hxxps://www[.]mediafire[.]com/folder/h1ehwnjwsb1q1/Velocity

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/h1ehwnjwsb1q1/Velocity
Sample260418-e9mrwagx51

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
509	4720	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
5188	OperaGXSetup.exe
436	installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3508	msedge.exe
4720	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209607212049816"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{8D4EE86F-BAA0-4D25-98D2-D5E64EEF0519}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{1BE14269-4240-461C-9D96-098DD76B338A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
5932	chrome.exe
5932	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4128	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4128	OpenWith.exe
4492	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3932	396	msedge.exe	85
PID 396 wrote to memory of 3508	396	msedge.exe	87
PID 396 wrote to memory of 1424	396	msedge.exe	88
PID 396 wrote to memory of 1424	396	msedge.exe	88
PID 396 wrote to memory of 1424	396	msedge.exe	88
PID 396 wrote to memory of 2336	396	msedge.exe	89
PID 396 wrote to memory of 2336	396	msedge.exe	89
PID 396 wrote to memory of 1640	396	msedge.exe	90
PID 396 wrote to memory of 1808	396	msedge.exe	91
PID 396 wrote to memory of 1640	396	msedge.exe	90
PID 396 wrote to memory of 1640	396	msedge.exe	90
PID 396 wrote to memory of 1808	396	msedge.exe	91
PID 396 wrote to memory of 1808	396	msedge.exe	91
PID 396 wrote to memory of 2768	396	msedge.exe	92
PID 396 wrote to memory of 2768	396	msedge.exe	92
PID 396 wrote to memory of 2768	396	msedge.exe	92
PID 396 wrote to memory of 1520	396	msedge.exe	93
PID 396 wrote to memory of 1520	396	msedge.exe	93
PID 396 wrote to memory of 1520	396	msedge.exe	93
PID 396 wrote to memory of 3512	396	msedge.exe	96
PID 396 wrote to memory of 3512	396	msedge.exe	96
PID 396 wrote to memory of 4744	396	msedge.exe	98
PID 396 wrote to memory of 4744	396	msedge.exe	98
PID 396 wrote to memory of 3084	396	msedge.exe	99
PID 396 wrote to memory of 828	396	msedge.exe	100
PID 396 wrote to memory of 3084	396	msedge.exe	99
PID 396 wrote to memory of 828	396	msedge.exe	100
PID 396 wrote to memory of 3708	396	msedge.exe	101
PID 396 wrote to memory of 3708	396	msedge.exe	101
PID 396 wrote to memory of 3708	396	msedge.exe	101
PID 396 wrote to memory of 2188	396	msedge.exe	103
PID 396 wrote to memory of 2764	396	msedge.exe	104
PID 396 wrote to memory of 2764	396	msedge.exe	104
PID 396 wrote to memory of 4184	396	msedge.exe	105
PID 396 wrote to memory of 4184	396	msedge.exe	105
PID 396 wrote to memory of 2484	396	msedge.exe	106
PID 396 wrote to memory of 4776	396	msedge.exe	107
PID 396 wrote to memory of 2484	396	msedge.exe	106
PID 396 wrote to memory of 4776	396	msedge.exe	107
PID 396 wrote to memory of 4768	396	msedge.exe	108
PID 396 wrote to memory of 4768	396	msedge.exe	108
PID 396 wrote to memory of 1920	396	msedge.exe	110
PID 396 wrote to memory of 1920	396	msedge.exe	110
PID 396 wrote to memory of 1920	396	msedge.exe	110
PID 396 wrote to memory of 4184	396	msedge.exe	113
PID 396 wrote to memory of 4184	396	msedge.exe	113
PID 396 wrote to memory of 4184	396	msedge.exe	113
PID 1952 wrote to memory of 1764	1952	chrome.exe	123
PID 1952 wrote to memory of 4720	1952	chrome.exe	125
PID 1952 wrote to memory of 1320	1952	chrome.exe	126
PID 1952 wrote to memory of 1320	1952	chrome.exe	126
PID 1952 wrote to memory of 1944	1952	chrome.exe	128
PID 1952 wrote to memory of 1944	1952	chrome.exe	128
PID 1952 wrote to memory of 3096	1952	chrome.exe	129
PID 1952 wrote to memory of 3096	1952	chrome.exe	129
PID 1952 wrote to memory of 5056	1952	chrome.exe	130
PID 1952 wrote to memory of 5056	1952	chrome.exe	130
PID 1952 wrote to memory of 3008	1952	chrome.exe	131
PID 1952 wrote to memory of 3008	1952	chrome.exe	131
PID 1952 wrote to memory of 3892	1952	chrome.exe	132
PID 1952 wrote to memory of 3892	1952	chrome.exe	132
PID 1952 wrote to memory of 4492	1952	chrome.exe	133
PID 1952 wrote to memory of 4984	1952	chrome.exe	137
PID 1952 wrote to memory of 4984	1952	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/h1ehwnjwsb1q1/Velocity
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffeaf36c188,0x7ffeaf36c194,0x7ffeaf36c1a0
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8619314411955780310,17036158303634498444,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,1097519040813002797,796178904747632783,262144 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,15371239781078844317,8039442218281857380,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9710843792555291290,15059214887666880702,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13200918373911829446,12833771079157750368,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,548213259409412269,9899931604280450186,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1776533172689719235,9750645395715933240,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,2772252769865870844,16674396948196839457,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,8852414752537514182,17175098211567907493,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6794895456311668213,4278742503588030632,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9141553782471059819,18394447926241342693,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5592,i,8947471327637778575,14979622431378678014,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,5580596828090366311,4818122851471610248,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,5580596828090366311,4818122851471610248,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17715732627886346925,4585659113108585833,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,4123026401454209270,11029815212556139310,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,12534970005266895573,10260582503851137083,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,11389111016616539628,4435176405745586242,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,13270842195282485386,101945722194768426,524288 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6428,i,11264294615337980665,5141906982676154784,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5264,i,4213738941905461073,5040832051393517794,2097152 --field-trial-handle=2476,i,1421928963720468311,1545080409946759121,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffea213c728,0x7ffea213c734,0x7ffea213c740
