hxxps://github[.]com/CirqueiraDev/SK-Builder

Analysis

user interaction
yes
max time kernel
279s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/CirqueiraDev/SK-Builder
Sample260425-w95fcsf131

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	msedge.exe
5060	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216159523100537"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "165"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{895933E8-D69F-4A50-87D6-0263B48E708D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
3460	chrome.exe
3460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe
Token: SeShutdownPrivilege	684	chrome.exe
Token: SeCreatePagefilePrivilege	684	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe
684	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3512	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4924	4420	msedge.exe	85
PID 4420 wrote to memory of 5044	4420	msedge.exe	86
PID 4420 wrote to memory of 2344	4420	msedge.exe	87
PID 4420 wrote to memory of 2344	4420	msedge.exe	87
PID 4420 wrote to memory of 2344	4420	msedge.exe	87
PID 4420 wrote to memory of 3516	4420	msedge.exe	89
PID 4420 wrote to memory of 3516	4420	msedge.exe	89
PID 4420 wrote to memory of 4044	4420	msedge.exe	90
PID 4420 wrote to memory of 4044	4420	msedge.exe	90
PID 4420 wrote to memory of 4044	4420	msedge.exe	90
PID 4420 wrote to memory of 3716	4420	msedge.exe	91
PID 4420 wrote to memory of 3716	4420	msedge.exe	91
PID 4420 wrote to memory of 3716	4420	msedge.exe	91
PID 4420 wrote to memory of 3284	4420	msedge.exe	92
PID 4420 wrote to memory of 3284	4420	msedge.exe	92
PID 4420 wrote to memory of 3284	4420	msedge.exe	92
PID 4420 wrote to memory of 3204	4420	msedge.exe	93
PID 4420 wrote to memory of 3204	4420	msedge.exe	93
PID 4420 wrote to memory of 3204	4420	msedge.exe	93
PID 4420 wrote to memory of 4488	4420	msedge.exe	96
PID 4420 wrote to memory of 4488	4420	msedge.exe	96
PID 4420 wrote to memory of 2992	4420	msedge.exe	98
PID 4420 wrote to memory of 2992	4420	msedge.exe	98
PID 4420 wrote to memory of 4712	4420	msedge.exe	99
PID 4420 wrote to memory of 3432	4420	msedge.exe	100
PID 4420 wrote to memory of 4712	4420	msedge.exe	99
PID 4420 wrote to memory of 3432	4420	msedge.exe	100
PID 4420 wrote to memory of 4400	4420	msedge.exe	102
PID 4420 wrote to memory of 1872	4420	msedge.exe	103
PID 4420 wrote to memory of 1872	4420	msedge.exe	103
PID 4420 wrote to memory of 1616	4420	msedge.exe	104
PID 4420 wrote to memory of 1616	4420	msedge.exe	104
PID 4420 wrote to memory of 3992	4420	msedge.exe	105
PID 4420 wrote to memory of 4856	4420	msedge.exe	106
PID 4420 wrote to memory of 3992	4420	msedge.exe	105
PID 4420 wrote to memory of 4856	4420	msedge.exe	106
PID 4420 wrote to memory of 2056	4420	msedge.exe	107
PID 4420 wrote to memory of 2056	4420	msedge.exe	107
PID 4420 wrote to memory of 2572	4420	msedge.exe	108
PID 4420 wrote to memory of 2572	4420	msedge.exe	108
PID 4420 wrote to memory of 2572	4420	msedge.exe	108
PID 4420 wrote to memory of 3336	4420	msedge.exe	109
PID 4420 wrote to memory of 3336	4420	msedge.exe	109
PID 4420 wrote to memory of 2940	4420	msedge.exe	110
PID 684 wrote to memory of 3668	684	chrome.exe	127
PID 684 wrote to memory of 2320	684	chrome.exe	128
PID 684 wrote to memory of 2320	684	chrome.exe	128
PID 684 wrote to memory of 5060	684	chrome.exe	129
PID 684 wrote to memory of 2052	684	chrome.exe	130
PID 684 wrote to memory of 2052	684	chrome.exe	130
