf063b8480
SSDEEP 48:6Ip84eKW0WqPkQ0K0KWkJP+TYpytyKBTyRfK+DibmC8kk+C0ND:BaK92yKdSfK/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 c1229ac216ebe685c5a1268f9a9c4949d0f967e3e5d2a95f71559271fe69865f
MD5 1ce76d8a1b421a6ee96e31861804527f
SHA1 31516561f0942d63f2a3aab346730b21c782e184
SHA512 a0e5e17dfc5307e7723e7c2acbdda5d0cb2a5d4fc2d01fe4b24586006e1adae02fd2d0863b1a8f6cc23eeb7ecf803f57698dcd74e25bb6467306e7d09e555ae8
SSDEEP 96:kqONkCyUfhKCDV/05ih/cIVURLl8RotoV456FDYBnPdvg5EB/JGgMMoQPnrb12U2:PONbygThWiRUz+sPPpJfMhQPn312DTv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0deb94166c50b81223e30793a10a7ca81b8beeb9daf6bc70a4fed307e993f331
MD5 a0c3d1de8301a4673f131858a19d3e78
SHA1 409caa7a348304fdabd4677d90fb1f3b786131b9
SHA512 22295eafed35826b70dbab7369bfbe6ee8ac1a155d3e135777b12070a027617bb656b89675124c4fbdc1ffa7b1edb7fcfc726e9c91718f8fe1ddfbbd049cfa1f
SSDEEP 192:PONbygThWiRUzHsPPpJfMhQPngmfY9OOVUr:PONby6dPxJfyQfgmcpVUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 b5a0b134d97a763820552d9a1b2c7203c547fedf10643edc110cceff6cedfdc4
MD5 8a4538897c76527d5aa6159f571f1865
SHA1 93bf2c21d106b96fe3718bdc2ec3923b3200a10f
SHA512 780f93ec6715baee156926a2782ffa62a0bc7262e6840ad6de0793a574a21b71b79acaf27a3ba345c5ec44df095adbadcf2ae43742aee4fe7bd2a00c343283ba
SSDEEP 96:8qONkCyUfhKCDV705ih/cIVURLl8Rotop56fDYBPPdvg5EB/JGgMPvXUe4mJrk4z:nONbygTdWiRUyisXPpJfMPvXDrBjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6dbde128d571aca24f2d829ba54fbba7297a13c07eb0600b17e0586136918e41
MD5 02fe2d5135e5b750fc5e5f45fcfa7bb2
SHA1 7422352bc36c3519e3d5dc9f0a5d5e7918c315d1
SHA512 26aa6565948671bbcaf57829ea442a7dfa353e7963d30e6d949804fab507a120b986cd518f63f31dee6d38438e60651d3208bc8be0d75297d83b5050b591d3f3
MD5 SHA1 SHA512

