vidar | b6ff9c7b9a93f045a947ebd1246eaf893f3fe8c94a77bd184d1e28ae551ec32a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.0MB
Sample260421-hjha9adv21
SHA256 b6ff9c7b9a93f045a947ebd1246eaf893f3fe8c94a77bd184d1e28ae551ec32a
MD5 8b4843ffeff0abbacd2c238be94712ea
SHA1 10dee3d6fbe77368bc7b15a20fafe4ed84357480
SHA512 5a11d99fb9112aade2347f5509c896823e13ddd9ad36b859adbdac2d8e8836e8a2b0d19c8559a06af2ce3dc90e46d7d98918462cf484e580de614fe5ed629525
SSDEEP 49152:/PJSIMO9Rx5f/5/P12nEv2nToSP6ymycY5:/BRTZ/P1iEXSP7TV
TLSH
T110A58C667CE144F6D46AA3338CB6629277B5B8480B3223D32E50BA783F727D49D79704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2700-1-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral1/memory/2700-24-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 4476	2700	file.exe	130

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
564	chrome.exe
4604	msedge.exe
2008	msedge.exe
1344	chrome.exe
516	chrome.exe
1188	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212276769384524"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{A14F353B-3CCC-4E8D-83E9-9CB02306B666}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
576	chrome.exe
576	chrome.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
2700	file.exe
4392	chrome.exe
4392	chrome.exe
2700	file.exe
2700	file.exe
2700	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
576	chrome.exe
576	chrome.exe
576	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
576	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 576	2700	file.exe	85
PID 576 wrote to memory of 1672	576	chrome.exe	86
PID 2700 wrote to memory of 576	2700	file.exe	85
PID 576 wrote to memory of 4428	576	chrome.exe	87
PID 576 wrote to memory of 4428	576	chrome.exe	87
PID 576 wrote to memory of 1344	576	chrome.exe	88
PID 576 wrote to memory of 60	576	chrome.exe	89
PID 576 wrote to memory of 60	576	chrome.exe	89
PID 576 wrote to memory of 3248	576	chrome.exe	91
PID 576 wrote to memory of 3248	576	chrome.exe	91
PID 576 wrote to memory of 4048	576	chrome.exe	92
PID 576 wrote to memory of 4048	576	chrome.exe	92
PID 576 wrote to memory of 5116	576	chrome.exe	93
PID 576 wrote to memory of 5116	576	chrome.exe	93
PID 2700 wrote to memory of 4392	2700	file.exe	105
PID 4392 wrote to memory of 392	4392	chrome.exe	106
PID 2700 wrote to memory of 4392	2700	file.exe	105
PID 4392 wrote to memory of 2752	4392	chrome.exe	107
PID 4392 wrote to memory of 2752	4392	chrome.exe	107
PID 4392 wrote to memory of 516	4392	chrome.exe	108
PID 4392 wrote to memory of 1792	4392	chrome.exe	109
PID 4392 wrote to memory of 1792	4392	chrome.exe	109
PID 4392 wrote to memory of 4156	4392	chrome.exe	111
PID 4392 wrote to memory of 4156	4392	chrome.exe	111
PID 4392 wrote to memory of 1252	4392	chrome.exe	112
PID 4392 wrote to memory of 1252	4392	chrome.exe	112
PID 4392 wrote to memory of 208	4392	chrome.exe	113
PID 4392 wrote to memory of 208	4392	chrome.exe	113
PID 4392 wrote to memory of 3600	4392	chrome.exe	114
PID 4392 wrote to memory of 3600	4392	chrome.exe	114
PID 2700 wrote to memory of 4332	2700	file.exe	117
PID 4332 wrote to memory of 3400	4332	chrome.exe	118
PID 2700 wrote to memory of 4332	2700	file.exe	117
PID 4332 wrote to memory of 1188	4332	chrome.exe	119
PID 4332 wrote to memory of 4124	4332	chrome.exe	120
PID 4332 wrote to memory of 4124	4332	chrome.exe	120
PID 4332 wrote to memory of 3524	4332	chrome.exe	121
PID 4332 wrote to memory of 3524	4332	chrome.exe	121
PID 4332 wrote to memory of 2668	4332	chrome.exe	123
PID 4332 wrote to memory of 1236	4332	chrome.exe	124
PID 4332 wrote to memory of 2668	4332	chrome.exe	123
PID 4332 wrote to memory of 1236	4332	chrome.exe	124
PID 4332 wrote to memory of 4300	4332	chrome.exe	125
PID 4332 wrote to memory of 4300	4332	chrome.exe	125
PID 4332 wrote to memory of 1124	4332	chrome.exe	126
PID 4332 wrote to memory of 1124	4332	chrome.exe	126
PID 2700 wrote to memory of 4476	2700	file.exe	130
PID 4476 wrote to memory of 5044	4476	chrome.exe	131
PID 4476 wrote to memory of 564	4476	chrome.exe	132
PID 4476 wrote to memory of 5068	4476	chrome.exe	133
PID 4476 wrote to memory of 5068	4476	chrome.exe	133
PID 4476 wrote to memory of 4336	4476	chrome.exe	134
PID 4476 wrote to memory of 4336	4476	chrome.exe	134
PID 4476 wrote to memory of 1320	4476	chrome.exe	135
PID 4476 wrote to memory of 2300	4476	chrome.exe	136
PID 4476 wrote to memory of 1320	4476	chrome.exe	135
PID 4476 wrote to memory of 2300	4476	chrome.exe	136
PID 4476 wrote to memory of 1852	4476	chrome.exe	138
PID 4476 wrote to memory of 1852	4476	chrome.exe	138
PID 4476 wrote to memory of 4164	4476	chrome.exe	139
PID 4476 wrote to memory of 4164	4476	chrome.exe	139
PID 2700 wrote to memory of 1836	2700	file.exe	140
PID 1836 wrote to memory of 4312	1836	msedge.exe	141
PID 2700 wrote to memory of 1836	2700	file.exe	140

