hxxp://www[.]ciclosrio[.]com[.]br/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.ciclosrio.com.br/
Sample260427-2a7pbsav21

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_325063747\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1337265466\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1337265466\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_12285481\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_12285481\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_225926820\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_225926820\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1628_225926820\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe
4760	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218022411056250"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{F0A8B8CD-8A36-4BCC-A00C-767537CE7EDB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
2880	msedge.exe
2880	msedge.exe
4752	chrome.exe
4752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3480	1628	msedge.exe	85
PID 1628 wrote to memory of 4056	1628	msedge.exe	86
PID 1628 wrote to memory of 2520	1628	msedge.exe	87
PID 1628 wrote to memory of 4056	1628	msedge.exe	86
PID 1628 wrote to memory of 4056	1628	msedge.exe	86
PID 1628 wrote to memory of 4360	1628	msedge.exe	88
PID 1628 wrote to memory of 4360	1628	msedge.exe	88
PID 1628 wrote to memory of 4064	1628	msedge.exe	90
PID 1628 wrote to memory of 4064	1628	msedge.exe	90
PID 1628 wrote to memory of 4064	1628	msedge.exe	90
PID 1628 wrote to memory of 4800	1628	msedge.exe	91
PID 1628 wrote to memory of 4800	1628	msedge.exe	91
PID 1628 wrote to memory of 4800	1628	msedge.exe	91
PID 1628 wrote to memory of 4556	1628	msedge.exe	92
PID 1628 wrote to memory of 4644	1628	msedge.exe	93
PID 1628 wrote to memory of 4556	1628	msedge.exe	92
PID 1628 wrote to memory of 4556	1628	msedge.exe	92
PID 1628 wrote to memory of 4644	1628	msedge.exe	93
PID 1628 wrote to memory of 4644	1628	msedge.exe	93
PID 1628 wrote to memory of 4324	1628	msedge.exe	96
PID 1628 wrote to memory of 4324	1628	msedge.exe	96
PID 1628 wrote to memory of 4324	1628	msedge.exe	96
PID 1628 wrote to memory of 2108	1628	msedge.exe	97
PID 1628 wrote to memory of 2108	1628	msedge.exe	97
PID 1628 wrote to memory of 2676	1628	msedge.exe	98
PID 1628 wrote to memory of 2676	1628	msedge.exe	98
PID 1628 wrote to memory of 2072	1628	msedge.exe	100
PID 1628 wrote to memory of 2072	1628	msedge.exe	100
PID 1628 wrote to memory of 2072	1628	msedge.exe	100
PID 1628 wrote to memory of 2184	1628	msedge.exe	101
PID 1628 wrote to memory of 1680	1628	msedge.exe	102
PID 1628 wrote to memory of 2184	1628	msedge.exe	101
PID 1628 wrote to memory of 1680	1628	msedge.exe	102
PID 1628 wrote to memory of 4868	1628	msedge.exe	104
PID 1628 wrote to memory of 4820	1628	msedge.exe	105
PID 1628 wrote to memory of 4820	1628	msedge.exe	105
PID 1628 wrote to memory of 688	1628	msedge.exe	106
PID 1628 wrote to memory of 688	1628	msedge.exe	106
PID 1628 wrote to memory of 1332	1628	msedge.exe	107
PID 1628 wrote to memory of 1332	1628	msedge.exe	107
PID 1628 wrote to memory of 4628	1628	msedge.exe	108
PID 1628 wrote to memory of 4628	1628	msedge.exe	108
PID 1628 wrote to memory of 2128	1628	msedge.exe	109
PID 1628 wrote to memory of 2128	1628	msedge.exe	109
PID 1628 wrote to memory of 3812	1628	msedge.exe	111
PID 1628 wrote to memory of 3812	1628	msedge.exe	111
PID 1628 wrote to memory of 3812	1628	msedge.exe	111
PID 1628 wrote to memory of 5012	1628	msedge.exe	112
