hxxps://geometry-dash[.]en[.]softonic[.]com/

Analysis

user interaction
yes
max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://geometry-dash.en.softonic.com/
Sample260419-tm14baev5p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2304_1135624217\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe
5848	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210886966212158"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{14D20718-88CB-431B-A87E-1B03B9ED6B07}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	chrome.exe
2768	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe
2768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4584	2304	msedge.exe	86
PID 2304 wrote to memory of 4480	2304	msedge.exe	87
PID 2304 wrote to memory of 4384	2304	msedge.exe	88
PID 2304 wrote to memory of 4384	2304	msedge.exe	88
PID 2304 wrote to memory of 4384	2304	msedge.exe	88
PID 2304 wrote to memory of 4932	2304	msedge.exe	89
PID 2304 wrote to memory of 4932	2304	msedge.exe	89
PID 2304 wrote to memory of 3148	2304	msedge.exe	91
PID 2304 wrote to memory of 3148	2304	msedge.exe	91
PID 2304 wrote to memory of 3148	2304	msedge.exe	91
PID 2304 wrote to memory of 4600	2304	msedge.exe	92
PID 2304 wrote to memory of 4600	2304	msedge.exe	92
PID 2304 wrote to memory of 4600	2304	msedge.exe	92
PID 2304 wrote to memory of 1456	2304	msedge.exe	93
PID 2304 wrote to memory of 1456	2304	msedge.exe	93
PID 2304 wrote to memory of 1456	2304	msedge.exe	93
PID 2304 wrote to memory of 3824	2304	msedge.exe	94
PID 2304 wrote to memory of 3824	2304	msedge.exe	94
PID 2304 wrote to memory of 3824	2304	msedge.exe	94
PID 2304 wrote to memory of 384	2304	msedge.exe	98
PID 2304 wrote to memory of 384	2304	msedge.exe	98
PID 2304 wrote to memory of 1232	2304	msedge.exe	99
PID 2304 wrote to memory of 1232	2304	msedge.exe	99
PID 2304 wrote to memory of 1232	2304	msedge.exe	99
PID 2304 wrote to memory of 3788	2304	msedge.exe	100
PID 2304 wrote to memory of 3788	2304	msedge.exe	100
PID 2304 wrote to memory of 1804	2304	msedge.exe	102
PID 2304 wrote to memory of 1804	2304	msedge.exe	102
PID 2304 wrote to memory of 1804	2304	msedge.exe	102
PID 2304 wrote to memory of 540	2304	msedge.exe	103
PID 2304 wrote to memory of 540	2304	msedge.exe	103
PID 2304 wrote to memory of 2792	2304	msedge.exe	104
PID 2304 wrote to memory of 2792	2304	msedge.exe	104
PID 2304 wrote to memory of 468	2304	msedge.exe	105
PID 2304 wrote to memory of 468	2304	msedge.exe	105
PID 2304 wrote to memory of 468	2304	msedge.exe	105
PID 2304 wrote to memory of 896	2304	msedge.exe	107
PID 2304 wrote to memory of 3448	2304	msedge.exe	108
PID 2304 wrote to memory of 3448	2304	msedge.exe	108
PID 2304 wrote to memory of 1212	2304	msedge.exe	109
PID 2304 wrote to memory of 1212	2304	msedge.exe	109
PID 2304 wrote to memory of 1776	2304	msedge.exe	112
PID 2304 wrote to memory of 1776	2304	msedge.exe	112
PID 2304 wrote to memory of 4064	2304	msedge.exe	113
PID 2304 wrote to memory of 4064	2304	msedge.exe	113
PID 2304 wrote to memory of 1132	2304	msedge.exe	114
PID 2304 wrote to memory of 1132	2304	msedge.exe	114
PID 2304 wrote to memory of 5356	2304	msedge.exe	117
PID 2304 wrote to memory of 5356	2304	msedge.exe	117
PID 2304 wrote to memory of 5356	2304	msedge.exe	117
PID 2304 wrote to memory of 6072	2304	msedge.exe	121
PID 2304 wrote to memory of 6072	2304	msedge.exe	121
PID 2304 wrote to memory of 6072	2304	msedge.exe	121
PID 2304 wrote to memory of 3356	2304	msedge.exe	122
PID 2304 wrote to memory of 3356	2304	msedge.exe	122
