hxxp://gogle[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gogle.com
Sample260502-cytpyact4k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3084	msedge.exe
2352	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221625931150770"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{9403164A-642C-431F-913A-7B7EF4AB8BCD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1360	3408	msedge.exe	80
PID 3408 wrote to memory of 4652	3408	msedge.exe	82
PID 3408 wrote to memory of 3084	3408	msedge.exe	83
PID 3408 wrote to memory of 4652	3408	msedge.exe	82
PID 3408 wrote to memory of 4652	3408	msedge.exe	82
PID 3408 wrote to memory of 4484	3408	msedge.exe	84
PID 3408 wrote to memory of 4484	3408	msedge.exe	84
PID 3408 wrote to memory of 1124	3408	msedge.exe	85
PID 3408 wrote to memory of 1124	3408	msedge.exe	85
PID 3408 wrote to memory of 1124	3408	msedge.exe	85
PID 3408 wrote to memory of 3352	3408	msedge.exe	86
PID 3408 wrote to memory of 3352	3408	msedge.exe	86
PID 3408 wrote to memory of 3352	3408	msedge.exe	86
PID 3408 wrote to memory of 2268	3408	msedge.exe	87
PID 3408 wrote to memory of 1612	3408	msedge.exe	88
PID 3408 wrote to memory of 2268	3408	msedge.exe	87
PID 3408 wrote to memory of 2268	3408	msedge.exe	87
PID 3408 wrote to memory of 4456	3408	msedge.exe	89
PID 3408 wrote to memory of 1612	3408	msedge.exe	88
PID 3408 wrote to memory of 1612	3408	msedge.exe	88
PID 3408 wrote to memory of 4456	3408	msedge.exe	89
PID 3408 wrote to memory of 4456	3408	msedge.exe	89
PID 3408 wrote to memory of 2304	3408	msedge.exe	90
PID 3408 wrote to memory of 2304	3408	msedge.exe	90
PID 3408 wrote to memory of 2304	3408	msedge.exe	90
PID 3408 wrote to memory of 3216	3408	msedge.exe	92
PID 3408 wrote to memory of 3216	3408	msedge.exe	92
PID 3408 wrote to memory of 2008	3408	msedge.exe	94
PID 3408 wrote to memory of 2008	3408	msedge.exe	94
PID 3408 wrote to memory of 2008	3408	msedge.exe	94
PID 3408 wrote to memory of 4580	3408	msedge.exe	95
PID 3408 wrote to memory of 4580	3408	msedge.exe	95
PID 3408 wrote to memory of 3256	3408	msedge.exe	96
PID 3408 wrote to memory of 3140	3408	msedge.exe	97
PID 3408 wrote to memory of 3256	3408	msedge.exe	96
PID 3408 wrote to memory of 3140	3408	msedge.exe	97
PID 3408 wrote to memory of 2240	3408	msedge.exe	98
PID 3408 wrote to memory of 4508	3408	msedge.exe	100
PID 2240 wrote to memory of 4072	2240	msedge.exe	101
PID 3408 wrote to memory of 4764	3408	msedge.exe	106
PID 3408 wrote to memory of 4764	3408	msedge.exe	106
PID 3408 wrote to memory of 2060	3408	msedge.exe	103
PID 3408 wrote to memory of 2060	3408	msedge.exe	103
PID 3408 wrote to memory of 2364	3408	msedge.exe	104
PID 3408 wrote to memory of 2364	3408	msedge.exe	104
PID 3408 wrote to memory of 4912	3408	msedge.exe	105
PID 3408 wrote to memory of 4912	3408	msedge.exe	105
PID 3408 wrote to memory of 4764	3408	msedge.exe	106
PID 3408 wrote to memory of 4764	3408	msedge.exe	106
PID 3408 wrote to memory of 4276	3408	msedge.exe	107
PID 3408 wrote to memory of 4276	3408	msedge.exe	107