PID 1628 wrote to memory of 5012	1628	msedge.exe	112
PID 1628 wrote to memory of 5012	1628	msedge.exe	112
PID 1628 wrote to memory of 3308	1628	msedge.exe	113
PID 1628 wrote to memory of 3308	1628	msedge.exe	113
PID 1628 wrote to memory of 3308	1628	msedge.exe	113
PID 1628 wrote to memory of 4804	1628	msedge.exe	122
PID 1628 wrote to memory of 1404	1628	msedge.exe	123
PID 1628 wrote to memory of 3648	1628	msedge.exe	124
PID 1628 wrote to memory of 3716	1628	msedge.exe	126
PID 1628 wrote to memory of 3716	1628	msedge.exe	126
PID 1628 wrote to memory of 3716	1628	msedge.exe	126
PID 1628 wrote to memory of 1916	1628	msedge.exe	127
PID 1628 wrote to memory of 1916	1628	msedge.exe	127
PID 1628 wrote to memory of 1916	1628	msedge.exe	127
PID 1628 wrote to memory of 3612	1628	msedge.exe	128
PID 1628 wrote to memory of 3612	1628	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.ciclosrio.com.br/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe3cc5c188,0x7ffe3cc5c194,0x7ffe3cc5c1a0
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,15649138874732096577,8208154399853200713,262144 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6344151865802405530,1454728363919561164,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,2897988836182704907,14863352011089990495,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14619741120613247220,9929380904309001241,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12196130425099345608,4186731649147513462,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3760847840708320509,5163770666165644993,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,741858210081215596,17915495655014149763,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,1406329884435337716,1433362645261250942,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,5038063535146631429,10697833124199878466,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,5349089516181203408,11538650345412623615,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5436,i,859518458957366576,3989808499828769706,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,13228381988362634569,16943709537870762510,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,15262014044948868376,16232870183861996128,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12952720261903965374,5593323982007595472,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12952720261903965374,5593323982007595472,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14216527996340345073,2462663789656147891,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,17847579902505692146,13016960866492149298,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,16984058536978477623,8001164485092105976,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12239688012743596760,5731054013325010538,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,10898655047689098948,7148533944928685869,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6784,i,184566118619310721,12986864135549484377,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6804,i,1605445471066104594,13783586992651040773,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5200,i,5130840780829140169,9207021142277287836,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,692768822222073646,6931046967704859487,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,14004501841917736048,17323290294256931181,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,12429524419569354796,17481208050451366850,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5800,i,18271