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,13177583626388433099,12225428705127499247,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,8230632907119009860,5349960231241423018,262144 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,5967054792003048413,14035827608078685823,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,11462559550705043297,14828062572412141261,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,1899242639728810476,7524545956623275225,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,10181980831823293338,1976325143883672634,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,17975844772406635487,11972759644405529689,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,8546287295855937039,5097203673880685918,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5888,i,16025638881762281861,7550776590239146340,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,15674779297404165229,7937504938376436540,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,14675036301424976345,14391416672305932876,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,13172464559037947652,12555003176321312653,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3276,i,13532027073848757646,14696561408311697902,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=1716,i,16727093721645307221,3936771729114420669,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,531219915228454913,17916372141540186986,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,15969198403777736226,8254716116126107452,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6180,i,15818048867381683425,13595469688830106077,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,3939236177174193565,522901829227690243,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4496,i,7590724989991892176,15524191484974994980,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6096,i,3327537096805274538,1225802963244124429,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6688,i,11744440714717754397,11538839420194426936,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7004,i,13672109719910486117,357815025498889786,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=2472,i,2330733112991572594,10878713999195815017,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6260,i,2660730514398313441,9538666780280224075,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7112,i,9185126369604340989,2033071998694893539,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6612,i,1603742339997793998,6903840898150905666,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4484,i,11218689328551138636,6332525161115664399,2097152 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7088,i,8167967583489249812,373922350491387807,262144 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,11702160051199834133,17503308109722986951,524288 --field-trial-handle=2060,i,12170300200972689881,14255004554614873042,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:4816
- C:\Users\Admin\Downloads\OperaGXSetup.exe
  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe --server-tracking-blob=YWIzZDE5YWUwMGY3MjJhYTJiNWJiMjVlNjgwY2ZkMDljNWI2ZmI4NWY3YzJmMzc4MjI0YmI5MjJhOGY5YzA4Yjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1NWUl85NDgxX0REXzM2NTcmdXRtX2lkPWRlZTk4NWQ4NTM0NDQxNzVhZmFiOGE2Y2JjNjI2YjFiIiwidGltZXN0YW1wIjoiMTc3NjQ4NzI2MC4xODc0IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0MC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1NWUl85NDgxX0REXzM2NTciLCJpZCI6ImRlZTk4NWQ4NTM0NDQxNzVhZmFiOGE2Y2JjNjI2YjFiIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiN2U4ZTFmYWYtOTcwMC00NmRkLWE4ZmEtNTFlMmU1YzdlNGViIn0=
    3⤵
    - Executes dropped EXE
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff62ee1e6d8,0x7ff62ee1e6e4,0x7ff62ee1e6f0
      4⤵
      PID:4564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Velocity.7z
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {ca03bdd0-248f-4a02-b44a-ae4647ba94fb} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {6266c4c4-08c2-4814-8f63-99b7100ed8f5} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:5004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {85980892-78c1-4460-b255-14e324f5bb6d} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27276 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {d4ae3a77-aa07-4aea-b7db-fe80d3a7aed8} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3160 -prefsLen 34775 -prefMapHandle 3164 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {86ca116c-f334-4fba-bf07-00a3bf7d0cb1} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3328 -prefsLen 35012 -prefMapHandle 3144 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {8f72999c-3740-48d5-b514-b3a1fe792ab7} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32952 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {4e5628e2-338e-4e0c-b7dd-9c244748247d} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {7670578b-1721-4e8d-8a81-6dd9f1799179} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {aed3019f-652b-478e-8d94-01054dcfc608} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6ef1f2ab10143b4137e7b64ca8875615a59cd7afb8e3d2ac7de8a85383199b92
MD5 f3990fe01f12269bc18aecb4a2697477
SHA1 e7d139457bbb8d7651fd79a21a4eacb71aa65e82
SHA512 790b4c813c9f734ad6dc7d4c7120db933674167e40d14b0487639b835c3801a2b3bf75fc2847fab3325ee30d38591c181da46606536f95a0bf64a2042c660123
TLSH
T162E02BAAC921EC2B08FD175920845785EB1407571781551F3A3C960C8FB033B518A81C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 09adf233fbcd03f3315190e2a6fd81f547493b274b82c6911aa0d57ee8ff125a
MD5 da87e285c1a115ea1ac4f0043c030bd7
SHA1 5327a6fb349d6e4d3db12028d4389f0c909633f2
SHA512 a82264d4329b700733fadf0e8d4d9a71ed587fa17d1f180f5482d8ac9bb088d0e42ef0a89faa8b1fa4c0a8a4dd37b2314e69f96db4155aae2aacc07d6e94fa9c
TLSH
T15421560975F6F292DF5479B974844C352633626030721B4E8FD440EFB45BA990980B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 4887fb73e2486d12dc5fe32fa1d36193ca71e90bcaea6535b433e89a79dbb19e
MD5 e1a41aa6a802f798f9bb93595eae2077
SHA1 1ed3c17ac0bafeb834e0120a113e6bdbfaf349f9
SHA512 7f6be5ab57402ca3818f0f68d33d5e6daee6fce1feeb138da5962a21ed675bd3f57455f93a1cde0c09a3e7095b07886114a7c8a5cdd532cef0221e340d50ac14
SSDEEP 384:DbQX8Z7lxixxxGex6xQxCRXDaIa8GxdVuVPdJncLoxxxJExbx9xArPxkzxkxUxZ0:zknBceQnJC1zAVmiyveOyhoc
TLSH
T19E428EB7D3E8872DC85256F4EB256F1ACE2A091843683C67C9D8EF4B93E1472D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 25d14e5cecf81d238aeef00654d79f0e4907aefdec550573adef53dd250a12e5
MD5 0976020b7b82c215a291576f546feafc
SHA1 8cd169a04a9b5b6c90477106f5edbc37bc869516
SHA512 e1a8ba4e9abc8fbd6c81eb6451f65126ad4ecf662889d435d6458732c75bdbe5814cae6c8bc626a33f42921233531b2d8bed8d5310154a228bc4a312c53912ac
SSDEEP 192:wRxr6J8AN6v7rpAPRp2O9+Hsb+WNnbx0Cdpeq2UpRzVyIsnAUgtaJ:wRxroWfUXlEw90s2eD8
TLSH
T19242E72EA9186A3B9CDBD21AFD517B63DBF5102171801D44EAFCDA3C05E79CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 5782ded2bb22474bb93c87d0147cd339e0fe368711c5f4e5ec55bc7aea76a5a4
MD5 4728d1738c2b23874e077c76e849a5b4
SHA1 537d9cc4f8967726fe708903bf319a133a00926c
SHA512 84d3d932744d9cbeb2267ba21818335b27d13f89ff3998e3cd905fd206c6f8dfabd883adf80690a43aeb81add7d4370c4e8068ecbfa9dd5907ea293c48651cbc
SSDEEP 192:wRtcBAr6J8Addv77pGPRpMoJ7isOjJTW1Z9+Hsb+WNSnRXuObxrAWP129+Sg2NdK:wRtmAr0d/iX7Ews9Puk292e5e
TLSH
T13B72C75BA5241A7BDDEAC21AF951BB2BE7F12421A1D01D84E7FCCA2C15D7ACD2203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 08275b4ec98e4273f235b7c9016ddd668b5205c3647c4175dbc50a687d24988f
