hxxp://000owamail0[.]000webhostapp[.]com

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://000owamail0.000webhostapp.com
Sample260504-c2h3lsbt71

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2046141081\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2046141081\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2046141081\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5288_1779243270\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_1733001146\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2046141081\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_1733001146\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_1733001146\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5288_60664518\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1036	msedge.exe
1524	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223356733977556"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-643422742-1162610606-620613169-1000\{6DDCA0D7-95A3-48DF-AEE8-B726382744F0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5288	msedge.exe
5288	msedge.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5288	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 4260	5288	msedge.exe	85
PID 5288 wrote to memory of 6116	5288	msedge.exe	87
PID 5288 wrote to memory of 1036	5288	msedge.exe	88
PID 5288 wrote to memory of 6116	5288	msedge.exe	87
PID 5288 wrote to memory of 6116	5288	msedge.exe	87
PID 5288 wrote to memory of 4804	5288	msedge.exe	89
PID 5288 wrote to memory of 4804	5288	msedge.exe	89
PID 5288 wrote to memory of 1724	5288	msedge.exe	90
PID 5288 wrote to memory of 1724	5288	msedge.exe	90
PID 5288 wrote to memory of 1724	5288	msedge.exe	90
PID 5288 wrote to memory of 1052	5288	msedge.exe	91
PID 5288 wrote to memory of 1052	5288	msedge.exe	91
PID 5288 wrote to memory of 1052	5288	msedge.exe	91
PID 5288 wrote to memory of 5448	5288	msedge.exe	95
PID 5288 wrote to memory of 5448	5288	msedge.exe	95
PID 5288 wrote to memory of 3400	5288	msedge.exe	96
PID 5288 wrote to memory of 3400	5288	msedge.exe	96
PID 5288 wrote to memory of 2856	5288	msedge.exe	98
PID 5288 wrote to memory of 2020	5288	msedge.exe	101
PID 5288 wrote to memory of 2020	5288	msedge.exe	101
PID 5288 wrote to memory of 2020	5288	msedge.exe	101
PID 5288 wrote to memory of 840	5288	msedge.exe	102
PID 5288 wrote to memory of 840	5288	msedge.exe	102
PID 5288 wrote to memory of 840	5288	msedge.exe	102
PID 5288 wrote to memory of 5672	5288	msedge.exe	110
PID 5288 wrote to memory of 5672	5288	msedge.exe	110
PID 5288 wrote to memory of 5672	5288	msedge.exe	110
PID 5024 wrote to memory of 2380	5024	chrome.exe	113
PID 5024 wrote to memory of 5192	5024	chrome.exe	114
PID 5024 wrote to memory of 5192	5024	chrome.exe	114
PID 5024 wrote to memory of 1524	5024	chrome.exe	115
PID 5024 wrote to memory of 1488	5024	chrome.exe	117
PID 5024 wrote to memory of 1488	5024	chrome.exe	117
PID 5024 wrote to memory of 2532	5024	chrome.exe	118
PID 5024 wrote to memory of 2532	5024	chrome.exe	118
PID 5024 wrote to memory of 3336	5024	chrome.exe	119
PID 5024 wrote to memory of 3336	5024	chrome.exe	119
PID 5024 wrote to memory of 4880	5024	chrome.exe	120
PID 5024 wrote to memory of 4880	5024	chrome.exe	120
PID 5024 wrote to memory of 3140	5024	chrome.exe	121
PID 5024 wrote to memory of 3140	5024	chrome.exe	121