Submit Download

cookieextract.ps1

Path C:\Users\Admin\AppData\Local\Temp\CookieExtractor_c0573233\cookieextract.ps1
Size 9KB
SHA256 7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb
MD5 efb5f106eee5ab6f38797adb2de2f822
SHA1 cfc7a8c241c7f37faabe27084a30c629317d3f71
SHA512 0cbced89acf86c82f58fba9a1aeaccd611f8136c6e03e64ca868c6f3523ffb42c6af9a74345d03c5255706d1ee35844ebb61631fea8ffac42649dc087a2fa712
SSDEEP 192:uEQ3KqHzxZS6dHBdN6UyrpCcANLLtSa8Yr8+nlisBssqPjxX92:hEHDS6d/oUyru8YUsBRqPjxX92
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_30jdmgdl.qw2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30jdmgdl.qw2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bhvE3E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvE3E8.tmp
Size 14.0MB
SHA256 6f5f8fc49d59fe192be48c6cde9be7cc79c18c6b142a2f8276b9502314c812f7
MD5 8d27531e273965781075c5fc234cb43e
SHA1 8871a83d6f2dc5dcc68e529f120eec97648cd8b9
SHA512 7cf93f17a4305c7e62cd7b7e05bd1c6ab3d044be4538096a4f15db95028905d8eb9601549e1b4303eedc29dcf12d32d1e84c198463472bcaad7cb902147796a2
SSDEEP 6144:XWY5iAYkMh6KGPtuLuAqCYVwSXEL2Ea35bHtuofBNNldGXjjhZYeUqYvCuPudms6:o9XyqYvCuPudmsiZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5c7ac20-6368-4e05-bef9-1f40e6f683bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\c5c7ac20-6368-4e05-bef9-1f40e6f683bd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc7e9822-031e-4f21-b918-e0614c5287ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1604_2047030514\cc7e9822-031e-4f21-b918-e0614c5287ca.tmp
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AllPasswords-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\AllPasswords-output_20250915040355.txt
Size 4KB
SHA256 1b09e4526d08d942928d00a15d18d3fe7c21b1a56aaa81d045a4c8ea2cd9ac6c
MD5 a2d42eb4d090dd8778eaaf0458cc3a36
SHA1 38dc135e51f0efdf7d9c6992f8ed3d1977865348
SHA512 af89ec7e55dbc578e8e1ad9896481158cccfbfe07a349ead3afe7e70818c9523e4057f3b54bab6db5ec0582a8a831fbd04bf1e9eab3083327298c672522ade52
SSDEEP 48:wvvv0qrUxfvvcqrUxfdvv0qrUxBvv0qrUxakvv0qrU7:mvRrUxvprUp1vRrUPvRrUbvRrU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternativeEdgeCookies-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20250915040355.txt
Size 15KB
SHA256 d2ae11c49fc74d4fc40e08bdae962769b114e89b72545a670b09f47652c456b4
MD5 5fab07d323a1b41dedc7e37fc3b2ceb5
SHA1 99be4e2ed4cac69d4cd01915846fef9990f410ad
SHA512 4d4d307b8e101a4422f148a636e8aab5c0c560de1be92042278837baa2eff0e851c544358adb810cb6194a91ded8b4bcd3e1446245e51388095384b03562b868
SSDEEP 192:cOSqo8lOallH5ba5axaueZOihvTxilO5jZalQa2gfE4wfErh:3AtC5+k8xgiZ9n5F36MlMl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bookmarks-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20250915040355.txt
Size 4KB
SHA256 8dae5baf8f52a28005134ca52c0f0328c8a3b744ee55a306099a58e4e9671b05
MD5 a22587d320c8a2d5e7055f496c36b765
SHA1 d7908019dbfe6d6097b55246277b17fed3fd0a70
SHA512 2d861cd34ec449779a8822ea6b8aae4e7dd9f62e1a27ac2f81a1d21743cafe2f62ba9fa7a2b44e82d365851cd710fdb5db2bf17fe7da7932f9646b596bfd0507
SSDEEP 96:eVhstK3hmnT6cQYGTVDstq+clhD4VSstqXhFAVwstDFhm:eV6GH7YGTVoQHlSVx2cVD7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChromeV20-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20250915040355.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExtensionsView-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20250915040355.txt
Size 33KB
SHA256 771c274db4b5b832fa9c27c1b99acaa8c9a7f9dff9018d67368668d769cb83bb
MD5 66618c9952cf68eecad1d076efe44ae6
SHA1 6a3c06a01bd2cfebb13486682b803d006d8dae9c
SHA512 582ebced189750a6ac414b96103f59bc167ea4dfffe50cbb28c23febad773f7a77edbacfbee069f78abb45b94ed339715253fda2ffde2619c55f196fd92e3be6
SSDEEP 768:m1zszdDzrzlzVnTzIh5w6nTzdnazBknuz3nTz5M0NMheaHjc9EccRmL6wv7RfvRc:m1QJDnJ5nTk/LnThna6nubnT1McMEaDr
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstalledApps-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20250915040355.txt
Size 140KB
SHA256 ccc6bf4aceadac743ba7ff9b86c702d920a242feca6a36b7e358aba600bc38a6
MD5 bbae73edb1b7aeab624bf6c894d08017
SHA1 7b5d6fb1dcbb34bd9468ed743d76e9fec6870e81
SHA512 557944632a16346847d18af3959d45b39e709b9105551105f26fd75233b28fe9a9147f91f5cd2e86ac0762934ea40629f003bdd00d781aba9bc70ab959dfe0a8
SSDEEP 3072:BtZmMXFMVuQo0qz0hVEW6WgUb/OXtb46ZLZqCBZnzW9+I6aP4q4fQLcXdI8f:hb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKeys-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ProductKeys-output_20250915040355.txt
Size 774B
SHA256 8e5e5034a55fa9153ed15cfd149244b0a74bb290cc45432f3140491384605c27
MD5 e950da0bbe85672b06e3bb70253ba94f
SHA1 04bc7a0d6dffc776b36d4b775fea9a992701270e
SHA512 f1fa820d06ace02c281a1315eaebbc96c8a5771f9bffb551045afbe6aa8bee6e93ed901b0b9e36b4e94a5db0bc512b978bc0445a4feff70d4276c005c642b611
MD5 SHA1 SHA512