MD5 07ff796520dd4b1a4ef89277622bd837
SHA1 bab9eff392bce2e7a41a3243388e9f971c5a9824
SHA512 42baa378b590fa58afa586c046b28abd14cde6192690f19906bf086b7bbf6806f5471813f21d77bdfdc341f9d78509ef68b743d9df58793ee0191ba7402912ce
SSDEEP 192:wRtcBAr6J8AN6v77pGPRpM/WOjeI9+Hsb+WNS5ZObxrAW+Sg2Pdpeq2UpRlVyIsB:wRtmAroW/iXKEwl9k2n2e5e
TLSH
T11062E82BA5241E7BDCDAC21AFD91BB27E7F5242161D01D84EAFCCA2C15D7ACD2213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c0e76ea5735655c99ed2843376830385803e40574bb212ccc72df20466725b3f
MD5 286b410fbd080581933df0a6fb13cbc2
SHA1 d08e71ef8807223a75546de0cca6c72c8281d610
SHA512 64fb4822893e0a6e1f8caf2d73e5252a479b8a8d65b646ca372ec6e702baccca477691b6e7e7cc7a91e935dabe2577052baf38f2c6fc2138ee907671dfa6badf
SSDEEP 192:wRtcBzr6J8AN6v7rpAPRp2/OP9+Hsb+WNnbx4Sg2zdpeq2UpRzVyIsnAUgtaJ:wRtmzroWfUXJEw9+2L2eD8
TLSH
T1E352E82EA9186A3B9CDBD21AFD617B27DBF5102171841D84E6FCCA3C00D79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9677f63b20ade56878261e030285a9b3f49697e505db7abc8758b0f10eb3be57
MD5 f251ee8c34962e7c52f28d081c8010e4
SHA1 eb297e9490bde8d2110025b846fad961aab87595
SHA512 f8f4e6ca95fd59e756d5659966bd9bf1a0f11e4040292fd015588026c73754c918817f520b39add83a02f1f547a792f30ff2ca91399dd51401a65213aa72d6f1
SSDEEP 192:wRtcBzr6J8AN6v77pAPRp2/OTe9+Hsb+WNGNbx4Sg2Wdpeq2UpRxVyIsnAUgraJ:wRtmzroW/UXEEw4+2w2eNe
TLSH
T10752E92EA9246A7BDCDBD21AFD517B27EBF5102161C41D84E6FCCA2C05E79CD221342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f8e097d752831912516f5a77428d78586a45373ce5310010109ed4fb5471df4c
MD5 abbc43aed5f17310361f21beb03fb4c4
SHA1 fe91ef48952e2e83c6e78493985a68c4b9237a98
SHA512 9a65409831812b122db3fc484e4572de812e5821d749bccc3a093930bbead2ba0253ae198bf0362e7bbe98130c77ff3a3f7d3f4f98aa9b34a3ad04e66447a1b3
TLSH
T1B4B012A080819911C00313F4158214883554AF10C70A130653E46A7198263E05024150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\0d8186f3-98f9-40d0-9fbe-62f3438f52d8\index-dir\the-real-index
Size 72B
SHA256 68f7a6e3afce5333c167cfa7cd69e609139d14d25f7f08ca89c6b4cfbe8808a2
MD5 b6a88ad6580ba2dfee1c23fa60bb9712
SHA1 9e874c37bab88fab82d2ff6c65f0b7f94cd04532
SHA512 bc93b2d49698ef01833d1024d57df262ea4df202ef0f2f0f8bb1feb33c313f21813cdb9719e7ab381791c1e2ec52a56344c333e15d2a54a67ea57a071d2fb452
TLSH
T18CA0027802508247C82003B0244B056177725911FE1F034286F8339AC8A52A7C14B1B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591543.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\0d8186f3-98f9-40d0-9fbe-62f3438f52d8\index-dir\the-real-index~RFe591543.TMP
Size 48B
SHA256 3d487ea55e6336cbc64bcd334a18883b7dcb8ca1f96b7b725de56a353fccd99c
MD5 349d63dd2d8a83b4e337e0ccdae3a7a2
SHA1 0c9945fa3abd528332217c30fa1dc5bb1f596a37
SHA512 f3909c13697061c86bc0638afd90cf981913182bb3bbae98765dfdb7f8fae2f171b2248f39da2c0ed6267ef329e36e48f7ec7da6f1847bd5da50864f64c49ece
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 162B
SHA256 53ba1ca24db01f95616b2f7891cfdcce2d41eb365d9ed98003a07f91ce47ca8e
MD5 4a6445920f7980f54895a5e11a8b2690
SHA1 f22801c5ae11f98701934893cbfd0aa6263189ca
SHA512 d830c12d70cca9d313272d38363c122bd7053bbd15831d6bac0afeedfd31ddc31e6270eb3652d6168b451ed8d49aa4d4865815e5ce5f95844e2ee195a0af7a4e
TLSH
T161C08097054041765B709DE4513AF94EE78745084CD1CEE19444101130745334E0176C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 245B
SHA256 7f543fe57c949b486df118e56af9b52ff689b1b84434e1a6595920e7aaa4f3eb
MD5 ce1e135cfb34c20bafe73fa321fd2f37
SHA1 165fad65dae4cca92410accbf9326054dcc0d86d
SHA512 5b4a6d048db72ff96ad6917f4b2079857f906cc8a2348765cf132397f6a413e1d3e7d779faf4a1f9f5a51581be3cd10dfc5b73aefcec93a1ed50db998222bec8
TLSH
T190D095D711A052613B715DD05136940FD14B8D05DC81CCD5B54470513074123C60167C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 161B
SHA256 35614badab58f887ff40e249c675d444a0c2ed3806e3096c967e127d84bf1fb9
MD5 554548771cf67e52f7afa016a382af25
SHA1 18f0ff74eeb5c903e57968b9760aaa28ddfd4811
SHA512 152296daf07dc31f01ab86b378818c94d0b8aa01f8893924c30759e3c85e74a87d522e5c784bcbcc5f6782aaf428a4c7ebde83f41f7a6c218a09ea19358315ad
TLSH
T196C080D70540416667709DE45136F90EE78745084CD1CDE19444101130345334A0176C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c5fb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58c5fb.TMP
Size 168B
SHA256 8d0cecd10326a0a40f8e55a7d1c948911f059c3b13a5ff962b18f604d98b33fc
MD5 a7f8ce1e61f3982ac6515e972d36405c
SHA1 33e29556a53b1fe10f1c1876567cfbf82bcb2247
SHA512 4f86ae4a2b294c4017b7b87b13fbf3c619c717fb2d0010cc4167c046bcc13545246e1d3c062764d9d3eb6501e23c7f7e6e0573d2b0b9a4c11d70e5cdfc3256f9
TLSH
T1E9C080970550416657715CE19136F94EE7974D494CC1CDE19445301130345378B0076C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 487a22fecf5c2798f374f6cb43aa4bbf93adffe908d5d8d885bac6a7ad7083a9
MD5 2136c063ad0bfab9b2bad19f1beddf92
SHA1 a339d10ca55e747da1f42d53e37fdd272ccee86e
SHA512 f9de00f8a49d9201f5e39dffc64bc403f08ee8336a0cea9cac01c23f263e2d41740ab3df5f5b8377bb2687a4916c3c836db9e4577fe907b97e5641db06d6772e
SSDEEP 6144:OpsDOEOJe8tV5SUDU3XmrOk0HOGm/SFyEE/:wsDSJe6RdrOjuGdF2/
TLSH
T12F1412F52E0E5EF22A3AD3D1359E650FCC51A24A25EBE26C10D8A7AC61DC1C45FA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8945dfb49d14b851e8c4104658954011a99a6b0d42a429602b938c90776c383e
MD5 f5e1d20ffd9f76d135626946a925a73e
SHA1 f75780993d463493a128cf6098b00ee4ce389b32
SHA512 ec9271df44258262a8708785e102d7af1a4042d3dc95bdadad3aacd36cb4ae68d6b8a3cc8cd60788e34d2489ee660d13433b6331493de97ed64406432a96a7e1
SSDEEP 1536:fVEcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEz:NE3Qw/xLANk0mUW5GmRntSFCjEENF
TLSH
T1FF9312BA9E1A49F7997E56D2729E780ACD22134D309F698C329C538C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 c7792bf230bebd7cf642c28bae74785f1dbbd2196bf02fbd07998e17a167a36e
MD5 24ae62371a666f269f68957fe0aa5877
SHA1 c3b1ca9147c829d7743989374dc35a17037091aa
SHA512 b715c80ebfe3d6e5159ec112cfec8115121c73616c286ffcda5c9e843abead44f57fc6123f683b0eb32b4d9aeac4daab51ba8352dce15ddabc1cb17c8d076447
SSDEEP 6144:KpsDOEOJe8tV5SUDU3XmrOk0HOGm/SFyEE/:0sDSJe6RdrOjuGdF2/
TLSH
T1CD1412B52E0E5EF22A3AD3D1359E650FCC51624A25EBE26C10D8A7A861DC1C45FA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d3cf07a76c773e9d9aaf4eeaab32b8b5d4aad4157a35096684a89a635d2373a5
MD5 e89d81f38e7fff513fd9b42838899ee5
SHA1 bc6dd81418b88e978c10afde475d09db42a3fa17
SHA512 bc74e8fd65152ae557ffab193c4356d00e305dd4cf51ef8585808d0034f047a072c794692ee65f34f08d8d0b2479c5daf8dd75e3ee82597cb3ccd6e4e5643244
SSDEEP 6144:mpsDOEOJe8tV5SUDU3XmrOk0HOGm/SFyEE/:osDSJe6RdrOjuGdF2/
TLSH
T1371412B52E0E5EF22A3AD3D1359E650FCC51624A25EBE26C10D8A7A861DC1C45FA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8384b8e61ae613f5440d93068c370d9fcbdcc6835a41cf9d5369f224c367f35b
MD5 513a0cfea567f65c545e07cb88193fbf
SHA1 39b3228142c76165eff0579332749219923e7c69
SHA512 e0aa4b03eb71461f7f210cc35ca07140325e47fd385450f8641f1e6cd0d8817c7fadef0192a782dd2897dcc1b4e91103a39d36c1e375ee0d30d9b16ee778a68a