PID 684 wrote to memory of 4384	684	chrome.exe	132
PID 684 wrote to memory of 876	684	chrome.exe	133
PID 684 wrote to memory of 4384	684	chrome.exe	132
PID 684 wrote to memory of 876	684	chrome.exe	133
PID 684 wrote to memory of 3292	684	chrome.exe	134
PID 684 wrote to memory of 3292	684	chrome.exe	134
PID 684 wrote to memory of 2688	684	chrome.exe	135
PID 684 wrote to memory of 2688	684	chrome.exe	135
PID 684 wrote to memory of 1180	684	chrome.exe	136
PID 684 wrote to memory of 2892	684	chrome.exe	138
PID 684 wrote to memory of 516	684	chrome.exe	139
PID 684 wrote to memory of 3428	684	chrome.exe	140
PID 684 wrote to memory of 2668	684	chrome.exe	141
PID 684 wrote to memory of 2668	684	chrome.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/CirqueiraDev/SK-Builder
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffea600c188,0x7ffea600c194,0x7ffea600c1a0
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,12954488220838104855,11019059234125062859,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10929968144476798627,98710514786794882,262144 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,416659599142639310,8308449398478794517,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,5697057666047511416,6645181803197463984,2097152 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16434643718789016511,5983380509562892209,2097152 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,864040103914007781,17343195627109471267,2097152 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8001932972140181754,13104579849884834994,2097152 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,6103083412752220418,773975180588146151,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5348512621418913004,8488313247873091977,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,5679131663329075687,11823954568969161454,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9592377402888535175,18244631533975300037,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18242385212726350012,836809627469659805,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18242385212726350012,836809627469659805,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7899804888258555670,16089941757426444431,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,1408901171356418889,14946003160606193109,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7904272598042984685,2835511121878451894,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,11899936000251466714,17141628099687252965,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,11270346688086230535,1336413129168478590,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5416,i,5533996342835543271,8937212222695454401,2097152 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16954491503324611531,16337119661359145126,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,13700068556468305807,3289021007465177497,524288 --field-trial-handle=2276,i,15316719535172028353,4358039167115324007,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe990ac728,0x7ffe990ac734,0x7ffe990ac740