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffeb0dc728,0x7fffeb0dc734,0x7fffeb0dc740
    3⤵
    PID:1672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,6425138133637516644,5643373324834149060,262144 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1648,i,3001017993203906334,4294000507045187343,524288 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,12357911653548342833,9540467378954905197,524288 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:60
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,7969699300246629679,13193524984078484850,2097152 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,4143877628786063031,18198940325547377143,2097152 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4180,i,6983566368872214700,3917727696839655460,2097152 --field-trial-handle=2008,i,15247569129132798522,14977113294822440310,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4188 /prefetch:2
    3⤵
    PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffeb0dc728,0x7fffeb0dc734,0x7fffeb0dc740
    3⤵
    PID:392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17674661860859134343,10633729790127805986,262144 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,14675055269222060208,5931276363789228981,524288 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,11997992892833994913,13551736935370324777,524288 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,4600887632473746497,10765693891720794688,2097152 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,17489387691074024481,3203832446509123398,2097152 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,227168258872522268,17643198120898522185,2097152 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4228 /prefetch:2
    3⤵
    PID:208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,11697332386685444418,10567143468817776061,2097152 --field-trial-handle=1932,i,2936531678465220464,9485775932561722193,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffeb0dc728,0x7fffeb0dc734,0x7fffeb0dc740
    3⤵
    PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,1631478440190413975,18211238265162872740,524288 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,16537106514965879367,15664125115341152408,262144 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:4124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1327674228648096307,2164532787249597920,524288 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
    3⤵
    PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,9260985893660599365,12739776328855539168,2097152 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,12164146769450354805,5480918516573217840,2097152 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4124,i,2556076023855026575,9547525740252984613,2097152 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:2
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4104,i,14550295312597393834,13301721231153751532,2097152 --field-trial-handle=2036,i,757047765553674723,16336646652690528181,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffeb0dc728,0x7fffeb0dc734,0x7fffeb0dc740
    3⤵
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,10801915314292393101,10428837877122635603,524288 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    - System Time Discovery
    PID:564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,8292330189313578320,4539566897500010733,262144 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,1036134837322193400,1817047863840316747,524288 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,2185696940536422948,3271534167226514834,2097152 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,413744031472238346,14690195753081173240,2097152 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,1776317524601067414,10501611269355882798,2097152 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:1852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,2545310102524068738,576517172628718514,2097152 --field-trial-handle=2072,i,15649847221081525236,1058638245134695570,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d8,0x7fffeaecc188,0x7fffeaecc194,0x7fffeaecc1a0
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,4714666640368031972,2732351911547876562,262144 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8261408113522728500,1350794321422359719,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,1230589651491503368,7649202155502313337,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16931434052064642943,14697065657725459504,2097152 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3451679663166464603,5520918506116431919,2097152 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,8424340966794392225,6514156284069788355,2097152 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,5620003693419946393,4318401977975367739,2097152 