PID 2304 wrote to memory of 3356	2304	msedge.exe	122
PID 2304 wrote to memory of 4228	2304	msedge.exe	123
PID 2304 wrote to memory of 4228	2304	msedge.exe	123
PID 2304 wrote to memory of 4228	2304	msedge.exe	123
PID 2304 wrote to memory of 2840	2304	msedge.exe	124
PID 2304 wrote to memory of 2840	2304	msedge.exe	124
PID 2304 wrote to memory of 2840	2304	msedge.exe	124
PID 2304 wrote to memory of 5216	2304	msedge.exe	125
PID 2304 wrote to memory of 5216	2304	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://geometry-dash.en.softonic.com/
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9ba6ac188,0x7ff9ba6ac194,0x7ff9ba6ac1a0
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1944,i,14909051828097571001,5240258657595470708,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,76752186967724575,2872260251867277410,262144 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2336,i,500081900616477048,16210154209094947946,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,4708005237991899082,10426764217056083149,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,15586293701000499684,11584845250570499492,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,9410333183889890833,9457957687213685419,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,1375044530173570209,7361738246168290245,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3684,i,12557667993907074193,8098307536637503465,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5144,i,7738365078826680408,12684063957011805273,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4992,i,9291950402759756816,1903566499988111412,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5452,i,11410377874205375431,15504243169580019651,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5632,i,17076733128709179124,374938918132450931,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5636,i,1533392496704991220,9069058685306209886,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6268,i,16503785017385333470,6360822543970434870,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5436,i,17792983014996954822,1695482178585253966,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5436,i,17792983014996954822,1695482178585253966,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3536,i,716617630694328972,8109551406597308831,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3636,i,3814521385549126724,11749353666304247348,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7100,i,5469152226358705388,13711432554870600485,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7152,i,1029612550505536168,11816592832862676335,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7076,i,13702968991695362434,739459689217411292,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7116,i,17461923312500030295,12395690696859858195,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3716,i,2312597634777024691,12361184530466308453,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6732,i,18270172138501353637,14806680420225125293,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5352,i,8500161798675768762,16653306085196322373,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3640,i,17991757275518587828,3927852090800915106,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4744,i,8379203022106181216,11485140076176883292,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7336,i,9874238111856239737,8767465657649108313,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7592,i,89256223856255716,2589884913062292928,