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,17188827168985204023,14132241402231322732,262144 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,1477330295168787465,12693632409728096198,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1774478356327182755,6279567150283409436,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,10013917559129493833,2735636933486829526,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,6756905125117009812,3145227808786500004,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,15717779802723828777,15671777377358044610,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,13047738427760255473,17725897349826182716,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,5161769985617307980,10498658251102589833,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,14844525925174227917,6138322873617739303,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,17503659667923905758,10999257708658997118,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,565154107144537962,4493013123253270715,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4600,i,17969473154979354318,10985948867265865335,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=240,i,6784621704542003823,15975949137499854266,262144 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3380,i,11116589695627316399,14975117044531394057,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3304,i,18341485837849834714,14329500368337645002,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,11087825393077593859,6873959506515678959,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5532,i,6267904103982071423,6519960768605788626,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5816,i,1237405769768547653,17719638040978132650,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5768,i,15859311993525370935,12604746318756247734,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6004,i,6804143852560194783,2088003396992515643,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6136,i,5462553129209818414,17589732611578272280,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6024,i,13033267863019522313,14769234831406490928,2097152 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16591679153180242616,14165712930673732273,524288 --field-trial-handle=1988,i,17179801357887901117,5925320116266944994,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:204

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3972855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 632346aea033c93170180782a56ad56582c3f45a1323dd58d40efc97aa90eaf0
MD5 13a36a00edfc41ea4ea457c81f530149
SHA1 017eebce3d4606e80f356d71207b38c7170be4d5
SHA512 f01ebead08534cd077ba6c38bababf21f28a6bdddce28f5eede581f4f9b42274a6dc74fd7e49f8533987954880d02a5ce52a3eb5c64debfc69aed08f79a0a116
TLSH
T1C5E02BBBD821EC3B08FD075861554787E700635A6BC0485F3A3D820D8FB473605968AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 10e081855a6f1f4f1221e9a63d69b73f3f9d2f5cea66a4e5b87176ec3b8e5ce4
MD5 f3c10dff75320caaee2cf13d97a24808
SHA1 1cafa48a0f9e256d0f9ab6c5c9470e3904866fe0
SHA512 03f803d52c5040c8240a4afa6af4644e31745783c7ce9922890043d9320234be707ead17a579ab4ddf4b76b20a034f3e494964f474210497695694d156f54036
TLSH
T130518F2175D0D82CFF59F5756EF11C813B3288180A376E0BA9C9A2FDB5033A82B944AD
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5a82cea85df73a165352c8eb53054fc1f401d92aa5d8e4e8638f86007121562e
MD5 8c3ed1f90151e10830ff622a49a083e3
SHA1 8778896c9fe767e6b3c713b6c8d24f0819df0d22
SHA512 9636156670004c0903be2367da1b6e51a139c9b0f8f3c25e0418d1356be29fe4dc8282c22550ad3d50b64f40ff4f1fa830c19f99c3bbe89982bca4bb4e67fcee
TLSH
T1D151ACF793E4867EC51156E5AA256E2FCE7D0A24431C3C66C8D4AF0B43F2972E20139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 31999fb9a4782553a96095b29a622a1f524271a2162ee9cefe7593535a1d2f0d
MD5 be7f1127defd86adb4762af62712dc1e