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,5216577449880490644,6266596353565785639,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13819038469857470523,6406927725741887864,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,3178094783271173293,12180253138124886932,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,6372887012699588688,7411510837746414744,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12040240323310504033,2109378428609727386,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12040240323310504033,2109378428609727386,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7923842967837017531,17957478912431947456,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15342470320262867939,7666053364918768542,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,10725287267980105074,7589967381057353811,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,9485122896081971207,3115704504962007985,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11737446599535751942,1524746631346404296,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,3103909794463105125,18377603076432806941,524288 --field-trial-handle=2424,i,15524340902701410965,9684569221173463910,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7fffeaecc188,0x7fffeaecc194,0x7fffeaecc1a0
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,16352934260389021728,14983564698471087988,262144 --field-trial-handle=2140,i,12126642309865901720,17558581176106418754,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12190825729454843013,15733272958324777718,524288 --field-trial-handle=2140,i,12126642309865901720,17558581176106418754,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7692690610848122263,11042253109782070603,524288 --field-trial-handle=2140,i,12126642309865901720,17558581176106418754,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:8
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5756880263239062924,6298566369455790225,2097152 --field-trial-handle=2140,i,12126642309865901720,17558581176106418754,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8398996151306956199,1101189940126113288,2097152 --field-trial-handle=2140,i,12126642309865901720,17558581176106418754,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4fd5d530ed140946270170fdf7d661512728c262868b84d775fc44f4fbe643cc
MD5 cb777f6d108ce927a3a5049b67de4c6e
SHA1 2aff4d8db7d4bc8709fcec51e3550b60188bf97c
SHA512 7aaae7f8f5dc4b32e6b04394fea8ca18e72dd428a8ccbc933a49f30aeb0953074a5d78b35cc8ad29d943f02a7c2a9dc8d8fc8bace730a738341be2032bc3c2e2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f79e9f152dc8ea727188c9f30709cc2c09cef79c6b51453e3d4e69b38bc9334b
MD5 3169968b18872722305e0846fe243a3b
SHA1 192931e09ff27c0d321feb6364ebe3a83d4ef813
SHA512 5ee0d4cc2023d2bc5146539778ca2cbb6c8573806d49a610e4897e141312b5c910bb37721c8fbe166282e696c3c5b7c54cec4b8629e2802894392fba6c39611a
SSDEEP 6:/FyCbz+X5iw0CTgvHtTkB4qlq32lcFl+pqPcRT:dyOzc5iw09lTira2ewpqPcRT
TLSH
T11E13462C86A0AB0BC9B04478048A3B30973893409A526A0730FBB5B2298020036AE2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 92325942144f32ccc3621af096de08e38668560a7f14876cde3ca95d7581da78
MD5 b6cd202dd59ce7c63603960746252074
SHA1 6ff4280733362d673dfc88ac50aafdc57462b26e
SHA512 9f3064b74ad3ed26e2b8dcce03dea707451e5cb1beafafcc3a273c2b1916e6920487490b7c1c5f53a7f15592d565c672a6f898054271e199985a6665bf3348f2
SSDEEP 6:/FyiKEK9Xxw9i2CK9HtcBmyekSbGeBhfhBqE48SpS4:dyiKEK9XR2JjcQyeVG8dT4
TLSH
T17013C23CC5194F83C2E4007C444EBB71DB30DB49A9D28127B0FFE1512E42A10360E174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 84a4e2bae4931f63dd667cec3003fd33637b7f0ac2dbc15cf87f49909c89c840
MD5 2f3657d0707aa7059404bf698a29b50d
SHA1 7984e908725b25bc9c87b9d56ac6ea824dd891a6
SHA512 f33670c56ed94258283fc652282a02ecc1112b659e2f69b75fb648146ce67d383ee164e53383e8f9c677705a21ebdfac82de872ba41f1c70056fff1435f0433b
SSDEEP 48:eCqHoECbYSZMCXgloupMiXW1RGxoyCqS8aBCyGyaB8W0Z:ehHRSZ/gloiDWHPDqSCyFaBF0Z
TLSH
T17544A9E72D04D9DBDB3C8BF12C5403388D3293151C959D77F52804B21A89AF33138B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d5dd06f8f318ba103d09530918a40e310a36bee1df3d1653536ee49e5a5de9fe
MD5 4d9224abb37745dda5617a89f667f309
SHA1 9ff947d7ee247ed985d380f0e04ac63af0e7a05f
SHA512 5967f4c74b75b87cc195b7396304cb3db491fc33900f07dd9816f135eb430c09b86c0b995717a1106d9d0ca3901ef1be226572c85e7773b614e1a637c05a77fd
SSDEEP 48:ImUYuZMCXgloupMiXW1RGxoyCqS8aBCyWaB8W0:xuZ/gloiDWHPDqSCyWaBF0
TLSH
T1024488FB2D04E5D7DF28CBF12C544238CD32961A1C95AD77F12904B25A499F33278B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 60b7d8c8df898eabbf94b013e609a6cc018fa9ce188499e71e6fbae9d8d2b5fa
MD5 400aabcd1d689c00d1e878fac30b57b2
SHA1 8b7365c39c48bdaf48c5a31ba46c618eb9dfa4dc
SHA512 97c85d3239846d98ffca9fb9547bf8dbca88e508960badf8524480f4466231aefcd8b399f94470334fb57a620e6fe6d6c848010332e560a6dc41832c7b93892f
SSDEEP 384:JdXNBS+hBFCS+hmqS+hAzS+hJkIlbS+hGdXNBS+hJfDPLGRgcRUv+/BS+h:Jxm4Hd4W454Q4Gxm4JfDPLSgcRUv+04
TLSH
T135164CA70F64A542EB96EFB0FBCDEC1C7C7022D2EC979492911282BA45F1FC417851AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0320d8af6cdfae2a37682f67c5855f3b3aac8d7e6b55324f2475694720132296
MD5 21dd4e79910ca39fef7a5b27f1161061
SHA1 d1e521aba817e803376517f113e33cf2c40db2ae
SHA512 9dfd3c1dbfbe0aadbfac8e3497e0d9d9dcfe21c37f8f60a342bddb79912294e3b6c5ebfd18587ccd42359f2648fb3063d5a2f81575aa0f5bc0b36b5e832d3ba8
SSDEEP 768:4fDPLSgcRUv+vZ4jd4W454Q42UfDPLSgcRUv+mZ47UfDPLSgcRUv+eZ4:ZZk3EBwZZZ
TLSH
T1B6163BA70F64A943EA85EBB0FBCDEC1C3C702296EC9698C2E122527D46F1FC5178519D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 55e880f55fdfbc70d10e6f87723f4a9b6aea22ff637037f5b58412bb9d0a1928
MD5 8ceeb1e4fd08d498e26cde493c65c5c5
SHA1 6dc2748e1d746f2f1d66e48a3993e6ae2f860108
SHA512 af7b64bd7bbe0eeb1377ade86b86f0363e5f7bace1cbc0645eed9914db7761ca43c8b18ec6503fb45e4460378d3ba8a36f7baa478256862f8f587b67e2f1e2cc