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7716,i,12345247758815564428,4223106292634793809,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7628,i,7524408931298711261,10994514547676325542,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7548,i,5096218505195771308,16628683524972693261,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7524,i,3016352857414344971,16621589772877247220,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7260,i,11709764204927062182,15550936266983373622,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5232,i,11585124023930705151,15969706333538609116,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8004,i,996626309433466159,6965217905219398400,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8316,i,4944925883858473134,17819825309567939228,2097152 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5740,i,1420056225907767630,8047721366465562368,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=8564,i,4050841535826246382,17456678847386969633,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6576,i,17624869431703116012,15223368479141942199,524288 --field-trial-handle=2348,i,1810463929213944293,7068602125634976270,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:8
  2⤵
  PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9b869c728,0x7ff9b869c734,0x7ff9b869c740
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,3236442995287127775,11899636531964155426,524288 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,18037354505940405416,297306845125005758,262144 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,8943154784050702962,13511227158538313050,524288 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15541179696054235775,7728341006255135691,2097152 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5721356146930580147,14432647676682234424,2097152 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,772226788391536534,7543123721823700260,2097152 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4580 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,4773179680061137539,4094496045956121136,2097152 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,1852810584809508073,16719969594344714826,524288 --field-trial-handle=2100,i,2226916650939278756,1050492465119839511,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:2792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ff9b869c728,0x7ff9b869c734,0x7ff9b869c740
  2⤵
  PID:2960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2304_1135624217\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 36d37a4f3db537588ec69a489da93506d94c577b4f53bea7ea39c3462654b28b
MD5 789544b272d42a7ffe9a443caab0aa00
SHA1 d378b39df3fb41aee2e3a60ec3332cd08fcf162a
SHA512 fb02fa3810689423f9c391285e2090241ced98a502159a41f4c729bfb827bcfcadcf11953f8fe742392051a49b9db58f49204b4140208cbca1223731290bb151
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8ed9a66f0a81a45ad3c24e8661beaebc66b0f57d9860c620f5286cc172cfcc68
MD5 58d3ec2074cb7737f3c9da7d9c3d7fdb
SHA1 484aed9c2a0f7798dff6a4fdb96fcc8039d27f88
SHA512 3cec5c6e166e50b25a4c53b6f3e03e7d7baabc9e267947fdb17ac2abdcb9892cf03c54c7edf23b7c4afb27f3d68bcadd3e7b90b32f36de5f42ee720b6e638010
TLSH
T11BE02B9ACD659C3709FD175920845345E70503971B61594F3B3D820C8FB063A528AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b12a9ba9e1eca703e4a842cbbb5c36173a0b5d73be10403bf6dfd674a2265492
MD5 4839b85cbf6b36f18d8b93ca8aa2458f
SHA1 042581028ef6f1797f5891fd270a84223a58191f
SHA512 92aa596f35256c1c1caa47f11544461138dbae4b4d585ce9aec4291306cef6915320e6785b1be57057a9d44c7b242226b738f44127649a2277cfb719355c6c38