SHA1 a759da37dbc95aed5bf12315f7c4307c5dce7307
SHA512 a28fc3e025e6d4a8522a1646404561c12dfe3d5b41a2be01b356e6ceedc6e21f1e0f499acf391c26ca268194617d62da9a914178c245bcda11fc53a17249d4b6
SSDEEP 192:DUjUkJZ0laIagHntJLWaX/z/gwBbhICNWrOUE6i5:DUjUkJZ0laIagHntJLWaX/z/gwBbhICl
TLSH
T18EE1ABF3C3E8866DC91196F4EB156E2FCE2D0A24431C3D56C8D4AF1BA3E2871E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 10a6bf373758690139205e19b488be79c88ecab74728a3a98ec910a16fc82283
MD5 0a7f03c2e743c0931b45d09496a68b28
SHA1 60c61c6221da4fb8654f3198ee5cc22ccafb50c1
SHA512 2259069940438bd022a4c732060f54cf664a8e011bedd4a51b53d8cf9fe529d6e1457fee55ad7849d051558bdc63f610b8ffb432573bf5ca664a79cca5d90be9
SSDEEP 384:DUjUkJZ0dcez6VOazyH1emzaIagHhI0WrOUE6GJ/DSkM2zo/0mKlKpKNLkSIYpWZ:ZIgiI3fb9X3iJJ
TLSH
T1FF62DDF7C3E8866D881156F5EB197E2FCE2E0A14431C3D6AC8D8AF4B93E2471D21065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 d987e7a5eb0308943d2f3fa03c5f08a1ee4fe775e79c8ba325e1a56c842509e9
MD5 8f0a878e2567b3ced610926252ec3e61
SHA1 c10c787e5d90beb13ccc33076e385c956bbd7096
SHA512 983909781d13c2bca627c1e051b963b16d94fbf1a67cf6b202a6ef0497388e5d1b4416c55bd1f8457080c45bc8c372bc7771b374fcb7c09bdadd9469df593193
TLSH
T1B9617C97EA7EB41BE0BD096B3E4E7C092975A831018276F9CE67807CA0D14F34F121B6
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5668cc9ed464d464c9e0299857d24b5e1938de8185d968d0e696feb7bcddb57c
MD5 f85afca3105e3ba9bba969b05dc6ee0c
SHA1 92244a13c489465e25e4bb331a602a9d3020b09f
SHA512 018149bd9aef5e3c6887ec3b788751df6e3df4b054871b4c73e9220fced1e6b99be0835dafbf6aa0851d45e38660794350b8135e4ec48e2cfc9aac82e0173e40
SSDEEP 192:6RsTOIyDvGyer8iRv7CMpAPRp2u93Hsb+WNn4/0oN0jIkwdb+Oar+VyIsnAUgraJ:6RyOIYJUBxUXZxwQ0om89SOar2e
TLSH
T1AD42EA2EA914B93F9CEAD31AF9127757D7F5202161852E84EBFCCA2C10E79CD121B057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24e69a62dcebe9e3813b5fad04a6082acce332f2c1c597e403ed4ff0ee1353e3
MD5 3625f1ad6a4a3c989835847214c290e3
SHA1 cae243152bef80411a81c76a5183769286f6920b
SHA512 c1a2f14545189bfa3dfe1ec3cb83cda3c9df4ab7135ae460081a091d9c825a43c81dbac33a49733df0ca13d0bc712431d144407662b03ff9cb8d1ba5d1df9fa8
SSDEEP 192:6RsTOIyDvGyer8ihv7CMpAPRp2u93Hsb+WNn4/0W0jIkwdb+OaC+VyIsnAUgtaJ:6RyOIYJUxxUXZxwQ0P89SOaC28
TLSH
T1B042DA2DAD14B93F9CEAD31AF9217757D7F5202161852E84EAFCCA2C10E79CD221B057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1cc46e8e68091b23561992a8811ad5e3d7e2532799beaa9a60425e3b71440c87
MD5 71b0ac2a338b230c491b05692f9687dd
SHA1 df455720566678ab4e50289e834c4852ff0972e2
SHA512 5b8ec5bfaf260cdb602db8dd785d2d7676c722f98c0354838fc8474beb597ee9b19790442ff9c73a441bde3cd8a3b5de10cf3baf5560c0c3dc1545f87baa0959
SSDEEP 192:6RsTMcBzIyDvGyer887v7CMhTPRp7fpPF93Hsb+WNLcQur4/2dG0jIkwdb+Oan+M:6RyMmzIYJ+DxJXXxwSQ2d/89SOan2e
TLSH
T1FC520A6EA910A93B9CE7D31AF9127757D7F5202162C51E84EBFCCA2C20E79CD221B053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5de0db3310b8535676f0cd009328237b6f004dce09e3cfa73d509622bdd55f9f
MD5 59188881a46e415e29596ac8fdf208d5
SHA1 a63ebaf6b7a6b6de642a786feb9612514c3f1f93
SHA512 f841ad4e6cd26e8c9d89bff74533b13cba2c43974cfde8a691caa7b426f1b5d22f11dc68fb54e0c6461479a84333452a5ef02168468ca1d77118fb814bdf9c73
SSDEEP 192:6RsTsIyDvGyer886v7CMhTPRp7u93Hsb+WNnQutZG0jIkwdb+Oan+VyIsnAUgraJ:6RysIYJ+WxJXqxw1tZ/89SOan2e
TLSH
T17252EA2EA910693B9CE7D32AF9127757D7F5202161851E88EBFCCA2C10F79CD121B057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cadeedc27acf62b917c63f7d8152e04f2d65a57fc222f7330bcb28aaa7f8d9c3