TLSH
T19FE026182E89C1BD406A84F7CB6C674ECAE03408F2D838027709A54425C450571C0F40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 97396c8463f2f0c0b7514460943b08bd4ebcf0d499d170843141fc665769fc1d
MD5 fc93431d245c0102582553c8d661fb67
SHA1 9e8ce11f2135d36a09149b39d17830b9b62eb0a1
SHA512 80fa6185fd4ab65f574279e67b99286ee254a13764a0a2e7395ed55c26ec64859d25a02ada71188e7111581f87befe5d9d340f226ae7486416d71473c0fe8aaf
TLSH
T194E0865D2789C1BD545998E7C768630CCAE43409F6D87822170E99446181A15F2B8A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 49c085222e370c285e78a9414b4b265a55a7bca59ace2af87c80190db3a99fea
MD5 290320e0dfea8a6794f50db91d0fd648
SHA1 fac24cdc9677c986cbc5369bef69eaae51141c29
SHA512 318aed0436ccdb149bf1a9b555798f409edbff6bdcd5b6e247d847d0d1e9a1aefcd9b07c8126bde092e78005bdc72e9a274f85548cde173c916ed43a9e04e7bc
TLSH
T1E4E0D8A4578D82AD510880AB872E778DC7B03408E6DD2E411B08E94464CC20862C0ED1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 3abac3bbe1ceeec308693276bc84a065e5e0c88c0e1455c24e3f114bfbffa4ac
MD5 0d2e0cc804fabeb2b80e62dd508817d4
SHA1 3a9f8250e437309a1895f28108a3cc96bc98fe91
SHA512 9196075f4f65cc4d25bc1cc1407e5a195562abd7d5bedea350486302bcef3e2ff782b500c75691e5e6b6813649e0b322c36b803c571f6d893255e86bf5c54992
TLSH
T1ABE0D86566ED81FD2118A097837C734CC7A03429E7ED29024B049544A08910863C5A85
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 8a952d8881a7aba58d929abcd179c83385025fe12281891b2a3f2eec3449c69d
MD5 9d429e780134e287c17260d4a3e828dc
SHA1 566800df15d63136594b6f40e5d8a3a13fc8a1e6
SHA512 e549ec9a5ee130a66f0f3bdf1a3d03ba0110c9107b307eb0e7a81c83d4fb35ef9e38e7a8f6e2e3ce7a161811bf032b20886818833cc05772fa01d4aad4e18961
TLSH
T19B818D6EA909084FE4AD093BCC79571B6F6DCF1C2BFE3767A9DE860409B455710082E3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 4bfc358ff783b3d7003582d7ec698662b83f1a407378e948cf7ee08eb8c63eb8
MD5 3c5b99909622d31f93c7f5436409049a
SHA1 a4e0cfbf9d4a20d356569bf6cbbbb607bd55264f
SHA512 5b898d7878aa380569dd4767af3a4961d013f6ecdaadc90c72d85062c11ccfcb0651f130ba4ce09c2626bd8c02449b5ecfceb197cf58144c430861cc59ce49bb
TLSH
T11381AD6EA909084EE4AD093BCD79571B6F7DCF1C2BFE3727A9DE860409B495710082E3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 55ad9d8ef2f5c01ac8a9498f47c12771bbd27c874aec640a071f66b2df3fa9ea
MD5 e5efef2942ac77ec73f9a62280250505
SHA1 183cc51dcf80df8ead48282406fe1cdec4a75196
SHA512 3b11609c15e1446725c3aeba9bf5a0eba505fa3724c7942b2ffb3f31a0c1615d94c63932f24d96497c8a70cf3253525bf09cd75cfc7800237f535e9005e48249
TLSH
T1A6E0262437C8D1FD10A980F38735D38EC6E8B419E3EC38223F04EA4611C98087091A40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 d261b9d6ee17a4b7c8f5be0b188b401e4af5be1956ecd73acea2b186f3018584
MD5 cbffa69ddc40161cd2a5c32ae77185b4
SHA1 c717e8d29ac535f15ec388ba4b1771b18c2f4e21
SHA512 2da3d034d425e804a377963f9c3849418fa8f743787d311e5dd00ce5bbae9ef2d6d92e563afc72f911ac569a18a68f65e8ab1aefc7672741b8777b0bceadaaa5
TLSH
T1C5E07DA52BCAD1FD106D80C76734930CCBE8781DE2DC3842AF84CE44D1C5C0A76D5E80
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 64KB
SHA256 7f5d82d6e9c910e8765c92d7d9df5c95bd3585a56907f6b0500fbe6ec36bfc5c
MD5 48aa47d036befbb608461e1daa637984
SHA1 125d4deaefeb1048b483f91d2ede07945743b461
SHA512 61dfc0577f841ee52a30f6be2d58a5bc24d2595824ef3d59cf1d357f510e20205d08357dee2fbd07bc014d14658c84ec24bae109d619f07d438670976ce0e7e2
SSDEEP 1536:sHZhuB2B7HauRY+1KWn8ID+M1R9iwKcNOmrGTNO:nAYGntD+6KcN6TNO
TLSH
T17153B588FAE6B452C36365B5006F010FF239BCAAE44C84A4F185D8E87DB546D8677F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 96KB
SHA256 35716f3ff72ce8f6d1413354ac35aaa0735942620a435d8a0eab864e100c83d0
MD5 cf5c27547f3e4f01698c5ae081802636
SHA1 9afa8b6ff2305b74e7107714bb054b62ff10f35e
SHA512 1fc75576a51976b360005164c4ea576e04bbe4ecaf22e84846fdebcd19e9fb769998d9b1ce9278482489bc22d1666a51f89a5b4d991b5da0729fb93848869efd
SSDEEP 1536:XHZhuB2B7HauRY+1KWn8ID+M1R9iwKcNOmrGTNOoi3qqX+u+CUDEHmSBQhGNe:0AYGntD+6KcN6TNOEE+ucAQh
TLSH
T16DA3E9CDF6A67462C3A364F5002F010FB23AB8BAE44C85A8F185D8E56DB446D4277F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cbcc92667e3d6e94928db94c347e36aaeb521e6a0267c9bc5e59f0e3cc59b737
MD5 c727e36936b7a86497f79e0250337cd1
SHA1 a60a14eb0a782543222e9f271b257d81d6b4e310
SHA512 2d17f108a446783ead307b1f4576331dc4b9c6105744c14c41ff5fe8cf631f1c4b04e875b089fd87ec99a4bea440ce8facf525cf87d2b5be5c5a2ef578490c3d
TLSH
T10BB0222CC082B382C0C203B820A3A8C83032CF20CF830202C2E00E22EE322300028230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b552f27bf9d51bfad81bd62ff2d844020af219ee47a84fa18841255ce88d441c
MD5 eea6728078e04acba6b007f3ed3f3bd7
SHA1 e66a0393e256b70176eead26fc4a575c61bf9b55
SHA512 ab1707e412a387c9748481ebebccd30de8e0de67f4553c40d6e4156c647090b51655e426870e216a02a55c650892cf527fd6465b554539bc545684598142dc1f
TLSH
T1BDB00255C106E312C05213B0ADE5D9E8B270DF6DC603261B93E05A76DC35770557A5F0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
TLSH
T1E3E002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 289B
SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
MD5 541c42f1c98b3e1b011d22eba854e707
SHA1 db30188de1f22e3077e7044be1386a5d0ecaed9d
SHA512 47828c1b40deb8d37d6ff4fc8f7673fbb59b40e07f54f0fa4121b91941160134c251e20f7f28f7ee5185f3c8aee2b7e95a1bef573bc64c68912016accbe90604
TLSH