SSDEEP 192:CRJiMfGDqjL1v7rpAPRp2O9+Hsb+WNnUjnqsIaFbVyIsnAUgtaJ:CRJiTDKFfUXlEwknyaj8
TLSH
T19A42B61DA9186A3B9DDBD21EF9617717D7F6202172842E84E6F8CA2C14E75CD231702F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 044e0e62feda0436a82391c22a7012e8f7fc7f8d8f990d689cb6d21dd3404062
MD5 7031d41695acdc15470223b92eeb688c
SHA1 97c62eeafe39588ea617f4b5faaeb41ac405c0cf
SHA512 e30e30e1e22b13d3ecb6fe6211a1510271bba076d3a1941ced171138bcac2923897b2d9e7ee6feca3b7adc36344bc9627a85beb2c94b51567d0649ca27ebdb67
SSDEEP 3072:dzcothHWNfF1sE1hE5i9v8qvaJFT3Qw/xLANk0mUW5GmRntSFCjEENo:5B2daE1Ki9v8KGTrOk0HOGm/SFyEE+
TLSH
T1BE1412B6CE0B46F3DA7E82D172BA140ECD1597C9707F655437D88B4EA0C52881762A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ced6831135a898738699a9341d5685c38bec2282e298c4b789e5a5d19fc284c1
MD5 14f73e1ed660f5bc8ebbc617b7563b34
SHA1 2687d2b7c47a980bb4efedc8e8fc60a28ecfb02b
SHA512 2e7ac812c9bf37e7aca138d7031764602c754bb3427927b211723c935da815d3fd49e13619598c9fe0da4d1a5cf9e053384a86a93dbf550cbf11f5974a73b5f2
SSDEEP 1536:jVBTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:xN3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1679302BA5E174AE7957D4A9176AE7809CE12630D70AFA8CC315CA38C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c8dd690-40f2-423a-87ba-688e765ce240.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c8dd690-40f2-423a-87ba-688e765ce240.tmp
Size 8KB
SHA256 d723212ba2b9ab087228032d294d3c16843b22e365d8fe7dcffc44ced165c34f
MD5 9054dbd520afda98da0b8cad96ea8b53
SHA1 c36fe989cdb45ba8fadf714b98141bfd0f581383
SHA512 f398282eee3b94337eb909dda7742920ecb956d2d69874815d48edc2a33a3ad4e7ff62f360b99aa5675ae3276910e233571ec0d0575827b926602e3038e7e54d
SSDEEP 192:FON06Q6QmiUy1JoZ/cOQ45RuAF4RtnJrrqevFU6:FON06r6oZ/cOdqk4XJbvFU6
TLSH
T1ED12F775A8781C779AF2AD05F48777139FE4107BE9862F84EAD81E0C00D7B9C2346835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 11e0fce6093b1531d4ca49fb96a1f25c1b8b059eeaad56cfb9af40c88b0ed85e
MD5 bd9280871efb12b3156bb174e33218cd
SHA1 b9c2af16ac98ff22eeea44f3dc6361b0ba4d3696
SHA512 c5e171c1b918c79f13ebafbeecee2bd1fe3e7fa1b6b5b167ae5bc386b014b0adb0507e30ed7bc5edbe1e71a45c05c47dbb1f8456cb68a94aede7413e0ce8cf67
SSDEEP 96:eGUUbe3I77bcvotJJBhnltoi0jyrYjmCg6VvHcStgpTQauLpsKw/P9tyFrMeoyHT:TbecYCJFvivHjvCKa9GMZydOg4nk
TLSH
T15E12A326F7ADE450EBE4803212FB1A867EB44B8625932F5A34F6503C6512FD830FB871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5916f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5916f9.TMP
Size 3KB
SHA256 9721e703f75a828149f3f45c389b95a2ec4190ead8b176834bce865617fc284b
MD5 0f7e1fce95512d8884a9d21a65cf1794
SHA1 99582c09cea54aa89123faf8c7942b333e7ab49d
SHA512 d31e62659f6daa3293744ef7b5c0cf5aa08189a817d75438ca694a1c97d3e771bf4e20d08354a5687c2f5efdf11d8cbe75dea426115de4207e175cfb8adae910
TLSH
T1F3612B76F36CC2A9E3E4017255F931853274879B35330E6936F5953DA616F2E10CA830
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 f11cda34199b76c35ad52daabab68e60d203abdb8494eeb631d0a337a0a895b1
MD5 c410061c12aec73d6fead09ac34144bd
SHA1 16416ac88d600642be6f9246e9f94e619c985f8d
SHA512 2702406ddec91367a6aa6823a1f195766154708ba991e29852da6a50400d6a738fc66960e401170a0b68139fb9c6c1688b0ae9b8428258fc2c439fda187fa46b
SSDEEP 384:DJyuM9Yfe1NeYFLWlPWWdSYeU8YdJFJNi403Pj9pYif9oYvU9VZAH4m4kGV57Hc7:rrEO59uEN5kOQ
TLSH
T1F9728DF3C3F4466DD92252F4AA153F1FCE2D0955832C3D6A89D4AF1B93E2470E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1041bdb254053e822d663b1f87646a1a3a3611a45b2e715d9cd1d3c0da9bb47c
MD5 d055dbddb79c8cdf31f133d973b09030