PID 3408 wrote to memory of 4276	3408	msedge.exe	107
PID 3408 wrote to memory of 2228	3408	msedge.exe	108
PID 3408 wrote to memory of 2228	3408	msedge.exe	108
PID 3408 wrote to memory of 2228	3408	msedge.exe	108
PID 3408 wrote to memory of 4512	3408	msedge.exe	109
PID 3408 wrote to memory of 1556	3408	msedge.exe	110
PID 3408 wrote to memory of 3788	3408	msedge.exe	111
PID 3408 wrote to memory of 4532	3408	msedge.exe	112
PID 3408 wrote to memory of 4532	3408	msedge.exe	112
PID 3408 wrote to memory of 4532	3408	msedge.exe	112
PID 3408 wrote to memory of 1452	3408	msedge.exe	113
PID 3408 wrote to memory of 1452	3408	msedge.exe	113
PID 3408 wrote to memory of 1452	3408	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gogle.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffaeaf6c188,0x7ffaeaf6c194,0x7ffaeaf6c1a0
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,3215065006409095395,5015983383419063922,262144 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,16922152701473582490,7297005879970536466,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,5951137540234176765,483598762003869738,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,15674721255900779525,2292263194466892319,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,6861680448614619306,14266214963376522185,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,7113144945470160653,17438538891415403336,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,2914664195689374064,9860256500574300165,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,10734115381587374780,1924837264766848590,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,17444997277438270309,16491425454649196497,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12599325466987507744,1055416871856524146,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5380,i,9474042008993489561,17721300502503209694,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,17734071123837288182,5001791191027074923,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14902980478968697702,8119135317429378001,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,11867873464862042297,9554322310340115341,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,4501193340242294168,9006663758823703170,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,17649083986912941289,9666627457171928828,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,17649083986912941289,9666627457171928828,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3784642489750996890,7355783191783567453,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10669296599398360403,8491387766579648869,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,7541599184754489577,7469780829255216219,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,17046993509086373189,4747603542756260101,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7602544244388721566,931587831714385626,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4184,i,10109337176434591895,13071054910081935827,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5472,i,11830381210657800982,9775498911501040872,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,8407692689023631945,14009329743107843099,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7786950146721657664,13755169422555208692,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5799087614933892247,6591439079501067208,524288 