T1B2D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 d654a3259de75315ec87852c51c920383bc0eb8ddd552522a18cb5fd1a7216e0
MD5 a8353b4273929837687f35a3589b5644
SHA1 542d0a683d0a5ace8a0bdbd16aa26be95c189cdb
SHA512 c3ed80862030dcfe103c132e2068baa16e955561f559d9d186973811ed57b985989437f1c6c771940fc6a705423666d50e4d950cab9a0c00131b70c03894a8c0
TLSH
T1FCE086686A89D1BD516880B78779679EC6E43408F7EC2C92AB05E944268950572D0ED0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 a6066480775bd908148b25f54886a91d171bd9e0a39bd7b4ba1ec00a163b8134
MD5 6e145ea05e66955f601416129123bd65
SHA1 3ecb5e9222488adb878b3961aff3815fe272c02c
SHA512 d8c072163e7a1c024526a25d0b172aa0f144c77fc29f6d6bca9c31d3ccf6239c3b3ad3fc5b57d9a658f7df7ae73783cec5b825d4b216c7e0dabddec4fb31a0a3
TLSH
T1A2E07D7927C8C1BD1168D8AF537C630CC7E03419F3ED28035B05C04462C690973C5E90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 299847a670e5a534550b5dcd96e040860b43386dcc5a46defbfff619b53d4978
MD5 f8e44eab1fa4ec58a85ece9148bb309c
SHA1 e91a60f8e44593f4a20e84289454db28dc65ac87
SHA512 4c2f2eb204fb0ac5f0cf4acaeeb91843950d1d892534c243eb10cb2ac00b93c98480d851fe352244a3bc8e335df1ee05404bd01c8a887f1eefa0d13357931316
TLSH
T16EE0D87837CD86BE218950F7D329E34DC5E17414E7ED24263B08F544628D4047181A40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 41b9126d36509accb6063e20a63bc7f56b0203e4aa5b111fd18b812d6f1030c5
MD5 f743f2b196d023f1fed9993ae6840c4c
SHA1 f0341d88ee0659217aba8fdbbca1b49ac3b460c1
SHA512 309463546976d730b2c3475876f8df36ca4a0c61e1e7c11a17c4310d485bfd0c56839a0e9006b60cc4e61dcd04c9b31f7c3fbd3a05c9ed0976472bf3cbe9a82d
TLSH
T10CE0D8772BCA97BE114D84E79329E30CC6F27814E6ED14651B08A54CE2C54047285E40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 3e331c9836090e6a6b7aa379ae560eb18aa751754204712d79a098b9cbc0b812
MD5 17c5518d44dd1d4718ebcb12945923ff
SHA1 821bcea41d541d25aa9065c6a1c45d49135694f8
SHA512 ce4d5c0493279a43cddcd377b464914414278f6ba6a8f2728d4677faf7c2eb204782ef40ed23de6c8623af7b369980a63eb911006940da1c80814a0e0279c8e2
TLSH
T15FE086B867CDD6FD3088D0E3C768A75EC6F47808A7D9755A670CA448758A50871A4E90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 612bc13caba73e4865c325a579327760a639e4c2037d5a9133532e101106fe82
MD5 7f1234c55de403e1bf420661f9bb1938
SHA1 7ff5e35b9cf698a29402dd37abe582e7c6be0633
SHA512 a6509fbb20685ef9ea9622e9e3d4902ccd5439e6fd36fd21210111ac7440ff786115844f79cb9ba40ccb3a710fc690cdcacf230542d35bba38d9096c9dd0aa83
TLSH
T175E04FB427C996FD104888E2C774B34DC7E46C08A7D9259657086845E2C250C73A9AD0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 e5e7ed8c987e15e60a46f3e78b7c03f6f4671ac938a632ff4b0f794df047b6b1
MD5 3a17ff523de7bee0bf35ac32c8f08525
SHA1 1b482401ed07cbb47cba31e7d7a3bcf4066475aa
SHA512 3c8221a9bd543ea86c92d89b45d6d665ec633412ad039a1b09a19b8b7e8e3c48eb4476b7d0d2cdbeb1bae8541d20d2eacd82761fb68c40dc7e2fdf5f3f153482
SSDEEP 6:sJ/fqVkCcnsuclDLul6rWc/XKuqHKu42IbzSrWc/mLEJOgLEJL09wVdHqVk3:sJXqVkQFlWlQRXXwX4qRmLULIlVtqVk3
TLSH
T17642229F7C419466D891003DC3DDA68228260B683A43399839E98C052CBE7078804BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 4af219476f19cc85aa9e8a285e398330b2206c807369845ab200b2361bd8a3e6
MD5 cc757b6d8d91f77818c8e8719559a56d
SHA1 11e791e5f29b8959f7443e245f06ab7ca9b32cd0
SHA512 3948566a944e73190ff7463d14147286fd918646dab9d90fbcbb9c06076e62316092ae38c6976da46034a14279bc468f849b225fdf0013ad75a621c7c49bbce9
SSDEEP 6:ksXqVkCcnsuEsJul6rWc/XKuqHKu42IbzSrWc/mLEJOgLEJL09zHqVk3:ksXqVkQxlQRXXwX4qRmLULIcqVk3
TLSH
T14642228E7C458466E891003DC3DDB68228290B683B4339D839EA8C142CB93078404FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 25KB
SHA256 77a4cef9de3969c571539c2cc1b4758edd7e38bb3133bb2041fb52dd65ac0374
MD5 bf8065703d53da5096eb91ff80be29f0
SHA1 6e47537fe36f5a18de57b6b2e8c68c7e62f49661
SHA512 9527fec082bf536d22a3e0b3df3f2c461ba121bb802681252f80b952a3e615ffae5b4de216609894a85cacedf85ee7f28596c018b1d6fd2b8cbe23d2126f019d
SSDEEP 384:GnRhsdGKljceF0OQvIIIebOMIM1BcTnA2sdGgZ//VosdGH0ZGPsdG59yqt0sdGCw:dl+OQOmtoRlw
TLSH
T116C2C896A3B01B91DCDF97FB7C958C2B0B73DC8F64560001A866DA6E6433E074AC9397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 6746ec0fe6a5f52eebe09f8125e43f820f093507176b9723c1e2157dcc492719
MD5 626b61a5daa327a73c3193fdf31ac89c
SHA1 784966f63c9a031eb620f07aad57840252ab7ed1
SHA512 5cbc9de3188942f12ec0ef1cb029fa5e486cecc9e36cf732f5ee711abaa317660bca01ba2fc5b500e69047ba1111eb37b9eef589fb48b8b05440924c8f2dbcec
SSDEEP 384:GnRhsdGKljceF0OQvIIIebOMIM1BcTnA2sdGgZ//VosdGH0ZGPsdG59l:dl+OQOmtoRX
TLSH
T1CDA2DA96A3B01B91DCDF97FB7895CC2B0B73DC8B74560011A452EA6E6433E074AC9397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 c28fdde3e2313dacb4edd01484e344019dcd7fea544c038ae67ce1134172c2d5
MD5 34fd5582ef3931bd8fe624bf39cf0da7
SHA1 b0606480ef67ebf1f93a931025465898caf5bf84
SHA512 f0766146bb15bc82719e335779dcbfc981735d992c277e69f1f82549632afa4cb00d0ce124d635d0c87a68dd8dcb5f4c34562bba0f3ab631010b35e9ce09489b
TLSH
T19EE0262CBFCCC1FE70A980E7462C538DC6C43809FBE8140E7F04D08C508C80C7180A40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 a0191d6d1f9b60f72aaa5550936f556f35be297c98a3b15b802ece55a47d2cca
MD5 19db8a6e25db3d913bd58eef1fed5e33
SHA1 42f10e407812d4f82da5003e188385a2d5377470
SHA512 4a44ca89ea84af50ef207f9dde14da32f4b43b5456e03c356703a45ce9977c5d8089ef915702aec42da6f8ada65b2e5dfb59fa79f2d04dba6bb62fc1954437e0
TLSH
T123E02015BBC5C1FE501D94C74714634CD7D43406FAE814550F04C688B0C0504B298980