PID 5024 wrote to memory of 2980	5024	chrome.exe	122
PID 5024 wrote to memory of 5156	5024	chrome.exe	124
PID 5024 wrote to memory of 5156	5024	chrome.exe	124
PID 5024 wrote to memory of 3240	5024	chrome.exe	125
PID 5024 wrote to memory of 3240	5024	chrome.exe	125
PID 5024 wrote to memory of 2764	5024	chrome.exe	127
PID 5024 wrote to memory of 2764	5024	chrome.exe	127
PID 5288 wrote to memory of 1576	5288	msedge.exe	128
PID 5288 wrote to memory of 4168	5288	msedge.exe	129
PID 5288 wrote to memory of 4272	5288	msedge.exe	130
PID 5288 wrote to memory of 4716	5288	msedge.exe	131
PID 5288 wrote to memory of 4716	5288	msedge.exe	131
PID 5288 wrote to memory of 1268	5288	msedge.exe	132
PID 5288 wrote to memory of 1268	5288	msedge.exe	132
PID 5024 wrote to memory of 1168	5024	chrome.exe	133
PID 5024 wrote to memory of 1168	5024	chrome.exe	133
PID 5024 wrote to memory of 4704	5024	chrome.exe	135
PID 5024 wrote to memory of 4704	5024	chrome.exe	135
PID 5024 wrote to memory of 1212	5024	chrome.exe	136
PID 5024 wrote to memory of 1212	5024	chrome.exe	136
PID 5024 wrote to memory of 1400	5024	chrome.exe	137
PID 5024 wrote to memory of 6004	5024	chrome.exe	138
PID 5024 wrote to memory of 5872	5024	chrome.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://000owamail0.000webhostapp.com
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb0233c188,0x7ffb0233c194,0x7ffb0233c1a0
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,10940582174648731840,8390857073049067531,262144 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1876,i,10655693870876713704,9745628550328632577,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2488,i,8317989812455014038,5608423174276585057,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9668575147912371038,3340827022739326665,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10835829387272739329,8358682692605272285,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3420,i,4825642943634112163,10945078476860624190,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4988,i,8464449208311414670,17149817413504370101,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5668,i,17126000908957612130,12672556148592875242,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5668,i,17126000908957612130,12672556148592875242,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6136,i,10132702954895524934,14664507056847151163,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3924,i,17341321154502102017,3108234026379968502,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5684,i,15882118362418314949,9814464737885370853,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6444,i,6783400113911588263,10894974397179312069,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3884,i,12180583578113711614,14057668698786034085,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3924,i,6900846279996247745,4441454558980476602,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3880,i,8905143523805914520,16637555655968284799,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6432,i,4519783128846491883,9077678266555259622,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2808,i,13147291956059704394,17994456975141785299,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5556,i,8603252998816094399,12663278234042465986,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5596,i,13124340335711564045,2579123694650015622,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6400,i,13624182633432785555,17099417520317364931,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5036,i,6642199313302064644,2707549998211544901,262144 