SSDEEP 1536:cVEcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEz:eE3Qw/xLANk0mUW5GmRntSFCjEENF
TLSH
T1699312BA9E1A49F7997E46D2729E780ACD22134D309F698C329C538C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 dd6e3a5be566c637a73e043a7f09566bfbeced9ee30a86dae7e600550f1fb6db
MD5 34d3b2d4bbe24349321cbcd84c50a0db
SHA1 d4cd633823be01fed7368928b8c17adda75e9d0d
SHA512 bc1a850b3b1903ae487f2007a71fbe88e29a51eaab830a26370ec1aabb84f29656b7b40cea5087fae2b0c1a1dcc3ed58044d76b2029ce75b7369f567f20b5a49
SSDEEP 6144:3sDOEOJe8tV5SUDU3XmrOk0HOGm/SFyEE/:3sDSJe6RdrOjuGdF2/
TLSH
T1921412E52F0E9EB62A3AD3A5359B544FCC11624830EB927D11D8A7AC62DC1C45FA3D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 59490d34733cb8fabdac3c89c29a4b30b44d8b765a43a0ff84f33d28af474e58
MD5 0bb448cc355a57541ce34f2af7a65334
SHA1 2666d0accb21747d9e83bb43ed93a6f8311bfa70
SHA512 aa529f6fe81e141c59b144f70b8ac0dc70bfca8f1ba6632f3fb22efef065844327f955d0e3a487373a6145b376a0b5b942ebf8b99be6582b0caf1382572eb025
SSDEEP 1536:jVUcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xU3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1579302BA5E174AE7997D4A8176AE7809CE12630D706FA8CC315CA39C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf6c7c1e310b8b7658a6486f9e0ec1988af55c64b0088c5e106c251843317694
MD5 6bb43aa8140737557979467fe7639310
SHA1 5d97e47df415ba67e13786711fbced4e9a750018
SHA512 8fb6570faf81d07a766da4536ff22a42ad13e3b00e64c6a1957397e3e55beaa3c40660967c718a520b4ce2092c1a8ae7388506160f6ae5fbf696f9efa13a4bd8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ed052e6aa62eb9cbc467b4593bb8dd26ccfc976d1fccb389ef957c030a5b18c7
MD5 f96064542fc5ec4c0549d4377c4f3483
SHA1 05ceecc956da598f16c67c99a5db1f2a0ace7c88
SHA512 77a0caf92414a29f73d2a41c29c2aa3610a2cc53457b42d6ba12448b1d4b87ee1c0ef866c4c78d5ceaf038f427597ad7e7831074462a20b6f08246f1836a7b52
TLSH
T16DD0A734B69AA402D2290037056192661B5AC995299644C0F02D850CFAA82A997DB1D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 b61c40e3a9f14ba5bcae6ef7b33286a00997237624de757d986da19cd094ec78
MD5 6b7159edd643e4944854d15e38774386
SHA1 17e988c2122dd9ba8ac9bde9f8229d3551459ae3
SHA512 17b035bf1e94c50f53867628e3184011d53a73b32ad78a852e66cb5733bc3fb70eb97fc4d7feed04463dcda1216881a93124a96261e1a7802876e16107cd836b
SSDEEP 96:V4UYUdqCqBguZQ8xrAVYJbjqMXG8YQ1uGzJXaQc2reE1Bj76G6NymUduzztWQ6Mr:0r0oYSPXX6G6wutNmY
TLSH
T147D1884153C1DAE9DFE893B505B68874B2614B748212BF0B1BF5677E262BB91C07E30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 742274dc76a7f44434c559e4124b581d1cea9027d3c0619d26fdae11028f41ab
MD5 37f09745272168a9537b8bfa37624c04
SHA1 8ee5d561eac7d367a79ca9f6c15ff3542b843fc7
SHA512 d94682ddee859e6aa242306ed7f1ab42a4bd53b128b8155a4f6fca3f931ff08bf51b438a7fb9107a69d6673d70162795d757b6c52caacd4449f416b9e4193b0c
TLSH
T1BB61F880539583E8E7E991F80BF75050B2304738C28BFE1A01F8577D5A56B12D0BEB0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 eac7ce736cb575fd79f3d0887191b25ecbab9b43c1ff3010058fc21ea927777a
MD5 ee50ed9b1bde9b943ee22c12eebc8f7c
SHA1 c117f151ef104ed188466acb476ba72e518f62ae
SHA512 864606f9727654485990269462914721f70a8700dfe5b0879aa12cf1e20e75aa8ec8467140f416cb1fe6b1a455b23ec7d541ccdf61644d93a36a8890eb9a5f75
SSDEEP 192:DEEAL+h9vPVtvv13krrElo/1hYVQYJ4VSUEij62svj4qn6f/jAkjAG375fG5nttO:DEEAL+h9vPVtvv13krrElo/1hYVQYJ4T
TLSH
T15332BCF3C3D5C62EC91196F4A6146E1BCF1D0A1983283C1A88D5EF4BE3E2472E15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 936389b476255c5e365c428f55552a09388771344ba160802c099e7f360a2aed
MD5 9d0c45710d9e81cac7b5525ad09168fd
SHA1 70ff12dd04615f7acb41d00275ca6d57c77f4de8
SHA512 b1b44817319017eaeaee9233d4e5a9eb04ce7b8a4fe110ee159ee05d46b2f3659d569b3cebd81764a5d2c17f94486347426c8f1f215b23f2a3cae48abb5665b5
SSDEEP 192:sxZqRiyM//K1Ml8MkT/fBsDC61qXmoIdp8IHW6+WNm9q/8K8EVImRtPLqnsoc5p6:sxZqsMT/fBsDChXmZRHbJ/dVtlc
TLSH
T19B62E9536A3459778CDBD219F945FB63DAF5087292944E84AAFCCA1C01E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 452a146950fe5cacde09ff6a8509a3bf07ffe1b6807a3986129bfb73f01394be
MD5 ade0107e9f9314d2e94305e7174ef29e
SHA1 f0697a8d7b8d605884b0c1f36f4e599dcd1a1365
SHA512 d443efe0fa901486ec5d3b4f5f5de114bfb2af9ddfd0f56cd50da51bd1a4de8ab9748be40f6e489f7920efd36c569ba8e7103c344361a19d4ac2beadddd92f55
SSDEEP 192:sxZ0QUnERiyM//K1Ml8MWOT/fBsfC61qXNW9b8JdpmtLHW6+WNA6XH99q/8KXjVc:sxZqnEsuOT/fBsfChXN5t6Hb5y/ZVDl+
TLSH
T1E6820B136A34497B8DD7D219F951F763DAF50463D6944E84AAFCDA0C00E6BEE2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e03a194b0461d3dbf430505551758cacf77b3a201dff4e9fc3de72b86b5a6e96
MD5 037c162d54839be339e910a09eed1288
SHA1 6bc20d4184aae3a4e89109db95bb2d98e2f5c6c5
SHA512 23567c0352da091c44fd402c378e4c7a697a69168bea7c9701167be0dee4996908bc297676252f8d6ef737de4c7609de05e7e0334cf885c458d21ca4d7e2d544
SSDEEP 384:sxZqnvsneT/fBsiWvHChXN596HbuXLy/ZV+K40:ssvhT/fXYHCWHbTZss
TLSH
T183820B136534497BCDE7D219F951BB63DAF90822D6904E449AFCDE1C00E6BEE2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 38bdae9387c3e4bbc333b99174846a1a735ac2f72c6d7c26200a73f7a50346c3
MD5 187c41a3d4d274a66ce48cdb322bdb65
SHA1 30d4f7a830f2f6ce56bb246f1e3d1eccd0c5be14
SHA512 38fbc9521df82702adb4cd0138c76281673e29c40ae7540c2ef7b3e008dd387d7234739eedb45b8d1a19cadb34f210fac58fa3e413799d61c28b5429716c7b74
SSDEEP 768:yssal167pLuLnNVWvNT0D8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSdwoLl6QF5aror:yssal1SEnNVWvNT0Du1jaHdwoLIs5Rfz
TLSH
T1E1F20C3B6C0CCB7E4F804E9CDC2A7E9E6DE801CB56D8899447E9844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index
Size 2KB
SHA256 66dafd768fbf76d995b7d65f6cd347a420269ab4cddbb8c0cbc1cc8f145ec1e2
MD5 46a0f897ef8dab6d3765ddc18476306b
SHA1 67baccb9611798a1847790c868b41d4300a06090
SHA512 070cb19118316c4eb6e205fc0df0e7fe89ff1125df11590149b3b57df67052fa7e1ad4fd79f6a43c5c88b6a497a5116ba39a9a8381250aae97bf05bae8fc7b2d
TLSH
T1BF410A9C5C475A17C96980B158B505A8337058FE1F48470BB8BC11B88D5B9951AE3314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index
Size 3KB
SHA256 ffa74e541ddc14b7277cb235d21a215540b8522c279c59f773ef255ef8435928
MD5 10b9b1ef47375fcb3d93a9a45b82d3a2
SHA1 c1f383b35f002dbe27e7146a7c4173b535802207
SHA512 191174590d1603afb8a844ea63aa74b692a7bca4077a9cc90c8f691617753c761aa3e7add47acd7e0d0e748b8c6656c1efe7ee1ec0c44b5dd4869aca3fc41549
TLSH
T17271195CAC464E13CD7680B908B614683370E4DE6FD44B0FF99C65B50C1B38A2F9B316
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe581dc4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index~RFe581dc4.TMP
Size 2KB
SHA256 61facf6f598b228946eeed1700519359ed46af4f933abfe9efb25882b8c6e3de
MD5 ce831193947d1b295ea3ebd7b08ec33e
SHA1 90087749475be442c8fa9d23dea506a61e52932c
SHA512 9a915cbc779d7362198a3ea4da5b525f297f2f6bd01ca031233f193d3edd5fc3135f06e5731e3a77d11a19d0686b609f35d78d501795c4f46e54422faf655196
TLSH
T18641C99A5C864A22CE7180B349C91469333DA89509449B0F74FCC633ACD77AC3D62254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86ef5750-3d17-413c-b5bd-3e678b3c684b\index-dir\the-real-index
Size 72B
SHA256 524fdc2ec22d254829bb895edac169065dc71d4c1b40e26f1c8637a36685ed5d