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b18d8efdac6489913a751572d0feed02ab5988ddb81a8d3705dc6b09d2968283
MD5 81169a0b0526d2327d301980e7d065b4
SHA1 93a3ce352a82d792cab18f0f69a8e78f7f5fdfdb
SHA512 a7291e7014089313fcae4296c3f5624ca474c8c0c55ae1d596fad24684dd7f277ce2f14bbed7b90ca1f447a551708513dc832c662f0757055b2f2909d9c5aed0
TLSH
T16A214956F332C208D2498A3AA43E5B250768D4139FF8ED4F55B620787EB2E040E476EA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ff925c7869f400e88eb2f12f7b3e1bcc4b2a9ce535380c63c8d38dfe7b811f08
MD5 ef49e4681800b22900af5fc6b3c42ed0
SHA1 9d99fc8a1ea5a099d7f356d00b10e10722ed9405
SHA512 5c865245334e78b85ae4742a7dcd2d46df029a9baf6fae090017180e345185692216d4b3abc3c9e59a5c7e39212d364df6cfd04a5ea3d2b07c2d4619604f1222
TLSH
T10B216856F332C208D2498A3AA43E5B250768D4129FF8ED4F55B620787FB2E040E476EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 545629a240df78c34a973600235aa3e73d5c83ee64f61e89cc8d7e63d366baf8
MD5 7588a6fe944a1f8bd4904d44c27653cc
SHA1 c2c889a771948c4d016f808e7bd32c483a9f94db
SHA512 bb3a88a189535cf21d3d30c436d45fc4b9d3a4c1bed7e2f6e4423f7dde88193a440aa404faf37c7eca0e3dc1c9065ada1c838152608d40883b8913fcc03ce94a
TLSH
T14EE0262CBB8CC1FF7028C0E3436893CDC6D43848FBE92E0A2F04D94855CC0097189A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 4bcd38756b72c059f2540d2eb4fbaf162408df27c5135e6f0e25f52ef5f51d87
MD5 ecb3be6695f775d100208bfe76d1b44d
SHA1 72e7bfac2d7a7e904a6de41a721bce56e7d7a1fa
SHA512 f85109dd29e74e83992b7da72e29c63f5a14fbdb83771f282bea41481872048f4dcf544bb9841df6362644d113c6401ed034a07aab9d0237c7e51872098b6c51
TLSH
T176E02059B789C1FF401554D74765A34CD6E43806FAE81D110F05CE88B1C060AB299980
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 483f8cc6406de3f8a8cdea8669c165a04774d86dce19fb3d773932510f873550
MD5 6a70e1204e57f02864da99fd0bf93588
SHA1 a75659d9675762a46f6c2fbb8a73eee929630870
SHA512 ba0fe79f92f8a22fab740c828df3a6717fd9c809ba13ea5874ef058008c4c9bdc74f02d724cf5ce41bed2adede17171b9106beffe5f617c5a701c6b9bbe82f0b
SSDEEP 1536:ip/2cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YA:a23Qw/xLANk0mUW5GmRntSFCjEENZ
TLSH
T1DF9312BE4E2646E7997D4A8176AE7909CE12530D705FA9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 01b69f81a28889f57427b9b6f438961b84626910fe82a068f7c01fe1eddb9229
MD5 d3463cd2f6b3dc7a5c3bb5db3a63d501
SHA1 460ec42d9f66335b3c27ee1976874dab67ac5000
SHA512 39bf05cf5449afa27e652c7afecd54a758fe4b2597bb517e3c08c6fef804192c8a684f25c897ab8e1a5e6915c09242a3387b053893b87a4af9703238ac064da0
SSDEEP 1536:ip/xcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yd:ax3Qw/xLANk0mUW5GmRntSFCjEENU
TLSH
T11D9312BA4E2646E7997D4A8176AE7909CE12530D705FA9CC325CA38D61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 2771f344f9083a28addc170aa6fa6808d37d97e9b086961a67f84a0a8a97ef26
MD5 f635c36ea9adfbfaaaa98d93c19821e5
SHA1 f7f84534b745f1224d176f79fe9c0ad5228cc2a6
SHA512 ab51f513818fb257421255d2ea93f4fd49485d8837260c9851b2c2c7228f26c73ad55fcf0386fb1aca34800525ab6770693c76138fb82b7a6ba5686de53f11c7
SSDEEP 1536:ip/ccYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ac3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1169312BA4E2646E7997D4A8176AE7909CE12530D705FB9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 80142a18a3c89135b45b639e53fc6f4117acd6ba1e75285ba34d78f34601bd82
MD5 5de1c3f29bc46c7637b8cd0696658255
SHA1 9fbd435b248fb5af2678daeb2fcc5a91c91624d1
SHA512 1c19bf7bce0de976a64358305d298ddb78df948ba3bcd9f87a0e6e4a8b1b172b21d0d78445b093ff198e30decf0a749fe0c0460eced979a3a1b68b93088d02ee
SSDEEP 1536:ip/xcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YT:ax3Qw/xLANk0mUW5GmRntSFCjEENu
TLSH
T1C49312BA4E2646E7997D4A8176AE7909CE12530D705FA9CC325CA38D61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ff8d381f7139fb92b33cf5c547073b70b41d42ed1ddc6139099fb1e0be9de9c
MD5 10f818095f5e044c765f111723e046e9
SHA1 edf3939b7495098161b217e610c1deb5a0736c45
SHA512 1b2e33a236535b3c3c2da904dd1e83518dc65274330c4cc967e3b11053074f6bbb59b852d87ec3f72843dfee915911b69b1fcdfb10ee236815084dfac05b49b2
TLSH
T1CBD08075FD9DD005D35708F3619193515746C6656F524101B091981DEC017F9D3CA642
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd10f9085cecfffecfd5883131fbca23560ac08d660007d9ab5caeec6dcc906d
MD5 2015b6001ceb9bc2260f7fb63f4d8354
SHA1 ab906bfec4264085eb0ae180f9039048de14c9df
SHA512 4f0cfefa674cfa613518d89245c5012df2a00b5b3559185a25168614fcc79d65eb01780926edfd64b12e96489d21616a8c1adc059ec94e2baaeb0adca6eb95bb
TLSH
T124D08075FD9DD005D35708F3659193516746C6696F524101B095981DDC017F9D3CA642
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fe9000d57580054aa2b7ed38e526f8a3686be2d627c363de76e5b1d9a3fdc27b
MD5 1923f1643e911b369670e28da8a90801
SHA1 c8ce94a3b525f982c09c95bd95fecada403fa909
SHA512 d8f0f330670634d9b97b08a04a308cb3243a7274ef3cfd126f32663293b3f70752d4e736853b4aaec7c2116647d3e1ac8bfea624f34746676c2e7efa6379c5f0
SSDEEP 192:sxZRQUnIRHyM//K1Ml8ME//fTsOFqRefwHiGcYbDLRdpmkHW6+WNBr0/YJRgZFIf:sxZ5nINc//fTsOwe45pLlDHbm/Fc
TLSH
T1C87209166A24593BDCD7D218F9167B53D6F81563D6840E48AAFCCB0C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 80e96da9ee9e9e3173687439b6f81d0b0be2881952f3368fd7262b83e6228c9b
MD5 8d3eca81197de25e50235eec7d201eab
SHA1 71cc1a3835e7cac7260193dfc07d1aed1a4a8454
SHA512 1cb050ea9fc78b37ba560ae712d253bffb55b8b3e21dcc1ce91163434aef641de1d35f29922de9df5aea982cb418d77b288b78efafd653e023a862e89d674038