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6400,i,865080080578567377,17550225825019888273,524288 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6132,i,16059336802671776226,13948552588296530876,2097152 --field-trial-handle=2460,i,1398469500180773632,9709911852736084610,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffae104c728,0x7ffae104c734,0x7ffae104c740
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,8903652736249737205,12603281800522937583,262144 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,10148942210408727404,12426215586764794006,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,8309255881149388821,13747124298230869204,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,18435870791267488608,5836953452714972346,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,2415775329596964697,15805348068787571663,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,10596650636658462539,10612174021896636376,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,139088482414419781,4594658668126401170,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,2589993131088138648,4618644788346178507,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,9504106488219165528,1592841939708561147,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4752,i,9111699523681105380,5120299193122354985,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3728,i,6690458352851357063,6940776416535513064,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,2974401546394116589,9532380522130843951,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3648,i,12651609645479250539,363741307867139517,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4868,i,12218899898793953276,1062647163043693533,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,11483704994659692950,8967790656491975220,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,7263365497430916588,543973536356945484,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,1778442516436414209,2859729665857454266,524288 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5948,i,6568375384558532269,6045522603230529585,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4812,i,2092213274388010471,17936643412364578759,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4656,i,12601974373212120526,6431732221974072059,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3280,i,12956278754649838002,9494788464376605095,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3568,i,6934465930534297448,17119560417910061368,2097152 --field-trial-handle=2080,i,7522466306196799740,2470324851707071923,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5288_1733001146\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2046141081\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5288_2134597957\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 21aea56e8a52eafb42eb6ab1086e9c7a4011fe2da1aa7ff0399b6633c704197b
MD5 735b475319ac5c1d0aaea4ed105aec98
SHA1 5ff03f70fe4d45cb4abe972558c073cf47047dbd