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3816,i,17468535463786707690,14096792276011224295,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5436,i,4933232084528005960,13585458414381416551,2097152 --field-trial-handle=2388,i,14621361109753758658,13114121100061669782,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadad9c728,0x7ffadad9c734,0x7ffadad9c740
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,14913937118960723953,2718863681613911862,262144 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,7778408311852972731,5453935925925389618,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,985034885544516315,7383040024348847783,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,8179651889491869410,5296965560356781087,2097152 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2453623034328159536,1258103729306384210,2097152 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,8716581267366092878,10229136180017614750,2097152 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,15246800213957864418,15879570530285759362,2097152 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,14977412074511894729,9884427238561084582,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5664,i,7632667937484660797,6616302853352437253,2097152 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,12163783992521731643,11568748682731203886,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,17612864165812534382,7704678363158228668,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,5062349366590004917,103832971941737622,524288 --field-trial-handle=1936,i,4111654305450009945,6486558369066985409,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:3124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ba1434651a50c954883b9046d303dfafca5125ac0f661eaae13448c0883b7fea
MD5 466469ca3ec31b3bdaf50581a1c589de
SHA1 72844a935eb631075288ae456ff9d556f9089534
SHA512 7b85791bf448ac218de9f04d6a4078268200a485358d1448e03952373bcd37ab8dea755e32d18d863dc5c44280bdfe3a599af4d64cc57e25c67221a02a77491a
TLSH
T16AE022FBCC22D82B18FD0B2A60148BC2FB0013676B80858B3A3C820D8FF063B41D596C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 80KB
SHA256 5143a87cf81e3e47d63e7336b52a21ac3ef830aa32ae975626ff5a3e6b85fa71
MD5 45d027fd6ae66c7d370cd73bc0ae94cd
SHA1 6beef066bd243b498db5c344c781ae9a74b06243
SHA512 e65232b1a9257ab3d475a23b842cd717b4e79c27d9afb4c0b687756c0ce5b344af82deea9ff126487616a2dcbc3ccc8bb3e9d7574dcaa0437a8c3ad26e0fa3fb
SSDEEP 1536:yCe8HdQm3fKdX8VnCxcX04B0CTz43aphU9I5a9zZSBxH2peADk+jtyx1Ff7Hz/QU:y49QSy2XTvP43kUuyQuz3JyF7Tf
TLSH