SSDEEP 768:L8Qv2il7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1B0FLllnWhYroY:L8Qv2izEneqWve+l+u1jacB0FLfWhjxa
TLSH
T158F20B3B6C0CCB7E4F804E9CEC2A7E8B6DE8018B9698895447FA854C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 7642f21f13c0023a523658ca355db6bf8bc47ec23922b4badf2b4558f4bdcabf
MD5 6b911969b02761e5d97402dc0b0fb40b
SHA1 43b30aec8fe23e6f9fb2e987c494f8e28f94d33f
SHA512 991fcd6574a069187999069d786546e081b8a20aaa66198bed2ccb6561ecbfc555a629e50434107b2524696f66de04fbb47b0066e6464d9793005b9b3f887d05
TLSH
T1B7A002558B914412C9926EB029DAD7412F14C9110312170782D80085CD55DC5CE4100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 d66dd516a9c7947e49f4a9d0580fcfad92e1cdd5eb666cca7fcfcda45675a0f3
MD5 9cd89fc9ea3fb7eed16bdf3c20207e21
SHA1 126ebeb53c157cd2e7521cb910d1ab6356bd0d81
SHA512 299d89ffd09ae02259cb619dd95d9d98e346d7ac7520f21b8bf52a80899f68a0bc766c9c4c66b41aeeda6521b9c70aa6d19b1859d7031ccf30d0c2721e9665a0
TLSH
T16BA0023823C04475D51213BA175286C52300D920115C161798934C45CC6854545624AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 e62fdd42e1bbd8b26c9733f94c0b98ea54c543875cc2d7b8ae46e7e91370e594
MD5 f266b2538d6f071c457538786e2600e2
SHA1 d0237ed406082001a89acf8d090b03089e5d5ff7
SHA512 14de9e2188c42b046e6d5701d6be22b103fbab72173c0663bcc19b484ead770cb5dd013ce9be566692af9e450ae75f7a752ce5dc15c713c31cb2cecddb15cae4
TLSH
T16C41B74D4C4A9E17CA3800B15CB5187C3334D8FE2984070B79FC52395C4FA5118A3328
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b2bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe59b2bc.TMP
Size 2KB
SHA256 6ef363639c8093808ff587284313c5caff6fbf4ecc7ca91988e450e8bc4d2cd0
MD5 4f02131b1022e47b821fb2c3fc616cff
SHA1 b6790050cac80d52656bb0241e5d3735ab376669
SHA512 dd0f3f1219b7899933a47bf6d9e6a1e34d7e958bb9a0ae55f4a68389d4c00592f73998b79313344febdd895f135ee0644eda4aa83cc8663ab7a1ea4e66b0b911
TLSH
T17641E9599C824E13CD3084B248C9202C333DA8A50944AB0B39FCC633ACD76A86D92254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cd9a751e66a37ad8c44db5461bde4709413b25824e86669dea6f2ffa873ebf96
MD5 ecb03979fa0debf469d88a14dd528799
SHA1 4be9f3c93edd239079b0633fb3a2992c46b1a8df
SHA512 6bebc8e4d8741cfb100ddc6d775e4d7a8c830858b8bc8d05788fc9ef7ca7e7147ead9aa92348771b3c3a458dbd000bcb7ed2cd5a2cf1f42b600ee47a55fe3226
TLSH
T14CA0023993559056D1180E7690C5C6C4A250885506173211C4EC46F8E990E48426681B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a08ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a08ea.TMP
Size 48B
SHA256 bf629c21b944f19a1ff6a19b3b21a7c58e439a034731d5832bbbc331c4bf214e
MD5 1ade1bd93cba86acad4abbd2d3d3b487
SHA1 2e8609ea83797e55d9cec19adf011ac746d08ace
SHA512 7ccaa0ab3eb4bd31a9ee28d803040edc9c620dd75f1a91f95fc3a4ba50118f11fd752304036cd422d2130547a372304e418b4852a8c9f37b9b52928d00b8cd4e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1f7d52a57c9a46864c6513cae5c12052badd817c1924f3cde24ab47696977706
MD5 68825e261b30356fdeb3560a924c1035
SHA1 1bb369066b00ae42a00dc5a17474728ff45c9360
SHA512 2c548e90dc6c181c31933924317c3bc96d12d22175c6179961bb288b618f92366787b326c1bf27c7ac3ba6aab4a882d4bb89baf7fbfba82ff2d4d396f11072a5
SSDEEP 96:KkE4Kh6CtWnimAEQgksBzuugKm1uYgS+ux4KaxGKagNdKKWY6SOYKrq2:SnR/57BnB
TLSH
T115E15C12323B42833A7E248EAD64B46E42C574673555A43B7BB844A60F7BF20CDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4bdbccc26bc8a578ebf38950bce16292025c6a381e451797141a5c342309734e
MD5 b8ee094686bafc535b1c6fff1b51df69
SHA1 43d6e969e497eccb25bd786d93f6081d69235e5e
SHA512 71254f23100bcf1fc2e05ebf08e290990f5fb8959e67511133d712e35c568923089963653a3821726e7df227b7b312b563ff105ce229332b7bf1f3062ad9f7a5
SSDEEP 96:iqONkvQsjpfKTzDXcJRC5ih/cIPURHl8h4otop57yDEBEPgpYvJKxCbTqNGLpx7z:ZONr6IT0JZQmiUyooOgibFsxo4FuLnU6
TLSH
T11402EA7568686C7B8FF3AE55B48B3B235FA4116FDA952F88DAE41B1C00D759C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 612d8d7c56619428bed49a8d964849277bf384b66729bbcbbea15b6da079ab11
MD5 8b186bc6a0289ca6341585920d31d765
SHA1 c574ec2643e2dfff174c65658fe78f6d8926342f
SHA512 c2f22d5c4d825bff8b7dfb6f6802c380635a3f80f5367fd9009419f55f677e9992ad2b80d029cce7ef0d0b3dd39457b8d0bc4be60ffdc046c093ebc26bbff55d
SSDEEP 192:uuVLsNqUCTDHheT0PD+umiUzV+H4gDbFsxo/MtIVFzqzJK:nJsNqUCTVligYgDq6/MkMJK
TLSH
T1AC423A3268B8AC3B4EE3A555B0473B538EB44127D7C92FD8D6DC5B1C06DA2AC6307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b5117b2f0dc55c5b18e93e3b7fde9b4f4f4e7367f193356d7df3e350bee0a9b
MD5 8111ab4e9006fbd220f99bf0315847c5
SHA1 6ee5e0bc93c30f444889750074c172c0d2d92d5b
SHA512 01d8dcc3c4d9df4ca5b673df0cd1f778d0a86879deb7aaa60530a0adfa41c4051712544e5dc7d8584fe5f7732754a0ad0bbc7d23c2f9f985d72692ea84524d67
SSDEEP 192:4ON16IT0RQmiUz4oogibFsxo/MWh1Pq6YU6:4ON16njogiq6/MotYU6
TLSH
T1B4120A7164A8AC3F5EE3A955F08736238EA0822BDB897F84D5DC1B1C05EB5AC5307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e6644805eb9c8794dc2609b468b1d4e730f0b8989230cec813b4a666a80d4bf5
MD5 5ca7ed7fb6e443d9e7d08c5bd234d682
SHA1 505cac601ddfc01630918c271b4091b2b26c2508
SHA512 09f6a63314e2fb3dc2970d767225bfdc80328d873d3cc0bff879ad51483939015481045c7dffcd573a0272f4edd962c08c17f695e8a9a10aad473d8502da1613
SSDEEP 192:uuVLsNkCTDHheT0PD+umiUQ5+H4gDbFsxo/MWekPq6YU8:nJsNkCTVliJYgDq6/MItYU8
TLSH
T13B42293268B89C3B5EE3A555B0473B138EB48127DBC93FD8D6EC5B1C05DA2AC5307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