SHA512 6d44536d30cd2d8008ec115658c85b3e75305c80a2a3d2defdf3d048b2f2bb1d514b24102e3b92bc8605eafac7895072fded37d24b92e5ab970b657dd0dba7e5
TLSH
T127E02B9FD822DC3705FD076E50500689E76013972750494F773DC30C8FB153B058685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 3a8ae904a7c75419ee23123f0525058203d284cf8bfe6331a104a9e603874509
MD5 f2c2f4480bdb07deac97cfd8fe1dde0c
SHA1 6e7d168d7eabac9c379445bfaab45b0c9d4dab84
SHA512 b8eadd75c2abcb09243c7e9771c1e52f0012e3a0c90a1510b1fd5bd5f53438ed270054c5a14146f8f267b8508432aad7428502805b6b2ad04e245152786fc87a
SSDEEP 3:MsEllllkEthXllkl2zE/lC:/M/xT02z3
TLSH
T17A4404447FC04447C55111344451C3541770D5700F17574334D104335DC57410C50450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b52486104a7476c3513487a334b039c2358cec97e300c9e9f54c07d38777c17d
MD5 56d22c16ebbd1c82e1d183002294926d
SHA1 c6dee4847849fa2914d8f8a30f2b0eab445227a3
SHA512 bb7fae7adad19853bdf07bd0d54ccf1ead8cc540737fde7f29f17a2f921ce65fad694d7bd9213569ff3e019b46eed2a8b00edf8e7eda6f3669a5cb5b75805a3d
TLSH
T1E0519CF3D3E8866EC51192F4DB256E2FCE6D0A24031C3C6688D4AF4B53E6872E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 25a73eeef9496ed9779efefb2a046123a8c4c8414f4dce233733d4a17dc27997
MD5 2d85866acf5c4f1d90ef30d570c2b5bb
SHA1 133731aa8f617eef519ff03c0328e54d8ac2d6d6
SHA512 478ca007dd278cfa35d23c9fa649df18b0524d589adfa36e101d9cb00dec728e42441acc26637520eab39332ef206367e1571ce7d7a1f6bcf2c111bf0ed5915e
TLSH
T1D7F09EE7977A786711BE45B71F04B80924B6B83216817AF8CFAA812CB0959F31F12853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2c9240536538ecf2ca24cb77f0796c9142867cf7a2273e5a315aac22a02e60fc
MD5 56922bdb7cda9af77d906743493b4b03
SHA1 4a90afd81a087c93beebfcac9cfa0772ff5ee8b4
SHA512 20582bde3b3d0f65fdf68cb68b44ab365a362ac2f858fd140ab9d1df0dec98989bc3fed485697a7635fd263775a0b6c6db482ad17a2292be57f5222aded0f61b
SSDEEP 192:hRDKP8f8+slv7SpAPRp2lA9QH+Fb+WNnsD0ckR7FaYrt8VyIsnAUgtaJ:hRDKRVeUX7Wac01RZaF8
TLSH
T12A42B42EBA14657B5CDBC22AF922771BD7F5102171D02E84E6FC8A2C18E76CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dc79e29a202fe1318bb679c9c0ea9eeceffc5aed39ad2ca02b250d91a02221f3
MD5 a438c511f2e942dd3ee63fea361ccd57
SHA1 79ee36327bf4a58e2095a6e4945487f508fc579c
SHA512 0e176ffee9e19dce54c5cddd55ccb61f67b1fd513e7a12bd9cf7a92a2b2d67041b957a8860628c194a102d070478299778646fd25097e2f43a8f79369e544bb9
SSDEEP 192:tRDKP8f8+Okv7SpAPRp2le9QH+Vb+WNnh+nfkR7FaYrtCVyIsnAUgraJ:tRDKfAeUX1W6snsRZafe
TLSH
T11552B52FB914647B5DDBC22AF9227B5BD7F5102161C02E88E6FC8A2C19E76CD3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ce93937551d62f8f8f27b9d449df9746eb8cb439b0cfc57add801cec759d0e7
MD5 87eaf8a5eac451026c08c2e98379433d
SHA1 1318abe21b1c19828e71ff4f74a5b9129ad0b24e
SHA512 54b0413b7511133cd61c6b534337fec7c8f9b9a7daf392e61f440f4c7a0f2d50ba04436328a3b4b90e2612fa5bc1557e50bd03070bbc2ca54736fe4bf9ae318f
SSDEEP 192:hRDKP8f8+PBv7SpAPRp2lA9QH+tb+WNnsD0ckR7FaYrt8VyIsnAUgtaJ:hRDKOReUX7Wyc01RZaF8
TLSH
T19142B42EA914657B5CDBC22AF922776BD7F5102171D02E84E6FC8A2C18E76CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0e82a03deb879c7a3325a5ec62cd5388c4858a25075edaca4ebb090c4db05ee9
MD5 a7475173370419ca32a6f3ea22193606
SHA1 758e9c88f7591ca909011352530a6c64716c5e1b
SHA512 c9f7b078587ec9d813717ea22c6921b857565b0c379b1cc19e347007060568d44094a360e0e033a6217a79920453286c7a5a287f496abb17e731f019aae5624b