T10683022DE0AADA14C5E60D323F0A6043B6B058C29F65EB1D214E3F19E17EF11D89979F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 81e124845ef25a84e540c8b1854a9378723b3fcb4a992f4bf831a4e791252beb
MD5 a135fad7803e0cb973cb6a5989ab2c2a
SHA1 ac5f8139291877354d59a665d65f09daab40a59d
SHA512 15382146fac38cf760179302a88f670dda7fea427c58e7f7c8e62a03e162c1215d12c83ae727b00b31bb8b5a5504eb31f57be8d69a7dddd4e08974f3580e5dff
TLSH
T10EC09280A9B24066CFB402F41A6A164D72B4C9AC19DBC29AA6A6428CAD12A529120C4A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 baace4488bcb635b486aac94a0497e2599f1e2473062d65c093b895f8a8b9bb9
MD5 b92f19af5b8cc58ed60859fb0bd8984c
SHA1 3440043b1dc64d78ff9116ff0a9171039532cece
SHA512 79294d3bdf31e47cd33982ee17df4cb4f2e3746aaee84e7e8173a1232c50ea4816fed9c57286ce6c9ec1f096a7c9046a01769daa07eaa2f46f4cf05b7c6b5d38
TLSH
T13C01C9C0A0638090CFB037B0B35E0B4E29B0CC8864DBC1609207EB95FE23FA2105081D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4cb08f5a893ace7fcd153d3bc7976e66076874e29f1d3b378c8fcf228800cde7
MD5 fce97b78c542302c5e39439d95319896
SHA1 f7f03a6e6d6f4c133b214247d66099f663fca5c3
SHA512 83e406ea0596c1dfcc6871bf585d36e0f0ab92bd7aca3b889a739b75d3aa0c0664951f2b2cdb9e23065d9a56ddd4aec910d29d96aad65b4bb4e719fd90a49fd5
SSDEEP 192:DIzxRV8TVgNaIaaVnfM9KSwjW8U8IdI+zI0cIaG:DIzxRV8TVgNaIaaVnfM9KSwjW8BIdI+/
TLSH
T10DE16DB7C3D8852D891156F4AB257F1FCE2E0A14432D3C27C8D8AF8B93E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b50d0bac1e09cb80053a947898dc439f7702fd9116163bf9601f7d764326d042
MD5 0c862f9f1ce437f9b65ced17dab4c08f
SHA1 8e1e29c9c91d7436ccaaa74d610ddf44b2020fc0
SHA512 eb0e3ca6f0c862b4c5379b9f8f591492884d390ab34828973c437f2b1b130688a8abe17aa027236999063a4d5f90ad06360f08177e452c6c8748109283ba0a52
SSDEEP 192:+RcskWuBlci9imv7dpAPRp2d9ZHsb+WNnmE0cFyHskwwCSVyIsnAUgtaJ:+RLkWuBiSpUXGHwB0IyM/S8
TLSH
T17042C52EAD24253B4CDAC229FD61B757E3F6102161942E84E7FC8A1C14EBDCDB21701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f1f4912043dc0a5914ef3cad2dc77f757c58f5cb97faab8fdcfbf0a37665a2e3
MD5 d082f496d835d65642918434cc894cd2
SHA1 3e27219e7ce730c0262ce7ec4fe5e30c52908e30
SHA512 4e64c30c66020d779d52c057f1bd3df26c80b0c00e089e4d0d026a3c8e0a9e96aa8f9f532e95aace12194a9743f3fe29ec824dfcb06e586f387980d4a0ed0fe7
SSDEEP 192:+RcMcBzkWuBlci9imv7dpAPRp2e4G9ZHsb+WNnmE4pXYdFyHskw5CSVyIsnAUgrK:+R3mzkWuBiSpUXDHwBmYnyMUSe
TLSH
T18C52B62EA924297B5CDAC219F961B75BE3F2102161941E84E7FCCA1C14E7DCDB21701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 15839c621f77100ac683ccad7579bf54367ce65c89b3346553e58a6baaa60f76
MD5 bba241fb816a64e819f071c971bc55ee
SHA1 59ae6ab29501f97170fa0e87e680910583fa9103
SHA512 518f3a7174d136d11cd3ef4daf4cf653f69e6442a1772ec5530797a207ca3b54bc99b8019dfbab9fa77a2c549ac9a593bb6968d1a884079123fe3c94f6903ece
TLSH
T1A8B01250C0015511C00302F43192448C7134DF50C70D130553E07DB1B8272904114160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592428.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592428.TMP
Size 96B
SHA256 79410688e6fb253e6f7a3fe38fcf7bbf0648fd7126f3e6d23c25bbd02cf4d18c
MD5 4f60b94b8d9f3e1179704266c2a97783