MD5 37e0b453f76efcfd4c704a3b0758a822
SHA1 de72b0aacc454bc8cccc3af9fc4671660d55c904
SHA512 2abd8f7f15921e6b7e7704ea21241b0441d1847e8c986ab8766928976d5fc73de9b08d1b20ec9b6c0937f22b98e58e838d623234474025e91d22bc21594c32ce
TLSH
T142A002A013A38805F41212B1256213515261C9101122B34642D50544DD53E44658655C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86ef5750-3d17-413c-b5bd-3e678b3c684b\index-dir\the-real-index
Size 72B
SHA256 06f76e034590a3ec1d3a96dc1783492f14c86d1da3c44046d4286bb56cdde422
MD5 8d6fbb421901c1fab6d615ecbe27491c
SHA1 ed99ee2b78b9c228398bb5243a02ea4479ef90db
SHA512 c7bf05d7dc66ad844049fd9c5750c2f144eef1d035ba9499eb1ceec978d7d0890c2219fc47d638e73dfd8f648a7928e314209a1e2ddf0c558f4cca2858cd5ae9
TLSH
T19DA0021413844002C00713F5555A83835310C9503910134B82914064DF906858D6985C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5e81765de3304c65f338bdf59da649b8ab65f453532413f60ae5c654cd8f9574
MD5 6acac02a1abf145ef90084a19068e300
SHA1 cc6ef18e9771f8827492bf3100c0150da7f41db3
SHA512 6ddafd967a17e8819378b513aba7b2d134d43705e6d19e1690a58cd37abcbd1a4f6a03f7951851808052be15f9d14b5f626092ef0659ba0d0e03e822b1ca986e
TLSH
T179E068B22EA62C14AC2FC3D2247084E001017819C700DE4F203AA3DB41B1351241AC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 8e0a5828e1cc9cd28fe6c3fa65346c746bf773dc16edf601dfe88fd7399eaaef
MD5 28d5273fd3576ef8e793c79d9bd9ef7c
SHA1 ec731dae900eaf06d6dabcb7c28c4b630cc734a3
SHA512 6d097df35d645fa8fc5d0fa622b9d4cd7d6297d32b7eca399e654b0eac4febe0aa6d1d72a2919fa8c096e05bc310c90ab1ed55cb26cf0157655dacb5cf7f9a7e
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5830a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5830a0.TMP
Size 48B
SHA256 fcb310a084c6a1056d65fc84e7ad727e9f8a9dc3f97c58598b4e8cd7bbb45bc4
MD5 179641e66c19b9fce8d488be6a8cec33
SHA1 62fbc23c8597da92dd220551ac22beaa21bd89db
SHA512 2a7203bf91a719a82177142727e66bda2f0d54b52b56c3a7e39d2b44fcc64e9bf1975a5482b50a834aeb5ec66b02a3f1a62f942587e216923de7ec532cc6ce17
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 020b1180f628459965ccc388dd5f4990a13b99c79d7ce7e173d3e0137bcc7db3
MD5 78ed812433317180ca0373b2a17610e4
SHA1 d3cb8a133898c0127ba8c58e57acefa17e3f2621
SHA512 c2e4d93d6260a802707e1f4320badd26ec7e958e4c05fa6ef3f52c6747d632c492d3d30c378bd40213555edf35762e6cef70e23bd90c92b4086008f3f45b046e
SSDEEP 96:KoleKm8QJ+KSsieNiKeAjpYd5HTXgz7uzhhgK51hfgNxhe/Jt6sQKB6q:EUtNpz/5
TLSH
T1A0D13F40323B1A852A7E2D4DD999B52F528130633058A52B7BFD00668BA7F20DDFDBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 37d073b11bf017d34a4fb475bd59aca7a500a8b5c36d358997647c962a9be1d5
MD5 29895d9c3bd14d6889d4d351437a55c0
SHA1 27a51c981b1a70e3ce7881ce17bdfa153efa6c74
SHA512 200d97bb252bd4a3675ef093e84c0a163472239642e94147c78336314b999861d1997191c66bcb7d810b6a01baa5ba04aeaa54a2f7298c38d23ea2f2eac0823a
SSDEEP 384:n+jccCs+Bt0S3vsNvUVKqDqE/MOJMpAwT/GXU/AatId6WlZrbf3Q:occQP190Oip1T/GXabW6A3Q
TLSH
T11C827C3168781C7B9AF69A15F54736076FF410BBA6852F58E9D84F0E05C7AEC130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a413e17db7e8f1476760b37b6079cbd2aa41be2ae74391e81a8a12fc03b34b9
MD5 13a4da8c8e5398274305acbbcaf76847
SHA1 98850208cc9b6f2c6ea2cb9911c534175bc83453
SHA512 0a7af67290364b92ec7a6effb4e8bc1150f930ff6ad9affcb5a497e885af476b549c57e104ee7b4299d1ee8e6939d123128aa829fc6e0a72fb1b2d1d056e8177
SSDEEP 192:gONk6QaQmiUyPnwZ/MOQqfSDCRxMEk/9U6:gONk6vGwZ/MOJMCo/lU6
TLSH
T1D302F93579782C7B8EF2AE49F48727179FA4103BE9526F84DAD81B1D01D7A9C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6b56a35c823383fab484176976bd045a6377aad819d784b0899c842b46f494d
MD5 59240d951b58f8f928c6158a5f608ccb
SHA1 ae29e2f4d17f3ca63be4f5e0e2052badccfc31bc
SHA512 e0097127c7646d6092e6c411ff1244e37bc158d4b58b8a8b9122c8c30c37b73cd87befa7a37be0bcb5a485477993773270cd31570a1c5064312112a023ddceb3
SSDEEP 192:6ONd6Q5QmiUyhn2Z/MOQqfSDpEF1RtneqbGU6:6ONd6ik2Z/MOJMpA1X/GU6
TLSH
T14C12F97569386C679EF2AD45F4873713AFA4107BE9866F84DAD81E1D01C7B9C230B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b81c64af-7048-44d5-bf27-2d61b2d44f67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b81c64af-7048-44d5-bf27-2d61b2d44f67.tmp
Size 25KB
SHA256 035a4f9bef37d17879f962c781c3eaeb0b9ef9d6fe3535d8170b32ed1f8a76a3
MD5 52e767155598d0c049e3937f308f5a87
SHA1 e2bdd326bee80e103fc2a1f49520b370ed936b89
SHA512 4e0acfc5164338a876adb88fa3c5cefd54fba24c44edeb45b1e5a661310502a01bea8d868611376613b7b6729cbfd7b146627d4598484822b1d628bdf5e86ab8
SSDEEP 384:nPjccCs+Bt0S3asNvUmTZ8or2E/MOJMpAwTScAStlaXUsN9Wk88agXU/AatId6WY:bccQ62rh0Oip1TsSsN90LgXabW6A3Q
TLSH
T1FCC25BB0E4A41DE790E1DAC9A587F5073EB8013BC5495A1CE6F8BB3E308F9F81316861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77564fa5-18f4-406a-b112-bcc49b13a077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77564fa5-18f4-406a-b112-bcc49b13a077.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f3da135c59625cc368fa70992f401104fdc95706d76ea56a03997918ed42d340
MD5 5d9a46893964c90747c09ee3876f2fed
SHA1 556a89934daa297a2b91e5df50ae48ba05ff5653
SHA512 968de61f56249e44143ad3b03166c606d54441afb6f9a998752cabc60d79fca4c279cae3558290d16b22176c430ef078782c46fe31d92825f9e970445f4f0a47
TLSH
T17F412798B6FA1108B3777E5AABF6A86E487EBD772E0AD05D00110D4F0A62B04C971737
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe
Size 1.9MB
SHA256 82efdcd72dad274bb941e8d50fac0d0b701ea6f4028add733477c883d95fc553
MD5 22f1281259224fad3b82cead93a97c6f
SHA1 0b7b36dbe20e035afa7b3facbe64af52426253f7
SHA512 95193b4ebb2c61328e27904533eb7bf207d554a7a34173262e393559773d35710de4567208718b765a6a04d436bee3f4817f7269504540d5efa4684399c71390
SSDEEP 24576:PFaEIndEocjvCe5Us83p4X3PxqTX61didSYME5qfVzWuuP:PWndEocjvP5H854X3PxqT4QTME4WuW
TLSH
T1569509D7E36111BDC81ECCA4872D64629528748B4735E3EF0AED4A760A71EC96B3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe
Size 7.4MB
SHA256 4aa0d040f35e7b235324ea096d5c8a6d0bf9aa75c92d2d3c4e3928e1a513a3e7
MD5 4910ff54cc95f8bdbaaced756961da8e
SHA1 c7d790e8563fe602c8524e2391631470af823912
SHA512 75a5c85ece92e4cdaec1b09c1dfea065441a7942b7d01e8a94f63b9e065331243288108be6097753b3c7efeda3b2997d169783751ddd43605837f1c10f13e151
SSDEEP 98304:uKH86eyCQLP5s7lqFxHVK92tZ49rF0XmHHxvFBIy:xH8F4tsGKPvH6y
TLSH
T14D768D53F29611E8C01EC9B9475E5623A5357C4A4B31A3EF0AE43A221E76FD46F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS444BA17A\installer.exe
Size 7.0MB
SHA256 bfcde428b265abbef5ae5e42789f05044e7ff4c1eae703c9ac5755ccc08e22ce
MD5 aeeb3b0761568f94f0707119c8ad8652
SHA1 8910959409ac8e13625e7793569acbedf08e1165
SHA512 fd78af5a0189c7354bf9d1cb68f9fb7e810004660829b3a38dbcf62c834b83ca3b4f2edad539e5a7fd30355c6a610a271315f584553345116d44431e44368238
SSDEEP 98304:uKH86eyCQLP5s7lqFxHVK92tZ49rF0XmHHxvB:xH8F4tsGKPvHv
TLSH
T118767D53F29611E8C01EC978875E5623A5357C4A4B31A3EF0AE43A621E76FD46F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3162eac-1795-4181-ad7e-24650db30f3e.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3162eac-1795-4181-ad7e-24650db30f3e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e1168e6d-d1aa-4e34-a76f-54c1706c5152.tmp