SSDEEP 192:tRDKP8f8+bkv7SpAPRp2lD9QH+5b+WNnh+nfkR7FaYrtCVyIsnAUgraJ:tRDKaAeUXsWmsnsRZafe
TLSH
T14252B52ABA14647B5DDBC22AF9227B5BD7F5102171D02E88E6FC8A2C15E76CD3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8a0cb70c014facc52a5f2a8d2d93935536dc0e6c35433171e44303fdbd500492
MD5 45a3b3ed9bcaf7f3ca3ab46ea27dee14
SHA1 b64d8847b22b5da0616ba23a47410dce87aa8f52
SHA512 73566a797ae80c831b733c65197deb859967a24c97328b1ebdc1225428c240ba9593eb53ff470d89503b3affa67b67ad1662a4134f331b51e25af30483d91c57
TLSH
T146B01250C4019701C00703F411D384CC3138EF11AF06130153E0AEB2A8262E14124150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c484.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c484.TMP
Size 96B
SHA256 35f32dd5febb6f02be30e2a61d90e7c626be50e49f7f6826266858dcb0bd6cb2
MD5 9554403bbd2c6a07112b85d92a8da77d
SHA1 e2a60b3ce6af267a1ca6957b0ec864be9b0aeecc
SHA512 89df490ebb56a68824d2138d5150df3f75107a33d4f080708b2b6342964bc652af0f6ff26ead8df29ed9616499490757099bb2d8ac91b8e30823b0af193c7d0a
TLSH
T142B0029AC1026632C04303F03AA59DD87170EF3AD643123A92E11B66DD36FE29925560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 85f02ad41896273047083e3cdcbe62a809edd848e9ebef307de61d3e357cee88
MD5 742cacde81b6a1ab9930fe7989fe6499
SHA1 c68d71871463202afdaabc0dc023878d86dc3286
SHA512 e9929d9533728c49aa6f96f3161f96248f28bdf41efee439ee96634b344caca33a68c6f5e5d1a839fe728098316d70f553473bbec0211e03821e48c42f524f6f
SSDEEP 6144:xrqlBiyDMu8J3k7BUJc86HqXrOk0HOGm/SFyEEx:IlEN3k7GJc86HKrOjuGdF2x
TLSH
T1621412A71F4701B310BC5BA9326F780A8BE30A49319F6DCD43B453EA15972C53BA3E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 248KB
SHA256 0728699ba62254b1a69efd575e5021936028f945fe6f598d3904672188bcd721
MD5 f77e62383cc087209ce777ab7dcd9d83
SHA1 a73e33bc1c8f65f82a718de0f9b60bbf0807fbcf
SHA512 39f08f99d731c11f75c6f6733fcb25ed627ce7cdcabe9c8e514b418bff021ade570065bd1faf8c5aeea8ad1eeff9c9e5006f3ac8f4e9a20e991d6a75de9ea73e
SSDEEP 6144:xWXauWG1eqlBiyDMu8J3k7BUJc86HqXrOk0HOGm/SFyEEx:/6xlEN3k7GJc86HKrOjuGdF2x
TLSH
T1F24422770F9305F210AD57A9324F384E8FDB5686A25FA8CC47B017DA169E2C02BB7D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 55a1cc9219159db4b18c827ca61ae8ef7c697e858695a91fd7a2cb7da7856e07
MD5 e07405f32b947e4a492178c5b361abd7
SHA1 78b70519a525a096d767ecdd5893bb4ab189cb38
SHA512 e1aca006f4ac6757c7b5e1f1e4a62acd0a3b7ee7f3944a504c291d323287c28d57ba555dfba73a4be5c5244586003cb9659d7172e2f98964dd58e779ebd0d36b
SSDEEP 6144:x6zqlBiyDMu8J3k7BUJc86HqXrOk0HOGm/SFyEEx:LlEN3k7GJc86HKrOjuGdF2x
TLSH
T1C91412B71F4301B314BC1B99325F780A8FE64A4A769F7DCC42B457EA159A2C13B63E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 1583cb1530eb69c0989683fbfb21014e1870da947fe91da8705aa7d9066cc73f
MD5 221205e3b95b0b03afc59c805740aa91
SHA1 ab246331c220af55d51c56b4c06a6a9145a242e7
SHA512 41fcdeb03654e08c718dd3e53c396ad70a00dc126caceaa85de46e418be7da19510a3abf90bb3be0257498a8541329a364e098a83d218f872ec1d55464a25179
SSDEEP 1536:s3j/rhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:S3h3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1239312BA5E2646E7957D4AC136AE7908CE12130D70AFA9CC326C638D61D41CD2B63F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 f4d831149372433e34350f39a5eaa2cd1e5c6cc70ff1052895be1f9c0bed3e76
MD5 d8890b25709ef5c4d95eb924c94f24ae
SHA1 31cbca4735608b7e43e8b8e70db95f0fe04bd5db