MD5 46038e9f5a75add54d0907b03f5f1a0b
SHA1 8588a91c9bb69491b8c51f083caae802e99c5a84
SHA512 7991e9803138ce04a276824057c3f5b18ad6f253e2a5b497f8c7e1ae0b8fc0cf6e055577a5dfe6895675a4549b087eb352c2eb8b1969165f641635631562d3a5
SSDEEP 192:5RsTMcBzIyDvGyer88ov7CMITPRp7feTMF93Hsb+WNWpbvZGWL4WqG0jIkwdb+Ou:5RyMmzIYJ+0xwXDxwxJWq/89SOan2e
TLSH
T10262FA6EA910693B9CE7D32AF9117757D3F5202156C51E84EBFCCA2C10E7ACD221B453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a14093b76d32f668392baa7a5ed733b20d800c9facfc12e56fe042a37cbf1457
MD5 835c9a996526ef870483e59383fee15a
SHA1 978fcea90ce92bd3c5050efe41fd74e2ac14b08e
SHA512 120f697969a2d2b66f137c85a0a9c10b8d3ad1248122aca3980376bc54ea174a9eed0819277bdb6f3df7901dd3e9c53647ed44345822513bdaaa0c27585810fb
SSDEEP 192:5RsTMcBhIyDvGyer8lov7CMITPRp7Vr/MLgxF93Hsb+WNWpYSd6ZGWMrYZG0jIk5:5RyMmhIYJf0xwX5xwAB9YZ/89SOan2e
TLSH
T11762F96FA920697B9CE7D32AF9127757D3F5202156C51E84EBFC8A2C10E7ACD221B443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 b4e96d33a65dab22a9bbf9176fc34b76aacc3d21d835c41c9d78e3b8af2a4180
MD5 2b7f6aa7b86f080ba36ef44bce622139
SHA1 0aeeb0e75713627902725ed057c7acd9f0b5658f
SHA512 1172eac3a543ff51ab4430d8f8eaefa4eb702b94346f8e54f33b193655e38f01fd0de2cd0350ad49a2d7d922cff32c414d9132da363ce78d60413a316c05d318
SSDEEP 192:5RsTMcBhIyDvGyer8lwv7CMITPRp7Vr/MLgxF93Hsb+WNWpYSheUZGWMrYaG0jIx:5RyMmhIYJfsxwX5xwAKr9Ya/89SOan9e
TLSH
T1D562E86FA920693B9CE7D329F9127757D3F5202156C51E84EBFC8A2C10E7ACD221B453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2fd89543a139a13f756f8ff7fb2ab535d6136d849b5f969360a268c97d89ed2e
MD5 d42948caf95ec1466b1c3b7ab9876cfd
SHA1 93a4efb6c361456280e04a15daa8a9f7d5ffeefa
SHA512 c42d42112c5a788e0e3d7a483deeb2fa2e6ef0aef97eb069e2db8edb59ef3304531e45329ce94b35caa83ca0063ebe4c47404995ba99a7cb8dd8006932c17763
TLSH
T183B012508085D502C00302F81692148CB564EF1087091305D3E07D7198371A04415170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c72e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c72e.TMP
Size 96B
SHA256 3d88ab1d40b64421a9c60feccf5e0786c21259413f7a2a732381feaf9d04ca81
MD5 1aadd1a0ab77768a1f4def25ff8c35ed
SHA1 e8aca28d3679aa88095167cea0e11e5a70e182bc
SHA512 23978f425369aacb19503b5f2ed26b1554289deeae71a79f4f6012f35fea9e67576257f176aecd86b038b82cba61df148cd3ce32bf2bbbbff55f44fe9bbc9499
TLSH
T1BDB002A9D606E212C08A43B02995D6ECB1E0EF76C6031216D7F91A76DC676B04927561
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 db115edad222c4426a1d00334eea936f373730632f001b23cf967fa6ef079e7e
MD5 ab517d4fbc4056e91e7e8467fc750e10
SHA1 426e6fda95d985190553222ebafb5207a0bdcfc5
SHA512 9ca8b1c7ad48f2715d155fccae69bfff5b3c234bf18915f74891fb7a236d6df397e37390282cf0f65a6bc4d170379c91d6e77745575a30657635ab4fb264da65
TLSH
T19DC04CD715144D9F4E30E9D82478762ED95B51588CD4CCE89D05515715B4E338416A29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c405c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c405c.TMP
Size 157B
SHA256 e8ecabe7811b720b1f7df768244b5a2e9fac03bd44cfaef4d96c3d3be3b4ee19
MD5 aa4a85389ea398ede30e6101e32fff7d
SHA1 3679ecc310db0e1b5e9207317a3304549ff4d99e
SHA512 5c6e1a00a9bcac599eaa14f430571a1eef1843a38b4e21dd442877be1119e27b0ae3fb92676579918fc82bc4c25fddc6f25435f30578718d9e7c12509b0e2716
TLSH
T1F8C04CD71524499F4F31A5D56478721ED92B5D588CC4CCEC9D06715721B4A33C415A29
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 744a49b21b5b2020801ad3807a277f4bb9c5e1a07d80816af2335e9e9a35bd77
MD5 d189c42f5799bc324ab37b39493ad916
SHA1 6d10408f8022676c72a57499e49b90c9556820e4