SHA1 3b075692f49a878231f76aa45d71f2cf4fb18906
SHA512 a851b8cced8264fa7cdc4d0e394ba376043ee639bb71c769fb66ae399b16624a17d680b200ece598493f48a363ef142bdffec355ee87f07a984645ce84ec8f7b
TLSH
T15CD023E317003075B55D5F958097EC8FC72601194493DDD411F05C5C5D75C5C1507141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58ba62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ba62.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5aaf9ed7a329a225630ff38c24cb13cf2bcaa0cd835819a55e89b5cad68db63a
MD5 74303fc553a677651092c57f267c56f6
SHA1 eb84176cd0b6c7ca83c5433083fc33053bd131e4
SHA512 ef521cb8024f7dcbefadd299aa051aaa4a81722ca0e77c6be33859eb855e9ceeb381772ede706a321a854216a7bdd30fbc0dd2ba40a3309a7320a36ff3d8d2ca
SSDEEP 192:sxZJQUnnR5yM//K1Ml8MWOM/fasxvIkQkk2buudpmUKHW6+WNs8SqMJ/3xTlt+kt:sxZBnnHuOM/fasxvIktkJe6Hb+f//mc
TLSH
T10C72E7466634597B8DDBC22AF905BB53D6F84463DA940E85ADFC8A0C04E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 8fbd8f6e70c39b8faf9fc3cc6edbaede6c892b236cdd46555144d4561c1a4862
MD5 f23d381c69b5813d2c9fd0d8809e59b4
SHA1 db88a40791f54e1a18585cd4ef67ab6c560d3322
SHA512 f9c6e8a471f01e3ee8803dc7d3105480e1f1278aa8aa55824a55ec43e6fdbae1aba5c00e04ea25eaf34487f58b8f35223f23f06e7519a9ddf691a80cd0cf4cbd
SSDEEP 384:sxZBnUHsm1M/fasXvIPtkJkkHbTfw//M4RqQ6:s5UMm1M/fVAwHbmlR16
TLSH
T189A2D6935624C977CCCA8619BD31BF56D6E90463DE910E8D6EECC90C04AE6FD2612C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 655fe9a75e5207b536d71c255f2063c4d0d21c639e4a68a578a33a0b6fe3a652
MD5 55e7ed65ddb3c9aaf6464c9c9d8c3793
SHA1 e193f2058fa355fdbeb78e52563858e59fc32bb1
SHA512 d8f13049ce521acdf0fc4dae7b693f92cddca38ce7220ce01694d1dca37bf7e0ae2ea9529ace8b6ffac051b9c827bf8a045ab8c3375fb52bcdb11f1a008429f2
SSDEEP 768:fLsal4VWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8oLl6QF5frofWnA:fLsal4VWvNT6Du1jaToLIs5MfWnA
TLSH
T15DE20B3F680CCB7E4F840E5CDC2A6E976DD801CBA6984D9447EA884C03CA7EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index
Size 2KB
SHA256 1c8899ce6ffb48ca21251a08333034ddce8f1a52f8a8339e6cb340345328b523
MD5 fbd5d54b4b9f65d89697d5a987f42068
SHA1 58bc45b9d68692a4ec42f715c005f2a70ad63d26
SHA512 59522066065b194c64fef52ebd519ad4d1fb17fbba9f2d186fdedbe1659a95e4761fc465627ee37550a21d6114f8a7338bd6952feed2a5833013d4d6879d8a32
TLSH
T1A451099D8C4A5E17EDAD42B264F6046C337858FD1B845707BCFC22788C8B26E0DAB308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index
Size 2KB
SHA256 3ea18fcdc737b3a87e73f5cab797ba6682e511d8d406028576394c41997efec2
MD5 b5cec75bde109254fb0138d6325a7a4c
SHA1 6e68e4a5f2916c7f63b08832a2158626f53b5e7f
SHA512 dbda3176ef1775b6190de1e84903995e928fc8d493efbeb7918529695ea5799c38b3805741eeaf3166a16f64df2dec0ce9bf67389c7736d122bb96a7df0a8ffa
TLSH
T18A51C81D9C0A5B31DE78157308F7184433B8A8CD6FE44B1BEDDC59B4641222D5F1D526
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583af1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index~RFe583af1.TMP
Size 2KB
SHA256 c055482d61961e8647e02ea04bf72cb68fa35958fdac8d82215c4be504b9a527
MD5 5eec6abce02fa5eff6e0958ca31c53c6
SHA1 fa5c1290b96ac18e732c2dc7bf1baa3964cbff0c
SHA512 69b7b21f0977822b97cf5a4eaad0a69f233bedda76cf05db93863c456acc25cca6c7ba2a2519a1473a3216327d853eff7f9cd5fa836ee751ead1f25ccd3a7fbb
TLSH
T1C051B65EAC424A22CDA081B399CA2469333D68944948AF0734FC8A33ECC77AD3E57345
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86ef5750-3d17-413c-b5bd-3e678b3c684b\index-dir\the-real-index
Size 72B
SHA256 7f5de6710ea6a2ab7074f3e5847133776485e61e571aee63b88cd68bb64b3849
MD5 ecdc7f11b329e2d27943614b13521818