323815395638910,10769364473839677948,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5796,i,2425677837152808683,16156622991214048944,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5760,i,1014339719089689982,2183042101564596828,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6744,i,1888104064586597335,15382866987240905096,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15818101822165861315,9905229622649044351,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15818101822165861315,9905229622649044351,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5768,i,14768920787538667518,13836204141950754979,2097152 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,14250091637145234650,10438074609354131153,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,9372388512680611064,6235149224699710608,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,9372388512680611064,6235149224699710608,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,7467320402680619168,8850804897489251903,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,2978634245002641365,8253413142217147810,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,10362855482534454177,212652601695160183,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5724,i,5157347126377491037,9700001883819699078,262144 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7887000525730079363,4989335809799111237,524288 --field-trial-handle=2272,i,1563546506649390406,8290131061795646630,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe2e05c728,0x7ffe2e05c734,0x7ffe2e05c740
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,13208488733727851370,12985916892024225405,262144 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,13420598556165311716,8001635108079488337,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14546424352072153725,11531277198494460434,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10392026139114742713,12711110605142124869,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,5202315426286757067,1673619821522270575,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,13137336074926053283,17177902594810637025,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,16257407427951545192,12436585359453422233,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,5857706444635234993,9684055530278578470,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,4910851947452040266,111615491644874181,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3700,i,3584346077223582477,11250840782831776881,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,5719290404300262782,5024799172372983879,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,14805081747692730544,12017403617730466091,524288 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3408,i,3454930361700616113,5465138025165597526,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,6396044771912292939,11154665134849878809,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6036,i,11189950307685467939,16967521938069615108,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,1992551607680183579,6832802068274961277,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6036,i,4276599911175821918,15525114097844579908,2097152 --field-trial-handle=1948,i,8922824041074478254,383384746633752113,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1628_12285481\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1337265466\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1628_225926820\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1628_325063747\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 87b38b99a1f19a10cf50312397f7dfa6958598abb11399ca6c51dc08ae2475fd