187a424d-6dc9-42da-af13-cc232207c51e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\187a424d-6dc9-42da-af13-cc232207c51e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ad69f6bd45b895509e38e93e23e2eedc139fade17e235ab4ccbe287119058e1
MD5 8dfd21271478788dd46af7db96e912b4
SHA1 e0b93b54dc04dcca89127c91a438adc88b6da6da
SHA512 5f0aaa47b242a03f473449a2a67a5054e2cfed58e61c3cfd5550d10f0526f4e7b3aeb0531903d614f04c5e2b14c5db8ea87b532739186ae0dc31b77486ee487a
TLSH
T11D41274CF6EA1108B3B76E5AAFF6A86D447BBC772E16D49E00510E4E0A22B04D471733
MD5 SHA1 SHA512 TLSH

Submit Download

1f2ece27-ff2f-4283-8ab8-09a2b6ca680d.tmp

Path C:\Users\Admin\AppData\Local\Temp\1f2ece27-ff2f-4283-8ab8-09a2b6ca680d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4137cd40-06f2-489d-8d2f-ad44275ddcdb.tmp

Path C:\Users\Admin\AppData\Local\Temp\4137cd40-06f2-489d-8d2f-ad44275ddcdb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1fea891-943a-4a81-be10-5085cc3f7297.tmp

Path C:\Users\Admin\AppData\Local\Temp\f1fea891-943a-4a81-be10-5085cc3f7297.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1836_461209866\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmi

Path C:\Users\Admin\AppData\Local\Temp\vmi
Size 14B
SHA256 ff2c18e315338503e41857c786d0b43112f8c98b956613f1ad07935f735cae6d
MD5 ac1fc32f174d8807177cb72107ada23e
SHA1 0c532caab0f48d8929164593613ffa683aba54eb
SHA512 a1f4a019c0c73f0239de9380717fa22c7b3235a640f92197edd791275c0e6eed2b3529ff725fa45b1a5df74e2b7040b7aec10ef8336defd62d81b6f477b8d86e
MD5 SHA1 SHA512

Submit Download

memory/2700-23-0x000001507AA10000-0x000001507AA1C000-memory.dmp

Download

memory/2700-22-0x000001507A5C0000-0x000001507A68D000-memory.dmp

Download

memory/2700-24-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2700-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2700-1-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/4216-1369-0x0000029EB46D0000-0x0000029EB479D000-memory.dmp

Download