SHA1 76bb3375edacb433b440d0f3d7bb4e7434e122f2
SHA512 c29cba9dabda0b455df4d2cacab298c7add307209eb16bf16408eb34e40418dd6b7f94c942735fece274b33e85c8f59f3a70c50b94ed56035e0178278f4af8ac
TLSH
T132B02228C0A32203C00203F038A380CC3020CF22CA03020283F02A2ACC283A00020E20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e101007269d75b95cc0038fbe42301216cbf66112f4e37606e8f9dcd66c05873
MD5 6e3150fac0e5fdc317f1e95da11d0e4c
SHA1 6da4a49f82e7e0e3e76b9e5b96cf96b1a788ab53
SHA512 13656a468d4bb7710cdc6c29bee38b84bfcbb8d3a66d4c641bd9a7d91c3173b946002dd20ded79d6e893c03406da996fdfae6388f1ba9fd21e3c6530f6a4b195
TLSH
T112A00211A1814002D5143370158B5A44A7258831428E021540911945F894190D241095
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 3bde8b405d2a6d1ee58ba819f23e821ebef7173cfaa48cb4246ddb3006ba8fb6
MD5 1dd382c3424d60eed01f91412614569a
SHA1 767f25aaf8593c79b635c9dacc078c9ee160b82c
SHA512 2a5b15962130a830a67cb25279e859e2a2530b4208e295322724eb08c0363262dc85448fa81736d82ab4d63adeb055a71a8058a449eda406471b88236e7d091b
SSDEEP 3072:esv5XLZYHEP3QFLZVCjUtTDhjVtylf1q3assV++J3qUQm08KMWF0bFTcVHr6zo:es9qHEP3QFLSYWluS++JjcMW2VcVLD
TLSH
T11D14123EFC1B5CAD116AD7697053EE4BCCF29D872C5056BC209B2E2A36573C2961B170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 cf14f91b9e4f77c528557a1e3c3155c664207c43bae1531a0010ac83b73ad2db
MD5 6efe352de0c7efec933475c65b53a90f
SHA1 4c7a98859535762dde04446e9c66c5c2f879d112
SHA512 bb4bede1c8289e3dcec434eb8a86a2a3acfdbcd789cde477770778c2a0956f5efdb189f781794b41962d9922bf61302b4a274931233c0da99676b66cf644e0d2
SSDEEP 1536:XvP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:n++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1A69312B9991E7C79536BC696A0079DAC8CD3DCCD151451BC30CB6F0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 ed1e7aea8884dc35fb06827d7d492894b705d2f1808055f461ec83e71cdcc9a1
MD5 278699e62f7b77bdf4185e5bb707014f
SHA1 e18860f663f4406e35ddfa8276fb65e41215f60a
SHA512 f76f9f9166f985c25b0b8bea9557cf7ae5e8f6a41e288b8e86165c2256404d2833152da802585823f88fe70dffc5ab3372db3574ba76dac139374eaf8263e18d
SSDEEP 3072:Cnsv5XLZYHEP3QFLZVCjUtTDhjVtylf1q3assV++J3qUQm08KMWF0bFTcVHr6zo:Cns9qHEP3QFLSYWluS++JjcMW2VcVLD
TLSH
T1A314223EFD1B6CAD125AD76A7057EE8BCDE29C852C5016FC20C72B2B3A573C29616170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04041e9d14f3b0cfa89f268f1198fbab5d95461589c54f442abf5d1b19d4405a
MD5 cf9fbee0e9df0f21826249692c2c0e46
SHA1 1e1b77eca0ac37a417289edb3fbfe073d5b44be4
SHA512 b30663485f3ea94d9ec090e3c4bd1fecc5dcbe26f0510e69a82441dffb219543bea9e8281ffc7eb4785a8314d781e017c24bba13507a3461b55dabba2be8b272
TLSH
T1B2D0233173598006C4960DB34001975133CB80D530DF4082F029800E18DD2452FE3342
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 28c4ed3008985dcd39ccbff46d3253ddcc281845531902b9ab3cb9e76a107d95
MD5 7015f72d375e2f1071d92154b9a918c9
SHA1 6edb6d15aaf5f88e1c47f18af51ec8395dabcb9d
SHA512 0f43d3e0fecf682f1c75050fa1c3d6333536eb3330c428d109c55d72f087113ebdff845f87f4ff9e0c632bb9c639d9dfd6618b22017f17738479ad4bc1abdcb1
TLSH