MD5 0dbd8956dedfebff7bffc5655c756205
SHA1 897653c712efaa4d026ac1d308446a2d26df214a
SHA512 03ed7c3b52bd2618ca13c4e0afa57fab228e5b648c56dba9304cbfdf9de4c3a40472788061645511fe8cb51b11a0855a5c7e0afe434cd41805f5e9333f9ae49e
TLSH
T138E02BB6D921EC3B08FD075C61514747E710232B3BC0540F3A3D820DCFB063609928AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 35e13da7b639854df9fa596b03da5abe7d6db29bdc96474271eb872042e18bad
MD5 870af095e2a289735258aeee5fa30f26
SHA1 c5733b6391a501699094b9e6b65ae8e45b6bdd19
SHA512 c85c5d6edae0514667e9e355c306c5a271ae0f641cbaead7627d3fc1edea13e3612531f3abfbce55ccb98ad4b16ec03fe7885a21bbe304d6a79990f01c5bb2df
TLSH
T1090126D056856A2ECF741DB1B93B07AE60FF15D30062AA5B029CB06865851FB13BE314
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d779737fe060c99f5e6ec6f52b99595a0607b31e8d643720d514f91809da2cfd
MD5 4e15daeac83a7a6df3c1ee7e1379b7b8
SHA1 035ac36fb95a0f7a5891f66ba4cd34754f0c55e2
SHA512 af76e46978df51ab807cbb251752e7542172fb880ad2f00a4f0ad62e97920d7a209f8c93167594fc28b8593a131d2bd2047fd0f70a6f500daab88be07b7d0ba9
SSDEEP 192:kRMcBhHxZveKpu0rZv7CMpAPRp2fnF93Hsb+WNnSirXvedp2QKa9KZVyIsnAUgrK:kRMmhH7vpx5xUX8xwTjeP29ame
TLSH
T1A452D76EB914793B9CEAC319F951771BE7F5102161C52E84EAFCCA2C24E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a7763821c2f97699d6428258e17bc79dda58d37a061205fd70351c92e3364a31
MD5 5ac9953a8add9fcf5d6af1b16c0af8b0
SHA1 913835213472fb0dc3d0c2d62c18c6fb0bc2c719
SHA512 e63cd74cb046c4f57a9470b77f949bb582a643ab2c670470d87d82e152e73fce6e49cd4e339438a78013ecf260873779c4e75c2f00b8092b1905070c9399af00
SSDEEP 192:kRMcBzHxZveKpu0r6v7CMpAPRp2f1F93Hsb+WNnSirXvemp2QKa9KUVyIsnAUgtK:kRMmzH7vpxWxUXOxwTjeW29aB8
TLSH
T10D52D72EA924793B5CEBC31AF951771BE7F5102161C52E84EAFCCA2C24E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 24dd47fe211fe6d65844e7fdca00f2446ed1efb3abb04f829c731a36173a0e67
MD5 d53de96df449fa13d0c9950819335c67
SHA1 f7c812bba21780a35b059cf1b2fb7ae458da78c2
SHA512 82c7a5c6eebd45df8efa535de7349dd3187a23e89b691c44de3d8ac5bb042c8b42c824ef5bd67ed2737f44b8778e1745a73526ab848dedf71172ce6cfdacd724
SSDEEP 192:kRMcBhHxZveKpu00Sv7CMpAPRp2f0HF93H3Ub+WNnSi159+Xvejp2QKa9KZVyIsB:kRMmhH7vpu+xUXnx4Ttqe929ame
TLSH
T11852D76EA924793B5CEBC31AF951771BE7F1102161C52E84EAFCCA2C24E79CD621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b4c777d1b7efdf27fa2747852df464856bce8336a3a2d80d46197b3673e218b7
MD5 37c4c7a7606022b5b043c35596b632cf
SHA1 1d261ada461005edd91262c1e0c57565bcc7daed
SHA512 fe2be038e7e51ba8c36a76ab2bd62caea2890372808837ea147345baa4628cced2f7b964b368b6a0e644905806a33b5aa8625aa082ff943eed43f823d1759d54
SSDEEP 192:kRMcBhHxZveKpu00Zv7CMpAPRp2f0RF93H30b+WNnSirXvedp2QKa9KZVyIsnAUp:kRMmhH7vpu5xUXVxYTjeP29ame
TLSH
T1E952D76EA914793B5CEBC319F951771BE7F1102261C52E84EAFCCA2C24E79CD621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af6a623deba1384a0efff9911e264981791fd0d9a47fdca75a44ce946af098f5
MD5 f716ccc3f97e7f8beb40f2ae27c26ab2
SHA1 8d133d1676d91f79d240aed3abbf3c6d15acc4ab
SHA512 a24820c578b4f31ea85c6563acc19616c5fa10cc460d4251ced9cf202e8e145cbc9153c26d8000cf91155a7e57c083a0e77d3697f8373a17a3d077f0baacf5c7
SSDEEP 192:kRsHxZveKpu0r6v7CMpAPRp2u93Hsb+WNn3X0qp2QKa9KUVyIsnAUgtaJ:kRsH7vpxWxUXZxwn0C29aB8
TLSH
T12242C72EA914793B9CEBC31AF9617717E7F5102161C52E84EAFCCA2C25E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d52730e7a9c3a861b62620ab734223585d06f5ea01b98d862342300652c8d0f1