SHA512 8b0b54d1d1bca8c4d07f9421110438aab2b4a8e10c92f3a81b1baebffe57e14a207ab6ec186b1588e551d0504ec642cad92e838798f2dedaea7765fbcf6eb623
SSDEEP 6144:UGqlBiyDMu8J3k7BUJc86HqXrOk0HOGm/SFyEEx:wlEN3k7GJc86HKrOjuGdF2x
TLSH
T13D1412A71F4701B324BC1BA9326F780A8BE30A45319F6DCD43B453EA15972C53BA3E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20c5edea-b6ac-4fb5-ad9b-edbfaba437bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20c5edea-b6ac-4fb5-ad9b-edbfaba437bd.tmp
Size 27KB
SHA256 6ac848c77260646de84ad4bc4a8b0655f744e94414ee16ba7e7b6fbd4b40a0f1
MD5 7b5cf3d05b7ea2f9703dd29088080554
SHA1 8784cca86241aa39a05b8915c816672b08ea0cfe
SHA512 d7b576ec1fa02ba70213ebd1fa331f10485533bac77ada7b13142b995ca2383d3a4243817fefc483243612ef7eedbcb86739b106696a56b6bdb387613e74aab5
SSDEEP 384:nJiFwcXqnr3sNy8TUNTUlI4rTJvuxOXvceuYrfu4nALVuePn9/+pwrN1k+5vI+5:gFyr3DwgKmxrpyePn9/sUt
TLSH
T158C24A76E8A8DD6BADE74FC9A35A7A47AFE402A3C18C49D4DAC85D0C00C71DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
MD5 2abcf056d353616a5983a10f17185a31
SHA1 40d71f06b42cf03d05e8dba44f76231dd24d9fd9
SHA512 5bff16b6683201694139145fd708bf7d834e97a5792e68cfb43b011e13c0e993e1cfb6a8c6f450aa2437fe486fb6f3ff1af62a05b918ee73bc195ec5cb0b3e02
TLSH
T1D7D080181275AC31D4A68575548537093E2DED675543533B5473557C0DC7E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 57538c5b1a496e74643051a8eac971e789f7753204ea7b9348dc876f1bb4db19
MD5 ad28ee7946841ade66d741e3de0a2250
SHA1 c9af29c1edd3209a3f0397f717e0a055e311828e
SHA512 f1c1f1926fd247a68c1e5a7b66982fec95c52bae6795f17b24756a8850573b799662356dfa23f1c207c4d7f9a12195205ff2f479ae2757dfec1c2501063386cd
TLSH
T197E022AAD825EC271CFC171C74504A89E76103572B80890F3B3CD20C8FB067A4A8689C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d81317182dd8a7ee9e8ef7f1a81018a549014bd02c0bc51dd1a3e36dd073ebd
MD5 7e0c0a2088047eb425b2e57bb1ce0c0d
SHA1 1310b0e76023df798244db849fb8cdf5c6289079
SHA512 9b2412c2196ea6c2ff5b8d2be3e97c409e0f455b2b2d47fb7499895f82a69a8b46c1a78076fe40eb3c514144714a7c710ffd5b468296bb846c2eb0dfa6759d01
TLSH
T17941BFF3C2E8866DD91196F0AB187E2BCE1D0950432C7D9AC4E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ab4722ff2fb44f1b22e5c7f814288b1a1dcc3ce520d845891035f2e955feb9cb
MD5 bd78ae03e7538cdfec9b5d97753cd6b8
SHA1 ebefb13de6146962de5fe200715b138f680b71c4
SHA512 82aea6279e4b8daa1e33cd1efaf3b8289bf43062a29ef5ec4d13c066b4beb21f82896fcbee797a4175711bb353af3f34a4bce9d9dd78ba9ae4498ca0ea6e06e3
SSDEEP 192:sxZRRzyMqZ/K1Ml8UQbk+/fespzgkjSm2zodpWJHMF6+WNcZS/YvJ93IOs5Ig5PA:sxZRwqw+/fespzymN+Ht5/CXi/b6
TLSH
T1B972EA16AA38997B8CD7D219F645BF57D7F9116392804E44AAFCCE0C04E6AED311382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e9a0956c4adea7c97e3f6a790c8999a168c320e59f1a98c6a47d802512298aa9
MD5 f17458d913d3e983b589fd1d8a5a152c
SHA1 b00b4e63fa475e67993f760dc27526b6733c46d4
SHA512 bafd6b8034b0d2fa45d0fe1c551891eb2672d906fb578a2539df09c4574d5a284ce183ee7c07addcc02c8b65ea57cf3f25d364480981cbe531bd8f14884824c5
SSDEEP 192:sxZRRzyMqZ/K1Ml8Mk+/fespRgkjSm2zodpWJHMt6+WNcZS/YvJf3IKs5Ig5dCJ:sxZRwM+/fespRymN+HF5/CFiXe
TLSH
T149720A166A38997B8CD7D219FA81BF53D7F91563D2804E44AAFCCA0C04E6ADD311382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06f47b938acf09db92b1bab356008e62513954dc64630ab19523c16abb433f07
MD5 736dc451cd824bd748c7ada9e2d3a16a