Path C:\Users\Admin\AppData\Local\Temp\e1168e6d-d1aa-4e34-a76f-54c1706c5152.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir396_1651818157\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

766f7e95-d685-4f2d-aeb7-f1a894bee505.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir396_232044977\766f7e95-d685-4f2d-aeb7-f1a894bee505.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5d05fa9505326217c72229f6469c4714c28e581074df74c78f49cd799076f4e3
MD5 014d904d33ab2454935b8c81ba6c7067
SHA1 e4c70af76892330d07e477347158de98623e4ece
SHA512 052a0c34c8754c3550950bcda73ecda445ee07257c2cd522f1e78cfb42d1a313a6bf56811e1790aa3009e1cd598e80f6ee57968c72afdc486cf1dba76f0a5958
SSDEEP 192:BOv5zboPj3zyjtSk1/66JozGzgCl6mc0dz:eboL3zyjl/66JozGzgC1jd
TLSH
T1A9E120A4E638863BC408137BCCA51B410F3A384B984E3F1935AC655C2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 865b9e9227f8a91a3410aef2ebce68a200b940b0563d13a82ac0e157834efe19
MD5 7fad80a561cdf7737fa5c00b5ad4ef40
SHA1 b194210d58c44b01f01d7c2bc8aab46730be4557
SHA512 b7d22f28344a652f947a81a8bf15c618ce46a74997d1729aea44fa4d16ebff0980be1068dcbcbe91e5000f7ada4b47a71836e57355d3612d0fd1d171b92b8a70
SSDEEP 192:YOv5zboWZ3zyjt6mx1d66JozGzgCl6mc0dz:jboWZ3zyjAAd66JozGzgC1jd
TLSH
T123E12D64EA38867FC408033BCCA51F404F3A395B984E3F2935AC65582D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 91d63c8b8d3d39ef61297155bb1c881f26a6e428b31db3a242bac6b797440553
MD5 0ae92a874ad46c3a9764a9df29592000
SHA1 19abb3811b4517b0b2d77e6eb583ba8bc18706ab
SHA512 bf5a60030f5a1dc0d90154636fad7761edb0410aef9f386575553a6fb15f405c302c851d46bce9bb34ad62f3cff141cc882a1bd60b5ca8e627bf8f2631942f9a
SSDEEP 96:GJFVQFmF6F1n/dd66JozGzgClKtmc0d/UGSdF95/7bkW60rcPyUR6rWZK:b1d66JozGzgCl6mc0dzOv5zbowCyjCg
TLSH
T164B1DD68F629463FC458023ACCA11B400E36385BA85E7F2A36EC745C3D676CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c55bb62238ea15c7b1bf84dd57faed0e466ec8a98ea5b8b4db418262a789167b
MD5 96861230cd19e36ac7f0f533b0323582
SHA1 6c41af95661ca3c86114f46c0caeb1de91336d58
SHA512 1174c697af20aecc8e687963ea087fd05889c33811c1f55249af3ecb3947df058b6e4593b5a0323906759637be8cb9d27b0141e5c3eb2163f85431327d40b415
SSDEEP 96:zSdF95/7bkW60rcPyUR6ax2WZGJFVQFmF6F1n/dd66JozGzgClKtmc0d/UK:zOv5zbowCyj0xp1d66JozGzgCl6mc0dz
TLSH
T106B1CA68F629463FC458023ACCA21B400E76384AA85E7F1A32EC74593D576CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