MD5 a0a3af0ed3c052140d6681077d5b0a55
SHA1 75f3c36e935b25a59ae43da29a87d496e12c9bad
SHA512 01738ee4c4fd2dec4d37fe93bf40fcbfad42163b0a2b7e561262647a8ef66df9c6db3bf015c7942d5edd46fb3c3f6b65b9a4d8d1be080c4eceeab2b247e1ff69
TLSH
T1CCB0126280425541C44702F4218204883615DF128745230963E569B1EC261904018150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab4a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ab4a.TMP
Size 96B
SHA256 56ac2114877957a45a358dfa6044522eb986a45d8ab8453c86b3397e147b9bd4
MD5 13fb4e1ed498cb889d845e079110e479
SHA1 cbf477497ed5210735c05099d35ed75e09785f24
SHA512 38b4cedffd7dd102ec3de48f6384e6ce498f91a270a7c3ff5fa8e40c220e55542e822045ccaf034ad82d8850758f8b2dbd9e271906be06723e315debe59956b7
TLSH
T1F3B0220AC0822303C00A0FB03AA088F83020EF3EC2030302A2E00EEACC202300C30220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4da46b361b3b44b45fbbdf356e142ef93cf2c1048358693da8bbf5c0ad656f59
MD5 cf0fa24d9e0b8775b95654d2bfa937ef
SHA1 e603c5a5ea5f381d5ae575795d083801a015f003
SHA512 5ea81641f4a6b681f91dd98111cd0436ffa91be3d9f0467127711b59c96f3b9b458ff28ed997ba9b44207d89b5ba91e8aa57ad14c92923835e8e5e2615735a4e
TLSH
T1DEA0021899504442D1504672219726806274DC51C1572F47459490C6A8A02409541148
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 4ee7283e35c6c1cf6f7be598c907d48a8172a72b8b26e82dc75be4a3f51426b9
MD5 0535d747e75fc77a2d7acee77426bde6
SHA1 79722bc8c4636b944de590ae88b2310ea3d7be3c
SHA512 91c140850ebfbc78c3b3cef6650fa9796c8eb4caa7d578da08b4a959e2c62537677d1818c7674c8d6eac61c633c6e059363e44daa8bf687c042d49e6c575a30a
SSDEEP 6144:JTTjdrGYEHIJVNyr6orOk0HOGm/SFyEEk:JZrNYr6orOjuGdF2k
TLSH
T15F142273EB1B0C6B52720356750E650DCE13931EE0AFB8C87764D69E22C80A96B33E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 599700a02439c8569283144388b375c6de4ccbd80d3a6c9f3cdc1020360c2d55
MD5 df87f9a031b5aa26dddf132a13f5cd8d
SHA1 46efe59fc6533e1ed7bed451332f0987b22748b5
SHA512 8ec217b650d0c6a36e999ca347e44117c652d033d4ace765d9a01350b1874eb4392e1193b8d88b76bf32b69b6883ca14ab15c1664cd55c80727b00a7e26f91a9
SSDEEP 1536:ip/FcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aF3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T11C9312BA4E2646E7997D4A8176AD7909CE12534D705FB9CC326C638C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c73a890a838046adb82e213301fc1c5749ac95e083d029743abc0e272e79ed6
MD5 b520d408f03f20b586ef010105430967
SHA1 54695bce7e3ba1dba41534a347052e5f75de3085
SHA512 b84b06a2454fe0b8cb1aac12a334ab5295f519a8706f779aa121ae51481a62125ed9ef251c8eeb24a7d05f4c0c0c337480bb39a027e729067da37f5a904d616a
TLSH
T16861B55CAFA68459EFE791B096FA20D473BC755803170E3EC6E676FC4A12B724054B2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585772.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585772.TMP
Size 3KB
SHA256 8fae0808b62cfbe779e460284515a8a1d78d38fff18b68f0fa108d2766bfb0f3
MD5 bb4175880c7856b2a1ecf32e997ccbdc
SHA1 570ef5771621bd2daf5abb91ae31d9a169d0b3a4
SHA512 72e7ec42a328aa3d6f2429e355e2343050b95e70b368c1294a8aa6a187754074ab5405efd971ca7684df5dfa503fb8d7edb45129e899fe94eb53d2147c4d26ea
TLSH
T19B61B55CAF968458EFE391B096FA20D473BC755803570E3EC6D636FC4A12B724054B2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76315d311ea2f03652db5873b8fef33f6d4b05aa5681ecefe349d7731f19092d
MD5 9c280af7f5de09a4ce03be49d5869ff8
SHA1 ceff6bbd6771a6735ca7f6565065894f0949a0d8
SHA512 664ecbc63db509eaf9bffc82351f42e0bd47179e0ce2fce241cc06d3bd65db9384ec57c92f1ad16ed619ca8e1f402f87097a57b2c1f2e23589c845fb16ef6995
TLSH