T114712B8CB1E2A415E7E0857803ED26887E31811943779F273BFADAFCEA19B206047710
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f361883a45a1a0f5143cb0c37cc6103d37cb3f0997f2024ab2acf063d03c0ea
MD5 3e3745962b4306f443d31aacf3af294b
SHA1 806cf1c8456317594634a39c874d7c5cc4901e44
SHA512 9808a259e0e9532f5360709a8623f9d2d8d0c032a3716b21a94ed39955fc62b6acdd6b5c85ccd93f2f2f66fabd2234cad229472a481a1987b9e8efe55cca3116
TLSH
T118813D8CF1E6A415E7E0817803ED26883A35811943769F573BFACAFCE69D730608B314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5857df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5857df.TMP
Size 3KB
SHA256 314182fe5a993d3813205ceb40ca91efad91210ef8cd971149d92c25ece7c076
MD5 4712d64d464602de0cb30e9006a14117
SHA1 8d048b294c11380a4731303e21b3853d97a14406
SHA512 b7a2763cb6bd7e12b8c7f73f02a3c2c4b9951ff041b85174f0c6197fd98826ef5f68d12874c9ceca49e7d57ef9431a8e28b2ebcdcf3b43f86a6a8c00c823ed7c
TLSH
T18171294CB2E6A819EBE181B803ED25417E3041190777AF673BF6C9FCEA5DB206087714
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 064929a8f9e76b8d48e62ce141e9bfafe42c1d97c3bc787e32b1daa82f4a1d00
MD5 ebe7faee5ce19bbcfaa258277e669916
SHA1 5a49be625a0542052cb3c946363e314848f1e630
SHA512 ad22da5cc453fa389e4f2655da65d9f16acf6e4cb456aecacc20f8fb6d7a65c40da88617af7aed7b1725793ab18d492230a098adbb0e4952ee3014b421881ec2
SSDEEP 3:MsEllllkEthXllkl2zEkl:/M/xT02zn
TLSH
T15844043CFFC40405CD0010305051C35C0370D41447135757345505175CC55400C00044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

197369a4-c1dc-493c-adf6-b2cf3f30a069.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\197369a4-c1dc-493c-adf6-b2cf3f30a069.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 81c06accf56aac0a26813afcf56b16058d3b1e0b37fd0c56b6eaa924b675711d
MD5 a739c6c3f09866d93a476e1c7030be0e
SHA1 e5215b5ccf1217dc185900cefc5a4815d1dcada0
SHA512 55510b83e3ea9e294a56e3a53adac7d83ae4662f5a189cb650ee7735f3965fd90f6078ac9a19888e738166d7171a0c89e8ec7021b8e5e0d92f56d4e3fad41dd7
SSDEEP 48:YALlNTOhFhEh1gyGPC81hIs8RscfoKsmzBwBj6AsrgmzsFC7xs/+tsicsn+q0EsO:DVOzSDQLybxzBwBj6TGG11T+q0JrE
TLSH
T1B09159F7C3E9812D891156F4AB29BF1BCE1D0A14832C3D6B84D8AF5B93E2471D10675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0767fe7ea07885ae95316f212f3eb1d5c0ed42a749bd1b9edb2db8b104b3c60f
MD5 8136d7c1d529f88f209791359fd9a549
SHA1 945924035c330a3e33ff42d0dc54e95615910724
SHA512 514501462a0b0254c78fd60b87c26b7cd77e0494adca5db45467b51049e59c5314ca65e56d139bccc6c19fe850939f7e8fd5dd7e5c5171e20ff33d283760d0c7
SSDEEP 192:sxZGR5yM//K1Ml8MFo/fisoHlmwIdpRzb6y/n6/6+WNrkIF/Y0xknUhO+ZIg4J:sxZGjdo/fisoHoF2y/68oa/5Msc
TLSH
T19752D812AA349977CCDBD209FA55BF53D6F51572A2901E44A9FCCA0C04E6AED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5ee9474f60a520c0c60ced706f082daf37705f984dddba6fad720c22d27bd26e
MD5 1e5a445b084fb9c7abbfea5671e456e0
SHA1 3a3ccb5f052c5920a727d81806780fa0044e2def
SHA512 02b0facf3227d667972365ebc032f793b2661811807417a6a644fc3c64e980ce63645f6d6572590bb9212d49813f92713ed877fd7c36aee4f3effd2ddd28d267