338a1749-710f-4646-865b-8e281447cff6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\338a1749-710f-4646-865b-8e281447cff6
Size 235B
SHA256 7ba2bca7bb1761ded103aaf754a56b9aa324dbf1fb7fa43b3a2cd62cdab786d0
MD5 6a91451c9f9e87a9e80f83df308f3ba3
SHA1 55170ddc7a87ef94c2a76ebe54ea82a39fccccc1
SHA512 b999a4c9e121ad96dd2f6ac46b1505f403ddda2af54d029d8191556701943dccca46173295e7001435754040076d0f6762556328068bf53c0593fdc334d62eb9
TLSH
T1E6D097C428983B2D0C008F12F0E1BEC230464C3310B0981487608878AEBEECC42A2807
MD5 SHA1 SHA512 TLSH

Submit Download

4917ccbe-84cd-437b-b338-9841b6d01036

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\4917ccbe-84cd-437b-b338-9841b6d01036
Size 886B
SHA256 5d961dfd0b71fabd671b6f96ec059de1aae889d6ff7a4f107a9efdd240ae7e1a
MD5 6323d0c862eed04ea0e7f8624f71ddeb
SHA1 0c01f6ac4e724ee02674f9b1cf3a4f7f3c4606c7
SHA512 76579c50b1f2d2b3530ddcb66acbe83afb3919e31f31ae50727114024ae65de30a15e5d16e17db84d93f3976a25fdf97570477d012a24dfc9187fb23f03e0b56
TLSH
T15B1100808A78B9F28E68928BD594770687E0763380C64C087EB45B080DAB51EA7A660B
MD5 SHA1 SHA512 TLSH

Submit Download

575b612b-209b-4908-bf57-38f5fb991b3c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\575b612b-209b-4908-bf57-38f5fb991b3c
Size 2KB
SHA256 c006eb1b7b3a440fee3da1239be8ed8fd2711b23353a8e95c8dfb9092ceca971
MD5 ebc7d3b1a8975b4ea7c247fb0d35e4b3
SHA1 f1e50939455cd4403f18adf8236f93457ca133a5
SHA512 3a1d4bedb87816176a8888bc5101c4d265a1dee3eedc651df37681d6802c3b6f0b46237c05e13e92af56926ea379f8afdd040c372f5fddd71e921d8f7ebb9098
TLSH
T1FF41676C35785C7A8CDEF55EE481239D53608B0700C71C472E51DF4C8D966EE636B52B
MD5 SHA1 SHA512 TLSH