T176419DF3C3E4856DC91155F0AA18BE2BCE1E0A54432C3D5A89E4EF5B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0116bc3a85a9c24121d8b33d0b244d4f91ad7172b7a2692eb54b34c433a366ba
MD5 047ed41103a15c427843f67f2e5d071b
SHA1 a17da24c562b2423b2968a8d16365368322455e2
SHA512 7f7cc21b89d332587439ffb159e3acc9739213407707966062e8f5017eda4494e080730409bae21390bd378f6b87f30ae62ad99e68a8b0b515a6c6e5720e9056
SSDEEP 192:sxZeRJyM//K1Ml8Mk7/fgsGLxZIBGXIdpWfHfin6+WNGYJS+RGIg4J:sxZetM7/fgsGL94sH1GVc
TLSH
T1D952E8166A389D77CCCBD209B955BB53D6F91572D2900D44AEFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b2cec4b7f10dcff358693f8c4a1193466b975f0a90c983c80000910661bf93f
MD5 6563911420e2db4477f6058f74d0219c
SHA1 ba611588f055d28585b4cce8a47917023635c3cf
SHA512 4062f7e47740717430c15936072c2f0cadd283165796a826f0105f4919eec1a1a1715eb28b7ce81b42bc7a27658015620030e5bd809dff4139bda80c25f8ddc1
SSDEEP 192:sxZeRJyM//K1Ml8Mk7/fgsOXxZIBGXIdpW1Hf06+WNXfoX/YJ2uRGIg5rJ:sxZePM7/fgsOX946HtM/zD
TLSH
T1A362D6166A349D77CCDBD209B995BB53E6F5556292900E48AEFCCA0C04E6FDD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 74ca94a16d6bd5697f8fda156e7c29bdda64ca94a4e34baf6b02bc726d507e8a
MD5 76b6cae05fd57082870394e53b1ea12e
SHA1 0e5ec07615016b2fc9b359823f2ec7d930698109
SHA512 cfd3b3eb3bc9f3b43f058dcadfa645f1d42542c19ec595642672e99b9d2b2bae1df18dd77bcbd71adee4c6ed19bd4ed1190926a348ace9b4d3e9bebdbfe33406
SSDEEP 192:sxZeRJyM//K1Ml8UQPk7/fgsOXxZIBGXIdpQ1Hf06+WNXfPECoX/YJvG99GIg5rJ:sxZePq87/fgsOX948Ht0F/LYD
TLSH
T14D62C716AA349D77CCDBD219B995BB53E6F5446292900E44AEFCCA0C04E6FDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4fcbb3feeec25da0d3b1064541d392b3324357b30434de7f3a848a78e5183039
MD5 3ea17bd625b1d8a80c59c0e4c9cb9835
SHA1 7118ae03d55b81b3be31a0b41346e2c16aa7819d
SHA512 d2ecfec487ee7c991fcf1619380cb7e2b22551c110bb84bb2788185bc64100c4b318b30e97f04f9d1d5d94cd9fbd79545b243f20c64e6a66262766496a90925a
SSDEEP 768:WzQv2Bi7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoDnFLllnWhtroN:WzQv2B6EneqWve+l+u1jaRDnFLfWhGxv
TLSH
T1A8F20A3B6C0CCB7E4F804E9CEC2A6E8E6DE8018B96D8895447FA845C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 aa029a0cf1af24eeec931a7ba8f0766f30b879f0237bbd345b066f1e1d69c4db
MD5 dc7411521535a32a132e01f4adeced0e
SHA1 1a61befe33a413238bc6343a0822214689d70ee5
SHA512 bd49edc4f8e894d0e773c8ecb3c35c544ac2333c21e293db4d2b89e0db97cb6902494db4bed717be47ecbf477fb83d82667b26c1a1262deca7efe99031e1ee22
SSDEEP 96:KkE4Kh6COpuKqYK2daKmkViYKPa+yogK9me+QKjC2g:Snl5Z5rT6jg
TLSH
T185F18510327B0640393F298DD594F92B52C235A73019A93B7BB940B64FA7E64DCFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f400.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f400.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 406d0f25a22e890a8c4d6b301405430378202b7f915874c660a38bd31890f968
MD5 fcdcc1c7ff2c82b41db118abc2720a3f
SHA1 a1d151d70cf91e6c2443cb75c051c7155605fe18
SHA512 c974b6489448f2fffb225545fdf3deacfd1a45fa7a50d5b93c3ba6f6583098b1de585950592f35334a631df49fc1d961e5135c4991969fc33ad18101bcc1a3e6
SSDEEP 384:n1iFCjccCs+Bt0S3VfsN68TUNTUlIlbPrcg32gTifpp+AMUJXmTV5fPDznmHf3H:8FsccQ5pwgR3zUYUJXmDDzmPH
TLSH
T10FB2F676D8A4DE3BEDE38B81B64A7A479EF051A786D86ED4D9C94E0C00C71DD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e0ee3e4ad3a1438bf832dca7e0a530b092f4d17925659da87861dd63a64b4b2d
MD5 361f8da82593d02d50da6978d4ea726e
SHA1 37d3fc5865e8d340f2cd15a73795dd5f380eefd3
SHA512 a4ac1dd29f8ffdb2b7c30db2902899acb4f5fdb4489d8b40914ed2e191ed3606a2f1eb8af38139ff34110305eb58b079c045d67053ec428c342b2fc374e4a499
SSDEEP 384:nzjccCs+Bt0S3KsNf3Prc12gD+AMLJXmTV5fPDznmHf3H:fccQqFzOLJXmDDzmPH
TLSH