SHA1 5a2da70f1b39e82019b71fc25256edeba250eb27
SHA512 3a19e72545b451d58d5c7de2ce309d44099b036991f7905379f92b81c5f897c74d36d21e8054313a9bc0dc1d96ffba39e45c003e1f96b46aff3bdd77d6db3362
SSDEEP 192:sxZRRzyMqZ/K1Ml8Mk+/fes8RgkjSm2zodpW6HMF6+WNGYvJ83IKs5IgjCJ:sxZRAM+/fes8RymNxH1GCiije
TLSH
T1E462F9166A38997BCCD7D219FA457F53D7F9156392804E44AAFCCA0C04E6AED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3d081fe88ec84672843f79d16b6abf3c39e1469d41be5711a31329a0d12f3564
MD5 1581ae775c326a77418dd4b51d853c1e
SHA1 0a89e6e1853f62c14ed31490cf77297700d88586
SHA512 b1dbbf865aaa64e82d9365d9fed28ec2a32b4112639b18d0dcd94178cc97ee2da0d82ae7c123f1d38c1a3d667e963b643b2e0189d01b516ee338e0730ece4474
SSDEEP 768:KJ4Z0+27pLuL/8MWv80Xo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfYsLLlXZUJRrod:KJ4Z0+WE/8MWv80Xou1ja6YsLLxyJq7Z
TLSH
T137F20B3B6C4CCB7E4F804E9CEC2A7E8E6DE8028F9698885447F9944C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6f0de487a28836e1cb2a31db8568f50df1d2cfed9340e12668d47bc5ecf8c44d
MD5 9a7c99a5a3caaa1fd0776887cdad7ada
SHA1 2e3a84369c07bf6ad540302dc6a0fc703df49f60
SHA512 49a10ff3b1fd40b1acfb88d209e8d61a976d9d5c9d9328eac46493cf71622b6b1dd2b1074d4dd6b6a2e577a917d86bf8083792d31ea2836bf99d4ee44ff26844
SSDEEP 96:K4n+K0cCmHyKcI3IgKdG62fGKssvAAKdKi+1OKew/Em/mK4omaQwKBySr6KYY7OR:ANtDrpn3F2E9FHwgRBL3WDfSZX4hFd
TLSH
T162B22811717B02813E7E298E8195B46F62C231637198B93B3BB814764F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bdd8eb82a2280294d12cf62dcd952f48a5097afaf87fffc3f577cbb889b06a36
MD5 6e6eaf00608c1abbd6ee9141e08f9de4
SHA1 d4102a480939b348eef35988b42632cbba8b42f7
SHA512 c5749542d28685ecb1839671cbec8f3e57797b02d5f9d21d7df32a60955a31c41afd7a674499c2e207a2c155a56a92bcdc40ffd5ca3f2081688ec161a351e020
SSDEEP 384:ngiFwcXqn13sNy8TUNTUlI4rTJvuxOXvceuYrfu4nALVuedn9/+pwrN1k+5vI+5:7Fy13DwgKmxrpyedn9/sUt
TLSH
T117C25A76E898DD6BADE74FC9A35A7A47AFE402A7C18C49D4DAC85D0C00C71DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6e27e70bae1b56a96df5b4c25f2aeb6a14bce950e97bccf1a12012fb49e4cab1
MD5 7fa88b24b49959ce2aeed6663ec55113
SHA1 a80b22003d36172739698fe9093e06864afcdfac
SHA512 fb5521ab30cde111baa3c64a8493297048e98e3fc02f9bb28e0ce2bef6c0d9daca832efb5956cb2222d374a4b73671ef91bc097735784c40f621691487f8ad3d
SSDEEP 384:nJiFscXqnr3sNj8TUNTUlI4rTJvuxO5vPeuYofu4nALVueRn9/+pwrN1k+5vI+5:gFur3SwgKmxq2yeRn9/sUt
TLSH
T17BC24A76E8A8DD6BADE74FC9A75A7A47AFE402A3C18C49D4DAC85D0C00C71DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e23935ba3b93d5a8ddb00f61750d8fe889dae8d27084de60e8f238962ef1a513
MD5 2620063c5ec123a6184d3f9c59e43556
SHA1 5c279d208860b17a8e7ed63f71d0093fda192643
SHA512 175e33d5cdac80df41a07fe70df304acf0eab9a7ba3135c9ec174615f7c58d0571816adaee0e2d7f8330147dc7149ffa0b1410ab4a73a92c47f2b6c6c901865e
SSDEEP 384:n5iFavqMg3sNl8TUNTUlIm2TJvuxOiIyNLYrfu4nALVbq3Ra426rN1k+5vI+Gil:QFayv3IwgzmxLr/q3Ra4SC
TLSH
T197C25B76EC58DDABA9E64FC9A7493B03EFE002A7C5984AD4DAD81D0E00D71DE1307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9e8d2dd9eee4b7d22fa68f2fbd26592b5fb9784ddae730ccea55a971e0194992
MD5 690d2a25f37f04143823f55e1967f4a5
SHA1 7ad0da9dbedb040fade0b5603bc3ce3baeb42f9c
SHA512 76a70dbe8c6ba05df8f7d8263c3ce009b20c474fa8993cae0f3a6d99ac23d5a142f355e002b78b95460b960e5fe9a5136b238217827d6d3708546d94a3f6b0c2
SSDEEP 384:nniFavqMV3sNy8TUNTUlI4vTJvuxOHv2euYrfu4nALVuedn9/+pwrN1k+5vI+1j:iFayS3Dwg2mx1pyedn9/sUp