SSDEEP 192:sxZGR5yM//K1Ml8eFo/fisKWpVp0lmCIdpRKsn/n6/6+WN0wkIFt8Y0xs+U9HO9G:sxZGjto/fisKWvp0Oj/68eaK5xNa
TLSH
T10872C713A93499778CDBD219FA55BF53D6F90572A2901E44AAFCCA0C01E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5f35cbb7ba4312d62684b0c9f945c831f5d884dd3a3d222b77d347bde3b70a07
MD5 febb96cbd18dce77f877d1ae45f1d298
SHA1 3a04b6e5ed76d9b6b792873a1828bab223d9700c
SHA512 23fdcb27900c4bdb9df71a7f4e91eb0198ed8b590288e4b74b5dd354459d2b95b3a957b3bcecf58816484e11356dce546034911fe3ebafd25b27845e693645ae
SSDEEP 768:2kK2G8g+2Id7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Asn8Llq:2kK2G8g+2ILEndJWRmdnQaPu1jaKAsn5
TLSH
T17A031C3B280CCB7E4F844E9CEC26BE9A6DE8018B9698CD9447F9844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0685825db6198fd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\b0685825db6198fd_0
Size 194KB
SHA256 1e7ae97d98e31f63ab1f369fa6199b818cd0eb1aef6ab71487e919712c7826fd
MD5 b7cfcff4e8baef98aa5b6aa47ad931bf
SHA1 3c59d72404f1a93cecf61b2491dac860024aa8dc
SHA512 acb2444ea1d7dec1fea1d80f84829d9fc991f8578c3cf1892a4da04f205416eda304b36cecc8116c36ba20dfb5016896d8e35b55f38369df53fd44d3babe5cbb
SSDEEP 3072:qegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:qegF1cc9zByRIZa8HlI93h
TLSH
T198146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AAE6CF60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 34f35bc261685b508396140674bbbc2504d3456c0a115d9259f988362d67f0c6
MD5 2a9df50fca1ee46ec1fac2602d78015a
SHA1 4a3c1a935b087bc1516dd11591c5f7e5c5e7149d
SHA512 235470c70c0522e54bdf3c5d5f8d91930eed7af25d0df987a249110fcfeda7ec712aa40a8889d7d57af5740387c76ffe29940f10252058d72946e5c0ba9044e3
TLSH
T15CA0021841D25C21DD5556B6748E46C43212ED31B12ACF1B64EA20488CF215C664D256
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6047fc356868b3f7b1b2b2119a5976daf19b0679c19c89b7e95ab270f598057d
MD5 3241031515acf98b8045469932de8b7a
SHA1 65722058662c8fe1897166deb6ec3bb237d90719
SHA512 ab3d729909fd9f00cba36cced28fb042a042f7cff3b956d5bfdb651d8d501edc395f96c742682c7aef0a00df3c1a177db4302030aedc768eeada76becc6ea62c
SSDEEP 96:KAhyKisS2paKCQ6mB6Kq8RooKRqW6oIKBuR:olNpJlTb2
TLSH
T1D4E10250B13A12812A7E2BDAC2D4B47E22D23067345CA43B77F911664F66E21DCFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 90b329cb0f3e968bc875c94c84a58f7c68a25c5e02e88562aba3c0d456e23e25
MD5 87fb68c47d2d14ba28cba24537d70dff
SHA1 be06127329187bfd1bff632e1f0e7901a8afc6d8
SHA512 f8ac1b7f8f053b9f00a527ee8b32331d41bc0985861014feab0649ec5d81bc82d0e4a36b938a155d23d6e91a534f4e38ae06899b8b65a9114d5b87b320d0f5d0
SSDEEP 192:uu2rL8NFULDQgWMIbuRajLOYmQmiU1JmK4QvAwjXmllTUSJr1lwxqTLv+Kgzn:ne8NFUf3VIqRe0GVQvAwj+lTTJr4m/o
TLSH
T12E52193164782CA78EF79E85B14B3B176FF4512B96C42E98D9E81B0D44CB78C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6273f765f786f9713bb104a29cd7d643660af0fcc1b80b79cc5ed68ed8c5cd80
MD5 3fcd6b26e071adb9245f8543725be603
SHA1 f8b58bf69a828726315ebc10bfddb7c4e508c2ad
SHA512 66c128f869595fecb09654d2a2682543713e2131d4865218a9b8c483ac2bcca7f2e94bc3232b49119a20a5e5df4265cf6749173a001cff5c7512bd3f3caacbaa