T12D825AB528B86C3B9AA39955F18B3B43AFB050BB96942E64DDD94F1D00C71DC170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8d612c5c01ceda9b53924e0df6e5dbd05f6a3bdb62e22e116fbb9fd455ddbe5
MD5 dc6fa34bc24de4d4f9edd929a74effdd
SHA1 d0020ea9ffe1bd436e124fc15b3ac0af4d44114a
SHA512 9d7842a7053f8a68057ca81a33f8c3efef295cb5728adad799c4c37161c6f426adfbd660d9b4e2c0925a59cd7b7b641f412b89b7a7d56250c09602e1c1a3152a
SSDEEP 96:iqONkCQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5cyD6BEPgpYvJKxCbTqNGL4exN:ZONS6IT0JZQmiUy7qOgibFk/HuFuw3U6
TLSH
T1FA02D975B86C6C7B9EE36E59B08B3B235FA4106FDA952F84D9E81B1C00D758C1703836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b9e9539a54e4887070f6814ec17be852e93d3a239c975d08bc87ef57842e8d7
MD5 eefbd37b71378cc26da31f69c40e6ccb
SHA1 40bab8e655e52dacfd3db6a0a95a0fb10d178e9a
SHA512 ac3751e9691b9f4938333d82c40bf29511080ba6e79530e0b8edd92445f4d0956ba0c4d8c78a0f851133b45037d32c2428a17ddc5ecd80028292147778e6f12c
SSDEEP 384:nfjccCs+Bt0S3KsNfKPrc12gD+AMLJXmTV5fPDznmHf3H:rccQqwzOLJXmDDzmPH
TLSH
T19D825AB528B86C3B9AA39A55F18B3B43AFB051BB96942E64DDD94F1C00C71DC170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 95c0ac9b3c57bb3584e06991977c505636e684b96935105645e6dccbb0476938
MD5 8a006aef7ad422c5623199a22876ee58
SHA1 35cb150baed1eae7a7c384db7fa3a068826ea1a6
SHA512 4eebf57eb54a3e96f422986a3e1d6631d9fc37abf8af04163cb5b85180de3642cff4d748e8348bd8cf69de36b8915ae4912e1ddf09df4f3d64cc4fe597ec2ee5
SSDEEP 384:n1iFJjccCs+Bt0S3VOsNB8TUNTUlIl3Prcg32gTDfQp+AMUJXmTV5fPDznmHf3H:8FJccQ4cwgB3zQYUJXmDDzmPH
TLSH
T10EB2F77698A4DE3BEDF38B81B64A7B479EF051A786D85AD4D9C94E0C00C31DD070AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85dfe73bc868038b83e625f4a9d429309dc08e81c347672f33d22f176f5575cf
MD5 0dc2bf665c9947344fe93825d39eb3db
SHA1 beca904cfa8a84f8e5eb98cfd14b611c4b2709b4
SHA512 3652bd59d775a302cb51245e435a7519fa002d9be271830100e3ef6d2e49c8b117241c39b2ce26e8eb67a3dff619cbd23f22bd66c844cc965accdf0a9ae9ca0d
SSDEEP 192:nRONq6IT0LPQmiUyvqigibFk/HgMth15qcXU6:RONq6lJigi+AMRJXU6
TLSH
T1561208757868AC6B9FE3AD55B08B3B235FA4217F9A852F94D9E40A1C04C358C1707836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

493d8dbe-4e6d-4057-819e-c484b4cdb975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\493d8dbe-4e6d-4057-819e-c484b4cdb975.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c5d13510d06238e419974a4fb78a4b0813232a66821501267be796f90bb2ea5d
MD5 6bbddf724e64bf290be3f452c712075d
SHA1 f1c31434c7f456db8ae20f0cb4917a66f112b909
SHA512 2de75100fe7c2b9ccaf1347c5976852aad0aad589248ea48653b337a47f87004bc5dc06233fbbc5e954dbc040ba0f38a25c02d60e2a850eb6d9285bab7956f70
TLSH
T19E412B98AAEA1148B3B77E569BF6A86E487B79372E07C45D10050E4F0A63F00CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

24361778-cf72-4c52-af30-bee51154c6f9.tmp

Path C:\Users\Admin\AppData\Local\Temp\24361778-cf72-4c52-af30-bee51154c6f9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c450ac5f-7718-4904-9162-4c9ccfa62b57.tmp

Path C:\Users\Admin\AppData\Local\Temp\c450ac5f-7718-4904-9162-4c9ccfa62b57.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b3974fa-6b95-429e-b7d7-aa0c9a392a00.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1628_739553719\7b3974fa-6b95-429e-b7d7-aa0c9a392a00.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1628_88221380\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4028-570-0x000002185FA80000-0x000002185FAEB000-memory.dmp

Download

memory/4852-600-0x000001B655A70000-0x000001B655ADB000-memory.dmp

Download

memory/4868-506-0x000001F42FE70000-0x000001F42FEDB000-memory.dmp

Download