SHA512 855531d1002b11d69cb0672a1313fb5926b2b3b7abe1910001851f14c75f4f6d7cd129d1c402c96b6bf8823dde2e184d3f63b24c14be966087cd1ee8a5b177df
SSDEEP 1536:ip/gcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ag3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T18B9302BA4E2646E7997D4A9176AD7809CE12530D705FA9CC325CA38D61D02C82B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 95b32c274af281ab7acc2e7ebb1b1bfadf33f8dc91f3fb8d6490c373a3f0ea5f
MD5 1ef197bd56f4754dd4793c895a5a44e6
SHA1 783e4e722c22ac0aa86fe8113c4b91f9f9e5a61c
SHA512 f974547e4aba7a4acafc202e593f8cdde5e37558e8323d6213dffd1cad29ced552438ecd7d44b33db89660254087933b3763d07a76a9b73dc92fffc3ae6c447e
SSDEEP 6144:CRqe7NvoXMZjC+a+lAFqBMQFrOk0HOGm/SFyEEy:CYY8GjC+28MQFrOjuGdF2y
TLSH
T1531413B7DF2409EB6A2D5E767176B40E8C0389E9315ABC8C516C2B0932CC5C53B76FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 26b999213ecdbe722213879ef4d400a2b1c5cd36e0971a68a444a0b67ad3bd86
MD5 822a168ab2ff8fe4fb96c5602d4c266d
SHA1 70f58e973d317151ba5fc1d636dc5f6c47db2a67
SHA512 5b942161adf7bfeb3640e3e055e2abeab960b4a9f375a43f710d31f9773d5ee713e4bd3f7923720fb4d63882d63412b511f79054359a544be21f8bc51ef501d0
SSDEEP 6144:bRqe7NvoXMZjC+a+lAFqBMQFrOk0HOGm/SFyEEy:bYY8GjC+28MQFrOjuGdF2y
TLSH
T1FB1413B79F2409EB6A2D5E767176B40E8C0389E9315ABC8C516C2B0D32CC5C53B76FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 c9db7db2736ed7692459e1173cd1170e43d7f6709bc15f356854b4d43c18e81f
MD5 c4b715c18c9f5c83db24a7f4663ebca2
SHA1 93b13df9dc2facc2ef6c9c030df2864d33e8cb17
SHA512 85d45af6be3d70b056183416d6c748b36c78d1e4617fd2528bed0e9ff7a57e63d6c276b116e1701a08bb6b32305d503338f71530f3bd152cb38dbb81b7a876c6
SSDEEP 6144:6pRqe7NvoXMZjC+a+lAFqBMQFrOk0HOGm/SFyEEy:kYY8GjC+28MQFrOjuGdF2y
TLSH
T17A1423B79F3409E75A7D5E7A7175700A8C138AEA714AAC8CA16C3B0D31CC5852F76EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 ac950fc4b30e123b87b00e23f1f8471a539a2ae9b8437afbfd397244db326975
MD5 c7af02584810d1d711f47108d85ea57c
SHA1 9af0735831007555a27aed751077bc0700134a29
SHA512 9466da7a79a9f4e2f5db74998f2bba97dddfebc9fee1a388a4965e09d4272b0e655baefa9ae49e72c4baca724697bb0ecedb01e68542856dd5e7f7adb8ea2ce3
SSDEEP 6144:CCRqe7NvoXMZjC+a+lAFqBMQFrOk0HOGm/SFyEEy:bYY8GjC+28MQFrOjuGdF2y
TLSH
T1951423B7DF3509E75A7D9E7A7175700A8C138AE9714AAC8CA16C3B0D31CC5842F76EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 3abacf47320d1854c1b4e723e32a3b8dc94ef838154949c04b91f0d4285e7c21
MD5 d72cd655b8f843bd483a494775facb06
SHA1 bd94966f0a12d515679cf5e8a1783ae6533b7d2f
SHA512 3db60ee98c1d0d09d8d6a23349220ba5f6d5d2537b10b4b0418f03b0d231ddbb13c30705eccbefc215381fc9e905351ae3baabd57c6048cfbd5363171c2d8281
SSDEEP 6144:+pRqe7NvoXMZjC+a+lAFqBMQFrOk0HOGm/SFyEEy:4YY8GjC+28MQFrOjuGdF2y
TLSH
T1B51423B79F3409E75A7D5E7A7175700A8C138AEA714AAC8CA16C3B0931CC5852F76EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecc103220659b15b56c51e9002281cb930975deca8db44af194bf80a64b234af
MD5 9fed310f4dbdc9a2461971b19f5052c0
SHA1 115846f0655f86ee9b0df9e6162b98f6759f0431
SHA512 fa56e883ae91402b4ea0c534c2613509a62d2b9143aa63ac21e6964c2160f26457b4535ce353ca6ca04a2cd6e78c64013c6198649d03713abde28dc1800ee193
TLSH
T19DD02375FDD9D006D33A04B3135353516746C6157F434011F055C40CDC557BEE3C5582
MD5 SHA1 SHA512 TLSH

Submit Download

0ce13601-928a-4b73-be6b-03a8a4e279cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ce13601-928a-4b73-be6b-03a8a4e279cb.tmp
Size 13KB
SHA256 efe7afb90cc177316475c1258a3d6fa354ebaa9f9f59a2f538a106d9ef2bfa35