SSDEEP 192:uu2rL8NFULyQgWMIbuRajLOYmQmiU1jmK4QvAwjXmllTUSJr1lwxqTLU8:ne8NFUO3VIqRe0YVQvAwj+lTTJr4mU8
TLSH
T1D942093168786CA78EF79E85B0473B136FF4112B96C43F58DAE81B1C44CB79C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5ee46ff756f38755d57bb636b77d60b87259830f6e4b891bf08e60c89c774ac0
MD5 b659a9c1109f5c693ea964973620f5e6
SHA1 81f9183723a857e9c98678df710c5b3be183a8d9
SHA512 737612ce8867b882f70af1ef2400de9344c056f9b914a3fc64785153f73e65fa7cea81756f68db1967dcc373576246a3b4725b7508b8ae235f7530c6224bdcc0
SSDEEP 384:nmcXqn68NFU43VIqRe0GVQvAwj+lTTJr4mIJTlqHEBZJKYh:06QVIqGOPj+lHh4mIJjH4Yh
TLSH
T176826B31A8782C678AF79F85B14737076FF4526B97C82F44DAE85B0C44DB68C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7767a6f69f26a82329d53ec3f73aac82eec7283627125edab430877b004b09a5
MD5 e296b201b1f6640741c62a7f3ff3c87a
SHA1 bd885a72c8a700dff6b90ceacae18b7110785e94
SHA512 4131d06ad3d0834e620a4e29dafddf1a3139e19f2ffb736bbad6c9ec1ca2201b632997e7611e7017664117ed476e0b2e543d5d4bc0a087b1f475a4669e3f4f60
SSDEEP 384:nmcXqn68NgU43VIqRe0YVQvAwj+lTTJr4e7Bf3qKK/40XyIJTlqHEBZJKYh:06tVIqYOPj+lHh4of9K/4wyIJjH4Yh
TLSH
T1C3B24A7C9C655C3E44EEB748A64F2A371DB8423BC6F45E08D7A44B0DC0B6A8CF706526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1f8aa828e1816f7c4cc3d5f2e16daccde2b1f65480747c6847e22634c28d1a8
MD5 121a5e5058e820eae3596f2b20160666
SHA1 2b0c6917bba96a6c056f7fcff349eb541dadd1cb
SHA512 d123c044b53043e96263c686aa008f14c6b4608891c49eaea27a635c333daa906b7e2995da9d20f8bf80ff1a5ee67bddc2aca7f877e7012a367a889ffd22dfed
SSDEEP 192:LRGNH6EajeTQmiUyDgnRvAwjXmllTUSJrtupxqTLU6:VGNH6EXlnRvAwj+lTTJrSmU6
TLSH
T1A112E831B4787CAB9EF3AD95B0473B176EE4111BAAC53F54D9E41A1C40DB78C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dbb449149d5a0169000bf4de696faf120d561927c7acd6fe6c3c83cad6f7626e
MD5 2f4ebba94d7909d15f8bdd1a2f414b45
SHA1 8102397506d854833c3dc95c2deaa06a9b9a05a7
SHA512 e53b1e9bca5932a79e01adaed44b4a284f562f729a7c511247563ccaee18a191ba1edcb18c199a6bace821120f3c32b6d389a571ec2661213e04c8381b8149b9
SSDEEP 192:VGN16EajeQmiUy6w/gnRvAwjXmiq6xjU6:VGN16EN9wInRvAwjDpU6
TLSH
T1E602D835797C7C7B8EF3AD45B0472B276FA5112BEA942F84D9E81B1D40DB34C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2de6335-e545-402a-bdbe-8a72c7d870f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f2de6335-e545-402a-bdbe-8a72c7d870f2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4119c040-b19a-47c8-9bfd-dded1f068ad0.tmp

Path C:\Users\Admin\AppData\Local\Temp\4119c040-b19a-47c8-9bfd-dded1f068ad0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

57db131e-2606-4b1b-bd3b-b50b1e94340c.tmp

Path C:\Users\Admin\AppData\Local\Temp\57db131e-2606-4b1b-bd3b-b50b1e94340c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3408_1368906219\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad84236a-d1d7-4210-8540-a8e2128f9ce2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3408_33018246\ad84236a-d1d7-4210-8540-a8e2128f9ce2.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-39-0x0000023A84800000-0x0000023A849AC000-memory.dmp

Download