TLSH
T170C24A76E868DE6BADE64F85E70A7A47EFE402A7C5C849D4DAC80D0D00C71DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bc23b608300542e0fb48777a6e1742365496265e54930e7e88533f69b9ef315c
MD5 ff3ea5a0cf794d66e0f8cbeea6fd188e
SHA1 d20c394c7944f02c27f9929c1ba3ef1032c378e4
SHA512 8389b855198d3e30123d172a767370b874892328b01dbf1510518a44b07414a8476743171b19ed47b2c1f8e3286cf4efd192a3dfc3d27510eeb2f2f6af0180a3
SSDEEP 384:nniFwcXqn13sNy8TUNTUlI4rTJvuxOXvceuYrfu4nALVuedn9/+pwrN1k+5vI+5:iFy13DwgKmxrpyedn9/sUt
TLSH
T191C24A76E898DD6BADE74FC9A35A7A47AFE402A7C18C49D4DAC85D0C00C71DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5ca936c64bace1be32c0f4f67b1ee803b7e8398e232122b1d833b7f93efbe225
MD5 272ba4f9156774c6b07d702085a3d190
SHA1 8635593dd12f66026ac5ac370c6400998d50d436
SHA512 6b8330e6d30ed2480b38122f9f36f552e946ccef0768f2df326a44d7d6d118b4009c3937230ca47c45237b63fd9903d5fbfc356265d588c9c7e999745a3c5219
SSDEEP 384:nriFavqMg3sNm8TUNTUlIm2TJvuxOSUxQYrfu4nALVue6n3Ra426rN1k+5vI+Gil:GFayv3Twgzmx84ye6n3Ra4SC
TLSH
T1BAC24A76E858DDABADE64FCAE7497A43EFE002A7C58849D4DAD81D0D00D71DE130BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 11665bdb514c89f604cbf0892652e72c1b5ea7d5f7e200f9a51b673b88084a22
MD5 7ab76887a6771b45c1a14f884c925cc1
SHA1 64696289238cd12b42c3221217cd03ec1c1b8966
SHA512 4f1124c46180180f69a46284c53141885ffe54b2a140ca252d42f4720f252dbc010d765c8166841d4f5b3d661b20f51113f7569eeafc5c509185f536ebd5b94a
SSDEEP 384:nniFrcXqna3sNy8TUNTUlI4vTJvuxOXv2euYrfu4nALVuedn9/+pwrN1k+5vI+5:iFza3Dwg2mxlpyedn9/sUt
TLSH
T12EC25B76E868DD7BADE64FC9A74A7A47AFE402A7C18C49D4DAC85D0C00C71DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b6c3bbddbc7675021380825dd278b4b90112aefc9554a8de67382cd679cbc402
MD5 cfb1153d72f78917dc49c8495baff184
SHA1 fdb5b383a4d79a50d8ef8f7b091b061157a28155
SHA512 8bcc5a0d07ba8769cecad6e435e176d214d288f046061d60f4b24d8fb67f3918f0b86ec399e00d1e7d275ea1d46299528027059e805074f22735bf1b9e6f0d7d
TLSH
T13A311CE2483D2AC1C8FE0E6EA45B78FC85C8C31AFAB8717D5820EE444639A0E254142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8aa7822750fd8d768439e006bce399fcffde523ea759200a08ce077ede6885af
MD5 9b9e95b9ca234a4ed37bcc5ff7d76eb7
SHA1 d800140167c29a27e022818c5decc35c12e47cce
SHA512 1e4eadf236d4ce4c88083c8decef95fb9fd2e6ef9ec2373cf21a25f1a4d6f982651736cb9fb4031ecc03f6edfab9f638e49ee67a33526cef2933a06372398539
TLSH
T122311EE2883D26D1C8FD0E2EA05B78FC85D9C32AF5B875BE5834EE444239A1F600142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 488e4bb64475b39f917dd9c6a80cef17bb63fc2912a4ed74af5a88cab315ae40
MD5 c9d52b4b99633590d58453557f9fab31
SHA1 17fe616379d77599af269fa5cd2858f946ce7132
SHA512 7ea04011d21ced823026d1a33190f53a87a31db097c1a0b5365226098dc9d7e80efb9056c91dbb23ed26b04e2a49c479cdc125840e54bd975d3422ed7c6fb598
TLSH
T104311EE14C3D2AC1D4FE0E7FA55B78FC95C8C31AFAA8717D6820DE544239A0E254142F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1efeeedf992ad6286224b693530e24306b79accec0e96ef7105b4e776e308070
MD5 f88b863094edbdb8273d4dfc8eae312a
SHA1 4f39e37e37fce22ebe247142bca34f830a13875f
SHA512 2855b3c951efc5ee9ada9709dcfe83487f8147650fa78a5de30336332dbfb6f2de987a480f6f0f7426618c178bf6f23aa8fb0943165dd735f0046f426343f486
TLSH
T19A41F648AAEA1148B3B67E56AFF6A86D487F7D772E4BD45D00010E8F0A32B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download