SHA1 c38dcc86d83f7578d2eb4cef3a5ad724805e9653
SHA512 84699e1631dc6d7aaf24904106554a4a13ae37a1d8af39081d7b317969beb77397cd770faff6320311689c2986a86afdbf41b9cfcfbf9ba9537f87e99f76ceab
TLSH
T155A0022522C04446C00B2AB1359761472A119A141E11530543E002C9C864647C99134C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86ef5750-3d17-413c-b5bd-3e678b3c684b\index-dir\the-real-index
Size 72B
SHA256 d88f746353080a928bf4d310c9721b2bf5fa838f9b6ddc05760a56b4bb14f871
MD5 83734a1c1e46384b6f36b653fb9b3cad
SHA1 8a3014ee9c5aa1bfcec8fc054ee3477adf276500
SHA512 c32542b15ee0b35a08780a52be211e5fa4df560fb4bd23ab72bb26f5b6f511ff54f4448b2c27a1a5458e91443743874ee12a0ce771e9d1909712ff8f76fbbc16
TLSH
T1E5A0022017844047C0169EB1159276855294CE101942A71650D51066CE5059057414AC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c3c57ef975e41397e455380f6e6d2d4d0adece7518ad954edc7d4414341da9c7
MD5 382a60e8d8901af850381ab2266bb2c3
SHA1 3aa77510a8523a82412ec5215b24d393feb100d0
SHA512 45ba62735d1fdfab011d3aea3ef1ae4a76bef3f552869e04c23124aad33528e162b4fc686e7c76bf7b4161ab3957a595fd27288b0b12e5355f48272f9eaa08a7
TLSH
T150E068B22EA62C18AC2BC3D2247094E00101B4188700DE9F213AB3DF41B13512409C71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 716f4da76348a9e0c4aa2320f25b9953ef76dd18e645d88020ac68b936826570
MD5 5d999f9d655643f969a2d6a8774a4af5
SHA1 64987aa052466b2e6ed8144cbbda90ce8ec8c1b1
SHA512 a68cfc9c9a63ef4c53c0cc14e0e7c3023e31f6372882ab45fcf8f84134180b8c89e27acc3a0431f8ab0400a084c9c1433cb6d6d8fff5a6d177ccae6d1e6e4cef
TLSH
T1D1A00279C1566149D0181B7491B2929CB6219955070B221161A41AF8A855E514173447
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5893ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5893ee.TMP
Size 48B
SHA256 7014d69a557f279ff853e43554cc37e8daea71132127107fe62edfa96d94acf4
MD5 0d896639fb2649f1f9b2b0eaf9968fc2
SHA1 5e9890634714eb17137e5f74449f3b29bb4afca8
SHA512 e454e54bb8f64713dfcb5e69f85905511dbba9c5b165371a4035045cc324264fb8e2cbeab353e5ab7234486f451d3b05ddce4000e9920502cb54d48bd05c00be
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5d54291d9a8c3c7fc4b1d7a477ec43d408d9e9485d5b4891390d535d2a2e7bd3
MD5 8edbfb5e93c14a0d993559eddae3839c
SHA1 de72aa0bfb48ab67e76ab7369194aad9a3cd5ac8
SHA512 93949cdcd7124103bec026245052b8115fa000b5c6f47de04f7af208887b02003760305775e66c9e6a75d3c95e2ac17190cc71d917ba64baa5d0f64e7ab6fce6
SSDEEP 96:KoleKm8wnyKAEemj2K4UXrKKE0e1daKecA:Espp9p09
TLSH
T1D4D138D0327E42513A7E684A91D4B55FA6C131937168A43F7BBC10A24FA7E50CDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59118a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59118a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b4141232668522cd2a1a2dbd5f1a8b06fe5713c907e56fd0381100742aace8ef
MD5 6cb7835335135fe45235cbe56245e259
SHA1 ff5c2fd609d7526aa8d1f740376afec89216c917
SHA512 bbe0a5f2297fbc37353efa6fb77aa49e3bf2d03e0e0b59a914f0881138d8fd835459f859494680639f68cc3ba92cf1868da8192079c047b4ae5c6443142e6996
SSDEEP 384:ncjccCs+Bt0S3vsNBOTREKH3CEE/cOdqkMTJbvFMvPks5f31:accQPUKSvkOgBT1vFGT11
TLSH
T178725A3668B41D3699F7A909F54B37039FF410BBAA812EA4EDD94F0D04CB6EC1306839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f86aec955e25e32b79450419cbd7c0a3bf6a7b663fff1358096198cafa994065
MD5 05206d0e58e49a806bc618fa2e664cce
SHA1 1a38dcbefef8a3a1e044ed3b2dbab0a70b9cf30b
SHA512 c574e67a2468765ec7eeee89a841951c7ba1227d4822881dd7f28524c09eb7599de7b2a4a5d2549478c5bb1f2b7720c439078455f4063cf5fce623082d9d06c3
SSDEEP 384:nliFJjccCs+Bt0S3ZzsNT8TUNTUlIlOTREKH3CE0DfcP/cOdqkyfJbvFMvPks5fF:sFJccQ5iwgNKSmPkOgZf1vFGT11
TLSH