MD5 57e875a630f5a8a5e7716b4a22648bb8
SHA1 0b45c84823f6c80b5b3906bbd35c7293086bb814
SHA512 7767db19e665a450650fcf548c2f97624acbc8bc9619ecb479d0cef0390d708864b8b1a2df630faa4ce95a9007f0fd9a83e7fc8af4127563e4daabdd58bd5088
SSDEEP 192:sxZGRfyM//K1Ml8M9N/fesg1Nehny+DaznLUGZIdp9sQHW6+WNYnE/YJfNwTIg4J:sxZGB1N/fesYUnZDMTyzHbr/xc
TLSH
T1B352E916AA349977CCCBD209FA55BF93D6F50572D6900D84AEFC8A1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 30e97b61d29f99afccee76c2f991723ebfa205b138534f54bb8acea0c822bf9f
MD5 7a4eb894ed2c06f70df886d1594aa566
SHA1 75713b5200b258b2773639319cbd3688bf44e963
SHA512 045717fb8f8f89a4ec08bd99aa245f41b6b4006a2ebfc52506ba87741d36821c97430eb9c7736ffe07c1c4e602692d4a602350aae34248d5c98940a7299f5eba
SSDEEP 96:GaMwv9uSN9SzGTeHkyNJqKdB/XxJuiFCX4NtzrsecoQJN//lUM7:LXFuAAEeHBHdBPxJuiFJzr/coQPHKE
TLSH
T166C14D05708CE89AFBD630B069D11F66717E5F9A0C3F4E267AFAB5BD060BB84134161C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8cfb792695bd8eec07925d34ec13b4433e43a5f03d3f9e97f4afe6061ebfdaf6
MD5 f00955fedad26afae44eb709a49d2014
SHA1 c06c6adb1918386ba1fcee383be665243c2b90c0
SHA512 cc9a04bf1c9d3cc6f29f1d2e73a3f3ab5a10c84d796fe70554075090f23c3b3088342a45e08ad8bd984911ce6abc0bc981ea3f08dff58565003380f95452fc61
TLSH
T160617CF787E5856DDA1255F0BA18AE2BCE2C0A10831C3D6A89E4AF47D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4dbe3c56ee48859fd07354fa084bfde313f4be94138494b6a246cce47727d79e
MD5 23f0d1de592142f88fabbc71f53307e8
SHA1 130d757ac68fb608ddae26db72d5a77a4b758bdb
SHA512 1ec229ca7a439d2d8413dad6218fcbbee98d620dc8fbeeb0f2cf508f69949e9cd941f8e133d7ff916cfda6ff9bd76d31445ad4abf242739afbc69aac6b12c784
SSDEEP 192:sxZGRfyM//K1Ml8L9N/fesY1yWpV1ehny+DaznL+GZIdp9sQHW6+WNoFnE/YNDKv:sxZGBIN/fesfWv1UnZDMlyzHbT/mw
TLSH
T10C62C7166A34997BCDD7D209FA557F93D6F9143296900E84AEFC8A1C00E6BED630381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a53d1de9945e10077bc188f2995ec93c79abb164766bbf98874776bc98bfce9b
MD5 4247e62d1c9f826090d9153faad78388
SHA1 5359757c7b67e355b0c92b60bbf8d936e53f225d
SHA512 ed8ad53fd680c57c4a4006f1e3fe534f274c145cfbe3d621ac5c4e44e6c8a207d072386f68c1ba28462629db3aa5290b82e0064f0858d1c7971d0b7ae61dced6
SSDEEP 96:KkE4Kh6CKysKXqmB5UvT5/fxyziss7xKk4sZxQhpK7Y+sKziuacwKRKB:Snf7B5UvT5/fQziv7d4sZ6hpK75TfS
TLSH
T173E18B51317786A03B7E268E9A91B42E46C275633149A42B7BF840A54F3FE30CDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c7137692-60e0-4148-8c03-02b85d007b27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7137692-60e0-4148-8c03-02b85d007b27.tmp
Size 35KB
SHA256 e8347e0d811726e1327a5fcf2fdbf1930ffbe663be8f29461d19b5dce760eb8b
MD5 b7f9c23c683c61cd55334ac4dae7f569
SHA1 eed562d3edfaf004d517048e9185f76686af9575
SHA512 9bd21e5ef5b9173787f8a4241241280cf4cc45eec2fb8a636ba53a3bede1f843eb0919f47ac99b9930f0c048ccdbf47e0e7dff6434ca887eef253c3b3c9d3087
SSDEEP 768:4VQv2u17pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEbQhnFLllnWhxU:4VQv2uDEneqWve+l+u1jaVbQhnFLfWhi
TLSH
T17FF20B3B6C0CCB7E4F804E9CEC2A7E8E6DE8018B96D8895447FA845C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fe4f53aef998fbe397a320b5077f1b842b663a781c69409c1b638807aee3778f
MD5 637c387d9d700ac6a2b5f26d7899423b
SHA1 138f5bb08df4c12cea4579263c7aa9375e25a30f
SHA512 2339e894d542c44153ff38aec8070b7c24c1b6048c38b7f7c0f63c60f88c17d3fae1a7f95a871703703a09e04d2f08a74e93afcbae4fcaeb2cd70140a2e22f3b
SSDEEP 384:nyjccCs+Bt0S3vsNNkU2AIGLgDTBMdymTV5fPIf3B:cccQPG8fGdymD0B
TLSH