Submit Download

WorkingTasks-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20250915040355.txt
Size 10KB
SHA256 1c6f570e74eff9f3f2f04a85b713138bc3238ee14ea4f2e3e99b4ca6c67f279e
MD5 7332a0427c162dd1a3639b787c2bbe5e
SHA1 00058df2a96d93943f0a40a533d88eed63d31a0c
SHA512 bec192a014262f52f70df635dd146874685c8cf32b94ccfe0f8622ef61775c814e605ec1ab08695dfdcc731146781f937562bc7e4f6ec375b8efcc7138500822
SSDEEP 192:3VCE15bWXekcSVC915bWXR3rPVyY15bWX495cV9915bWXesRVUh1obWX4NCLLVjn:FCE15bWXHC915bWXHyY15bWXH9915bWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

watch-output_20250915040355.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20250915040355.html
Size 3KB
SHA256 90f4241a2e0a7aa3484645f1600f2985588ecd76fb95b36b2df669c3c77ff827
MD5 b0d7f8c7974fee0d207efb9e13d50b4a
SHA1 e082a6e279e3263a9c9092462517fc70328f505e
SHA512 1c1846cee5982a78efa37979891f0cb94f8bd02e5b2fa74d543a870d82726e9fdaf9789bc1950fde9dbc2f1020f244250ec1c94fd83b7e677e767b97703b3d5c
MD5 SHA1 SHA512

Submit Download

memory/348-34-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/348-33-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/348-31-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/348-36-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/948-41-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/948-40-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2312-7-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2312-9-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2312-10-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2312-15-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2516-75-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/2516-74-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/2544-26-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2544-29-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2544-27-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2544-24-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3400-79-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3400-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3432-70-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3432-71-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3668-62-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3668-63-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4068-45-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/4068-44-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/4176-66-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4176-67-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4392-17-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4392-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4392-20-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4392-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4448-3-0x0000000001710000-0x0000000001716000-memory.dmp

Download

memory/4448-6-0x0000000006180000-0x0000000006212000-memory.dmp

Download

memory/4448-5-0x0000000005670000-0x000000000567A000-memory.dmp

Download

memory/4448-4-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/4448-0-0x00000000001C0000-0x0000000000C7C000-memory.dmp

Download

memory/4448-37-0x0000000005610000-0x0000000005620000-memory.dmp

Download

memory/4448-2-0x0000000005610000-0x0000000005620000-memory.dmp

Download

memory/4448-1-0x0000000005BD0000-0x0000000006174000-memory.dmp

Download

memory/4448-1178-0x00000000011F0000-0x0000000001202000-memory.dmp

Download

memory/4640-58-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4640-59-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4724-54-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4724-55-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5116-117-0x0000000005760000-0x0000000005AB4000-memory.dmp

Download

memory/5116-104-0x0000000004790000-0x00000000047C6000-memory.dmp

Download

memory/5116-105-0x0000000004F30000-0x0000000005558000-memory.dmp

Download

memory/5116-106-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Download

memory/5116-107-0x0000000005560000-0x00000000055C6000-memory.dmp

Download

memory/5116-169-0x0000000008C20000-0x000000000914C000-memory.dmp

Download

memory/5116-118-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Download

memory/5116-119-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Download

memory/5116-121-0x00000000074C0000-0x0000000007B3A000-memory.dmp

Download

memory/5116-122-0x00000000062A0000-0x00000000062BA000-memory.dmp

Download

memory/5116-123-0x0000000006E40000-0x0000000006ED6000-memory.dmp

Download

memory/5116-124-0x0000000006D40000-0x0000000006D62000-memory.dmp

Download

memory/5116-168-0x0000000008520000-0x00000000086E2000-memory.dmp

Download