T1FBA20976D8A48E3BEDF39B85B64776479FE000A799896DD4EDC95E0C00C76ED030AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebf35797737d9344a203dfe2387560da4dd96f1ebbc2f6461846169954d3e28e
MD5 95735a341dc403166750d790b69bb287
SHA1 70013b56f7ef37311add4bb03bc2b73674236113
SHA512 a29c3e6749a4918de11e3d8dcf6238db29aa72c2ddadeb4fb9ceb818a578094f22f7bc46ea32c89c83cf56e5048dd7d1cf33f530b3a7f7257d606d66856d1bf3
SSDEEP 96:ZqONk2Qsjpf6go55ih/cIPURHl8h4otop5yiD/B2PAveRPfqNCYzOQCZ5R1zRxMj:gONu6QaQmiUyhJwZ/cOQ45RBRxMvGqU6
TLSH
T12902E935A8782C7B8AF2AE09F48727175FE4106BE9966F84DED81F0D01D769C2346835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 f6d78190125bf23b16b93f8a0e04464dfb6d4bb4cb94f5a2bf60bd13653b8f49
MD5 ff12696bbe95d99dae8ae77586dc580a
SHA1 9bf6ab41829727259550e88a46a77ab1da6f4b27
SHA512 8cfda0716a62b510ed4858c89de9875a6e94d80240f7a6836e1a5033103c6ab2aed33c3be281445b1ba53a6f4e8d7b058322323ce7f38ccdbf4080355ab646cb
SSDEEP 384:npsNBuTREKH38p2E/cOdqkMTJbvFMvPksD:pqKMphkOgBT1vFGTD
TLSH
T1D652187668781D7299F7A909F90B36139FF410B7AA852E94EEE94F0C04D77AC1306839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f634d09119463c95f99bf554f4800ba2ed0bf4b75e6ae96e86290994d394d745
MD5 9944c77ab478abbe4e4e4d89956ec830
SHA1 94d6257a485829ac717133ed62e3e09ab9577f6a
SHA512 35d53395d8647521bf7d689c66261166083c1d634cf90b0bc5f6858a937eb9b8e8b4f7b06b41f0273f9e1ccc1b4bd61a2d62d593a826b4b0b7e1cee3295f661b
TLSH
T17BE00263930050F8E41803310083931533D3D430117202065C0125547C038400D38F42
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ca27ee64cadb88307759efc82e684120eae2a064f64983fcc21aa7a2d1995bcb
MD5 c5424a6ffa70a9a9dddb0f6fa006c783
SHA1 111a7eb4179573f75ebaad1adf3fc598f0a90115
SHA512 cafdec847e260425f2042bfcf0353c341e2c86b868f0a26e5b70b67445df0c862cd2962eecb63ca73a5f0b74bee4c9c2880a60dcdf78ffa5b984b6849bc22694
TLSH
T1B2E00263D30050FDE418073100C39B2537E3D4301273030B5D5136697C17A401E38F82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58871d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58871d.TMP
Size 392B
SHA256 18d105d05a434e8894f78b0ae21e76627e0f225af4f0acbe2bace34f54b3e497
MD5 428302a43d49a338498d91a9e325da15
SHA1 5a7a5a56739f3dfa1f237cb405f712a64a68dbb1
SHA512 cbcf0479e258264336bc1fb8da8f9ebf1bd6a272be26709d418252fafa58b0c00b7f2bce3e449e0bfce0974594cce7941dae619dfb5291a739288e13b5a45519
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ab909e8e-4850-4de8-aea3-44de4dc00061.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab909e8e-4850-4de8-aea3-44de4dc00061.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4b18c9f9bd31004cbae486a6608b55ed449bc659f677fd264793bcc488b5e519
MD5 93657574f9e9a49e78745ab6170ccdd3
SHA1 73642247a2bced3b2af69705bf0f0508235ee88e
SHA512 1c2776bad4cf7d41d91471855fa3d229f9b8649d198242d57947b3f3f20ceee6d8fae63cfb8f8ed8e3b4f39de916010c047ab325411d3beeabacdc6666fed3d7
TLSH
T1AF411798AAE91148B3B76E5AABF6686D447F7D372F07C45E00110D4F0A62B40C961777
MD5 SHA1 SHA512 TLSH

Submit Download

15e8e111-7968-41af-9661-9703db4da930.tmp

Path C:\Users\Admin\AppData\Local\Temp\15e8e111-7968-41af-9661-9703db4da930.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d37803d4-c2a9-4c78-ae50-d42b7df18b6c.tmp

Path C:\Users\Admin\AppData\Local\Temp\d37803d4-c2a9-4c78-ae50-d42b7df18b6c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a5809877-b00b-4319-868f-60ee567174aa.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2304_1913421159\a5809877-b00b-4319-868f-60ee567174aa.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2304_2048719387\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download