Submit Download

9369e7d7-e749-401d-a626-e35d927e611a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\9369e7d7-e749-401d-a626-e35d927e611a
Size 235B
SHA256 d12cc468da506e6e8a03a8247271106f9c2378c7cf63b61a9627f9e887548af1
MD5 b84e0b2688f8c9f096b352289c7379c5
SHA1 2b6fd5407ae9b136d2218ca3d6c29d42e4d54131
SHA512 bfe99f51cc2032faba707efadf290dcc1cf1111533e13f39caeffadc43049884ef597edce580ee592feda785f886d4ded0974160e4dc120d4500bb6afad260b5
TLSH
T127D0978828C8272D08184F02F0A178C2704C4C331065A86485910674CAF8BC8022281B
MD5 SHA1 SHA512 TLSH

Submit Download

9a784837-79a2-4716-8122-368e2f705a76

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\9a784837-79a2-4716-8122-368e2f705a76
Size 16KB
SHA256 a136384f83bde580b773089f135e9abe4006d717018dc1175a77cea46bd6c703
MD5 61f4ae0eb08f31dac050e4399cc77e31
SHA1 e727ae6ecb466532986197435ef3ec3d5a8e85c2
SHA512 698b29cf58515d07689edc781a621c09eb16802354eb32f78123596a73162c374964e9eb983c60bc80b055e64191a6ade592527a783f26f378c0b36bd7d1726a
SSDEEP 192:15AXhhRosIzxDbaE37eCTz71qBOpKUYbdItJcDusl9rjLuyDI1UOZUlrR5nMkS:1chhRosIlDbd7e4MwEdpKsbrjMf
TLSH
T1AC72CA166820497A9251E769D9E8BFC3E5F638CB4C419FC99BF07E081DDE09E102794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7efc9ae-db91-45c5-ba83-b01c192bca50

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\f7efc9ae-db91-45c5-ba83-b01c192bca50
Size 883B
SHA256 4157e3c166fb48cc27f7d8145ab045fbbbca09918a040c78a0783223fdb1446d
MD5 8388384b16ecfc892f925064f7864111
SHA1 83c002f51d442d53dea8cb59b32d8567fb924459
SHA512 82f79fd009f7f8763a56d90087d262266e7f98f9ed7b0bc03a15e19c17613302af377aea096c60793de49b19df7fbf3a94ca046c1ae722da3d0d50123792b080
TLSH
T14E110080D678BDB28E7C834BC9957B1247E4752380C65C183EB05B184D2F56ED76670B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 6KB
SHA256 a3a209125668ddc7875649429e71735cb38c05c5823f09dbe638768f7ab59e3e
MD5 4b888e808df6570de072aeebef3fa492
SHA1 e93d6c89f48e6278400e54bebb43ed1fa10f3dce
SHA512 6b5d754ed08a42e6630a710fb57382c031b050e2e521e495169035528b064d836aee9f8493249b6298b100150ef81b7e97a855220717f549e93e7b9e9e2f3ef4
SSDEEP 96:xHsUTUxqGq7fC6r+ObzStt1SSl8pdv9jBnEHYfYWBw8On8L4cnUaT:q8R7fC6r+7t1SSGOY7Bw8OW
TLSH
T110E12F7895088B7F78B6776CAC6888716AB2413B77BF28C710B944C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 6KB
SHA256 3cb9e7553517181533a579ef6fd8bf71fa817d2b3502e86d19fe9afe32674bcf
MD5 7c541650a7a19333ea8ed5666d4f0228
SHA1 7f689cb7d52687215da88c050e0a30114fd3455c
SHA512 1e9ecc14d6b40955a70362086a94eb3f438e3de9bb6e7debebbfa754f420130e7d62cba1961b3348906b298283c59a3267c4fcbf3dbd5d35580a48de38381196
SSDEEP 96:xHsUTUxqGq7fC6KjNnjy1zSpRinRiKSSl8pdv9junEHYfYWBw88n8L4cnU8WT:q8R7fC66eogngKSSGpY7Bw88Ws
TLSH
T172E130789508CB7F74B6776CAC688831AAB2413BB7BF68D710B64485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 6KB
SHA256 35a93ee2e2a500a3fb4535df61f65f29c288d745fde5ad6653a89e21bd43cc12
MD5 b48bb87e5889b056faaad6bd9136fb66
SHA1 e9bb388021632c283709b3fe6efd84c04aa146ad
SHA512 b40021c32c13cf3b94b5901395b1cf9e20a92e5e917ad98d3980eba36b5bc79a88b9584c0d824d4140a5db8876b033e5c4b08c01a4eea5a6bccf204b2509ac80
SSDEEP 96:xHsUTUxqGq7fC6r+1zStt1SSl8pdv9jBnEHYfYWBw88n8L4cnU8WT:q8R7fC6r+it1SSGOY7Bw88Ws
TLSH
T11EE12E789508CB7F74B6776CAC6888316AB2413BB7BF28D710B95485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 100588.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 100588.crdownload
Size 3.9MB
SHA256 09eb1b57ae5098c39ca17881c5af5579e0e668715204266f72cf0ce9066477e1
MD5 8e22dda853067b8bf4149a76aaccd85c
SHA1 cec75090f7888b25adf4d75e673037f0e065d8d1
SHA512 d44dfa7d5cb0ee142191e72795980283c50d35b4e0be08d312dd9d9abf507560dfb2ceab119ad74795d9efa2e39a7c155b00a3c5d39fc9d7cd284c7496115bb2
SSDEEP 98304:sAiuN0V0ZhWQ7LepW4ghq6ZrWecBcG4uK7x:X0VeWQLrhX1Wxax
TLSH
T10B1633217B80D033D2A315325FA9E76D97BEB6691E22425B67C80E0DDF32941BE35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.7z

Path C:\Users\Admin\Downloads\Velocity.7z
Size 8.1MB
SHA256 88d5b70b4c204499c578113b214285f71d77f8dec3b53566decabafd02c0019e
MD5 fc2b2217fdf195f194b446282ad8eb72
SHA1 af49d6eaff4749fe8bc19de0952aefe9730f0870
SHA512 6683d146ff6f1a0909b5e302706424391d7d318eeddc4f83b84f69c3ed96bffaabd4a694d146d5ecc7c2aa742055d32e66307051b849e34f84bcb628b893f40a
SSDEEP 196608:G9v6XObYTY60JlHm+AJ31YiS3F+Rqc5YmBKIUBw6L:ueKYT50nHmx3yVy5rUBpL
TLSH
T1868633AE956DAEF337759E693B09AE373D1051318137F2D358860E8410BAE3783C19B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2188-609-0x00000124E0AF0000-0x00000124E0B9D000-memory.dmp

Download

memory/4128-1548-0x0000023100170000-0x000002310021D000-memory.dmp

Download