T19F825B7228A86D3B8AE3DE55F15B3B539FB451BB92C42E98DACA4F1D00C71DC0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a7e66656453dae808cdad56cb437d0f8e966baf29eb38f5a81f0ff3aaeb795dc
MD5 7649eecdccd860fdd8a7ef60e8bc8d3c
SHA1 f6ab29b98c994184eeeee4ac620dfd31c044d8da
SHA512 e7bf7c6e8526bf513102e31b6b9b18cc9d5b6965fffa0e6af2224480cae408ebd33914f8e071033370ba17d2e5bfae05ed74ef2656f02e318268c5f27317eb3b
SSDEEP 384:nijccCs+Bt0S33sNNoU2ASRLgDTBM5oNvKASBXN1sg9kk87HmTV5fPIf3B:MccQX/8fG5OtS6g9WrmD0B
TLSH
T184B26DB1D8A45DEB84E2DAC5B14BF5032EB4423B86885D5CE6F97A3E309F0F84712825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef9b3a61f18ae92f18b55a63aeccdff544ebeb084bd34ef25372b04179587ed6
MD5 93ab8337f8be9d5de17467851c18dbd8
SHA1 47077e7e56738775f01b5c09e66a2ebde27f0c6c
SHA512 7e1f8926fed5f919542b852bb1e228232ad1a2e3ee098357595745f1c27aab9793f879db657285fe562d484d5ab1f8ba9dd01c4e02e644b1c3972bda1b5ddae2
SSDEEP 192:ZONI6IT0JZQmiUyVcOgibFc2RB0FuOHU6:ZONI6B3jOgiTlEU6
TLSH
T17C02E875AC68AC6F8EA3AE49B08B3B235FA4117FDA856F84DAD44A1C00C724C1703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0fea2ecdac07fe55ebf5ad8129698f6025078ba3128d3aa08504529f747b65e6
MD5 ca78d1ed664608388bcd7da99effe13f
SHA1 d2cd8915b9a30767277de13d25bc65ddd8360fb1
SHA512 fe9d79de5e320141d1cd8ff75259e3e13d622388afad04d2b093a96a02043ab913c0c7ef1c34b2a934d43a65d9fe250f1f5ba6cb435ffc319151e4364425b2b5
SSDEEP 192:SONo6IT0cQmiUyecJgibFc2RBBMsh1SqlAU6:SONo6keJgiTBMayU6
TLSH
T19412F871B868AC6B8EE3AE55F0873B239FA4517B96856F94CAD55A1D00C729C1307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

aca10138-f392-41e6-8f82-ce2c7b56698a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aca10138-f392-41e6-8f82-ce2c7b56698a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43d652a7ba9b1f4a5e7c77745dca087d33f4dae11ef5731e69c275d211487344
MD5 ad8f9487face524f4b6c550ac85025fb
SHA1 5e322aa1fc0e30ab0018326c976162cb4dd2e211
SHA512 83f8872936d1bf67f137f92c6644c8d3321e780beafca73dfe2f54822693835f54e0a250ad5a30a7a00861cd5262c12ca368f434605b02f5443a93b972fcdfc9
TLSH
T1BB413B98B6F91148B3B77E569BF6A96E48BBBD372D07C05E10010E4F0622A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

0c4fa88d-d502-457f-950a-fdd2872d5ef3.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c4fa88d-d502-457f-950a-fdd2872d5ef3.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6dcd9ff-f221-43f1-95a7-271c697cd53b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6dcd9ff-f221-43f1-95a7-271c697cd53b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ef4137cd-84c3-40be-a74c-7dbc36c087cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\ef4137cd-84c3-40be-a74c-7dbc36c087cb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4420_974251910\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SK-Builder-main.zip.crdownload

Path C:\Users\Admin\Downloads\SK-Builder-main.zip.crdownload
Size 2.4MB
SHA256 d0ff95aeb0881dce831e31bce4be527f1489764a1c9913b3590686df8ec469c0
MD5 cf74dc2652c5fdf94c4f82c191d2c14d
SHA1 51b7741aa8a19a0ecdd6749f7d46bbd42455501b
SHA512 7cc089018117f3ac67379d05ca93ecc143a5cfb0afb06115f891d7d734a6729d5de87fb4b4d5f6b279a99055ba5ba1a272f404391ad3d82634bf4bb0dea59d1b
SSDEEP 49152:vxy73nWvsAJwu8HxyJEjn3HeKo5ApekzJ+FK7Pqkz:vxyTf9HxyJo3HCkzAFg9z
TLSH
T12EB533BA93AE1905D227EA7F39901DCFB5D4AD259FB48F02D677A71C4C163012A1C3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4400-866-0x000001FA737C0000-0x000001FA737F0000-memory.dmp

Download

memory/4552-765-0x000001D07D330000-0x000001D07D360000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads