9536e81573fddb6cfa6d4dad09edf116b5018325377abbbe6c82fa71b015d705

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameInputRedistService.exe
Size 376KB
Sample260511-bwpgrscx3r
SHA256 9536e81573fddb6cfa6d4dad09edf116b5018325377abbbe6c82fa71b015d705
MD5 feee95cc1148b3b2e45fdb65f707fe71
SHA1 eb4fee573f34db57976ed026eb0d0673c1bbb1a8
SHA512 bf2044ec668bfa61dd8ae7ea7a387df34a61835f75ddd185d4302820c9f72d6eab62df7d7dae823b0ce93d60551c51bbddf78cd4e406c6d14741f0df79ba8cf7
SSDEEP 6144:iA9cv/+dekJ8dR91/DMwiFGw2HQqPF2BQjLgjcCLgjrx2HG:iAw/+zmXrMDH48JLgj
TLSH
T144847E1AEBA904FDD177C279C9938501FE317C4E07A0AADB17944AA61F237E09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	msedge.exe
5768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229366588036149"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{8510E2F4-F892-4BB9-A3A5-C4C3B316A99B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{998B5BF6-C80B-43C2-A8F5-3217F02C12E9}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe
5548	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	taskmgr.exe
Token: SeSystemProfilePrivilege	4772	taskmgr.exe
Token: SeCreateGlobalPrivilege	4772	taskmgr.exe
Token: 33	4772	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4772	taskmgr.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe
Token: SeCreatePagefilePrivilege	5548	chrome.exe
Token: SeShutdownPrivilege	5548	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
2864	msedge.exe
4772	taskmgr.exe
2864	msedge.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
2864	msedge.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe
4772	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2864	3296	msedge.exe	104
PID 2864 wrote to memory of 4708	2864	msedge.exe	105
PID 2864 wrote to memory of 5024	2864	msedge.exe	106
PID 2864 wrote to memory of 3276	2864	msedge.exe	107
PID 2864 wrote to memory of 3276	2864	msedge.exe	107
PID 2864 wrote to memory of 3276	2864	msedge.exe	107
PID 2864 wrote to memory of 1732	2864	msedge.exe	108
PID 2864 wrote to memory of 1732	2864	msedge.exe	108
PID 2864 wrote to memory of 2400	2864	msedge.exe	122
PID 2864 wrote to memory of 2400	2864	msedge.exe	122
PID 2864 wrote to memory of 2400	2864	msedge.exe	122
PID 2864 wrote to memory of 2340	2864	msedge.exe	111
PID 2864 wrote to memory of 2340	2864	msedge.exe	111
PID 2864 wrote to memory of 2340	2864	msedge.exe	111
PID 2864 wrote to memory of 3140	2864	msedge.exe	112
PID 2864 wrote to memory of 2008	2864	msedge.exe	113
PID 2864 wrote to memory of 3140	2864	msedge.exe	112
PID 2864 wrote to memory of 3140	2864	msedge.exe	112
PID 2864 wrote to memory of 2008	2864	msedge.exe	113
PID 2864 wrote to memory of 2008	2864	msedge.exe	113
PID 2864 wrote to memory of 2572	2864	msedge.exe	117
PID 2864 wrote to memory of 2572	2864	msedge.exe	117
PID 2864 wrote to memory of 2248	2864	msedge.exe	118
PID 2864 wrote to memory of 2248	2864	msedge.exe	118
PID 2864 wrote to memory of 1592	2864	msedge.exe	120
PID 2864 wrote to memory of 2432	2864	msedge.exe	121
PID 2864 wrote to memory of 1592	2864	msedge.exe	120
PID 2864 wrote to memory of 2432	2864	msedge.exe	121
PID 2864 wrote to memory of 3848	2864	msedge.exe	123
PID 2864 wrote to memory of 1040	2864	msedge.exe	124
PID 2864 wrote to memory of 1040	2864	msedge.exe	124
PID 2864 wrote to memory of 5064	2864	msedge.exe	125
PID 2864 wrote to memory of 5064	2864	msedge.exe	125
PID 2864 wrote to memory of 4636	2864	msedge.exe	126
PID 2864 wrote to memory of 4636	2864	msedge.exe	126
PID 2864 wrote to memory of 4636	2864	msedge.exe	126
PID 2864 wrote to memory of 3528	2864	msedge.exe	127
PID 2864 wrote to memory of 3528	2864	msedge.exe	127
PID 2864 wrote to memory of 2884	2864	msedge.exe	128
PID 2864 wrote to memory of 2884	2864	msedge.exe	128
PID 2864 wrote to memory of 632	2864	msedge.exe	129
PID 2864 wrote to memory of 632	2864	msedge.exe	129
PID 5548 wrote to memory of 5564	5548	chrome.exe	134
PID 5548 wrote to memory of 5768	5548	chrome.exe	135
PID 5548 wrote to memory of 5776	5548	chrome.exe	136
PID 5548 wrote to memory of 5776	5548	chrome.exe	136
PID 5548 wrote to memory of 5836	5548	chrome.exe	137
PID 5548 wrote to memory of 5836	5548	chrome.exe	137
PID 5548 wrote to memory of 5896	5548	chrome.exe	138
PID 5548 wrote to memory of 5908	5548	chrome.exe	139
PID 5548 wrote to memory of 5896	5548	chrome.exe	138
PID 5548 wrote to memory of 5908	5548	chrome.exe	139
PID 5548 wrote to memory of 6020	5548	chrome.exe	141
PID 5548 wrote to memory of 6020	5548	chrome.exe	141
PID 5548 wrote to memory of 4976	5548	chrome.exe	142
PID 5548 wrote to memory of 4976	5548	chrome.exe	142
PID 5548 wrote to memory of 5224	5548	chrome.exe	144
PID 5548 wrote to memory of 4284	5548	chrome.exe	147
PID 5548 wrote to memory of 4284	5548	chrome.exe	147
PID 5548 wrote to memory of 3440	5548	chrome.exe	148
PID 5548 wrote to memory of 3440	5548	chrome.exe	148
PID 5548 wrote to memory of 3520	5548	chrome.exe	149
PID 5548 wrote to memory of 3520	5548	chrome.exe	149
PID 5548 wrote to memory of 4532	5548	chrome.exe	150

C:\Users\Admin\AppData\Local\Temp\GameInputRedistService.exe
"C:\Users\Admin\AppData\Local\Temp\GameInputRedistService.exe"
1⤵
PID:1864

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=SppExtComObj.Exe KMS Connection Broker"
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch "https://www.bing.com/search?q=SppExtComObj.Exe KMS Connection Broker"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffa435dc188,0x7ffa435dc194,0x7ffa435dc1a0
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5474684471813126173,16696279839965024895,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17821334082761024455,16240324914577219920,262144 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,4174917299797896159,5671449403019134405,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:8
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10013235856314220209,17542420075122586434,2097152 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6735947126562858275,14684963009020357552,2097152 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6713259928959430357,10808521993858127234,2097152 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7233153421251307453,15543636097641978281,2097152 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,11106838252871098549,17797917669962634646,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9040561847857646499,11891577035931558637,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10861376917686132109,9738358450561424231,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,1107669459184479748,4112445111488397925,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,16336542645430016180,14767757570347334311,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,16336542645430016180,14767757570347334311,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11584644107041620839,6471156433228915415,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,4202095182118719884,10349953919577423996,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6340,i,1204973015646728135,10775278020803161893,2097152 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,3543653999434034816,9459115081199279659,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,1514469113585746242,15524729141075105937,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,11231014727525224480,1265196123165262546,524288 --field-trial-handle=2340,i,12346422469308737975,7015613609273694664,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa43d1c728,0x7ffa43d1c734,0x7ffa43d1c740
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,2941862641362268288,18178287950760773543,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,11938638375153072249,9853540287743819429,262144 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,1707607376603133273,17054099828379373161,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,1738503771421607313,676241098238371505,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,10749253206227071271,11836736337718348614,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,7225838794491406492,6682162111757851131,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,11100307451789941705,498063806895505145,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,17421670293848401172,13980839315617920951,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,14739409161211476138,12596399781046596794,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4768,i,18018938059349817431,10307338488055492123,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3228,i,2211156837381910143,14784757447398745891,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,15205771604287696791,10911476630938301357,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,5207163596213059453,9401521379721333230,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,14819323995871955597,8248482749748501428,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6292,i,17047279999049705142,17435893333828160737,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6528,i,13627884112917295876,7792452329484019624,2097152 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,2648241287602321204,12034129606268829297,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,11216993509191648954,854017850652362538,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,12605973706684418180,466150405443964131,524288 --field-trial-handle=2136,i,4900724540910058501,5640809159667307128,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b65cbda50c33a9896d292c9195905b40d4082e4d8490a92014bb8f0808b83dca
MD5 f26a3c90af78ba7780157ecf057f90ac
SHA1 81f21e432ba5d0ee897aa1297f7e0f1c3d902200
SHA512 b4de26c5e6f1634b0dc910159f0d60d70e77514c2802240eefdee37c79fc7236b9188e8cbf77548f4bf7aabde4fcb1bc946295bf775576276ea97bd50b6b0044
TLSH
T1CAE022AACD25AC3B08FD6B1871694746EB5143272B40884F3A3CD30DCFB06375296C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 57KB
SHA256 a9685a298004f8569d1c98e6d75222294654a0c51ce1d8b822642cf7100353d4
MD5 f3e91a35437da22d4698cf769f32821b
SHA1 de0aab35d521d670b90a1a782539550909e2e711
SHA512 611c6e81fd94f8781f2b442a927257f28df99f086a16b90ad4f7633f488b977ba3a3f51b86c80a95d0d3b6d263d0c4131d38c6e03aba5792795da05f9bc5b294
SSDEEP 1536:ojrp6la5grbVy7FXp7usm8QgiV0QcqsmTuFZ3y3cCvJi30n:Irp6layXVoXEYtZmTuFZ3HwJiEn
TLSH
T1ED43F22FF55EC70DECB5102C45869E8325CC7C1D5B11A037F5BB2487A236EAA695F832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 640KB
SHA256 cf4b37869f82ab565ecc806f3858e7e7b462362dd84b7769d4af3508129698a9
MD5 3beefbdff68d7989df5f3310530d1c13
SHA1 48d314f4093036273f7b4172aa3f6d1deaa65512
SHA512 a2fd916121fa3194af96d1aac0e48400b8f180822a99ab0a60d3fa51e3001899e4c857beb090b15ce350d4bf84cf670a3fc35191025a31bbd9501372eb9dc01b
SSDEEP 12288:AYQJICmx0yBPfUl33yAL2DFv3Ar7Udg+TrjAqP2:lCmx0yZ+3VaDerwS+TrjAqP2
TLSH
T107D4230064BB411445780A6D72F8B50FB850B05A4417D7EBE94A2F4DBA19F93E8FCBAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 22KB
SHA256 b80d3bdd09dda8f15eb04eca42f89d0027fc587e93e3818c0d4f1e22e4414c40
MD5 c11d92878923464b32423efa50f679bf
SHA1 378207643ac846918423765c3e1bb14811c428b5
SHA512 21cfc327c88c749cf90f02ddf44f41531bdd96684ee5a274be87fb65605834d93fec1c2bf7857e7bf3592177e1a7eed41664d4a0bd5c935e1d43c75e4212d12c
SSDEEP 384:FRqTYmFo+GnQK4tDCFUTAz4Ydowblf4ISR/nEjaXsCadg5WStyZ:FgYM0nI0+Ez4YWY14DRKRsA
TLSH
T12FB2E0B3AABF5C090D16E875F3B05E4A2CF0E31DD01E2E9D382A10866B14285ECC351F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 34KB
SHA256 0d82066ec9d4acda85fdfabaa1b50601f646d1a0ab1155c3e01b4b54ce477441
MD5 47de0cfff8fb9db37f89b2c31ae056d5
SHA1 36be8ecc577942ffdab4f04517cba100ba3a93d6
SHA512 ec6c523594e073a4b94705b9485e307e5ba3748b3459a34f1113fb3b86c1136e9c8a04e008232cbf599d27e0507c9012bd7b05f34ca4a2cfcc6488a43f3ce8b4
SSDEEP 768:rI+QdWgy5/nqFAz9Yb1uxX97gMP3TWC5BlWbLU6poItDGSxqvlR4oRQPQT6:XQdFMSoYb1uxt7XvTV5uk2ySxqtRRQo2
TLSH
T1CAF2F158784D51491E1F7CDCA2C72B0036745807ACE86BD13B66B6BA6CB98101FE48D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 269KB
SHA256 2deaf389933e40b57388906de9c202cc9c18ea6e288f434e49da9b769a70b8f1
MD5 6fd31d5409d1e132ed7fcaf500169cfe
SHA1 4239edddb80a088f946a15296a5e662ee5963d34
SHA512 1074b63d654c9a62e96ec8f9ff7d4bca4d9e91478158fa2fb54854d58f62656724304f0a99ddbc5b3985800d7c19adf2011e8949a723336d6a1c5df52eedce5a
SSDEEP 6144:bzdUUVOhA2DUUw8v6HKktC1ZpqaA2rRlkRwJFoieoETehHR:fDQhA2DUUZvz/5RrqWhx
TLSH
T1F4442338E3AEB49FDB0CCA8D1D8DA740A42599CC4482E0CFDD79415DC47A678C6B97C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 8e0f1e9766ac23afc814457a75ae2a85ead401a4f53f22bd731825ed2f7100ab
MD5 dc80c242f2ecacf70f3616886f89e545
SHA1 e8a27e6b1d20771190f535f893eaab7b75a0a3eb
SHA512 e95c3067f2c3f6f417e9cc82c7cb2e99dd3f492258cb71d87585d1039ee56732e35f26ffe6f873195f1569bd4c9484cdc87db299b10d71bcc0e02d15a604d451
TLSH
T1CE01AC29CFE4F022CF542270111F288782159F97CA021E37D969647C7A2FBE70A80852
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 113KB
SHA256 4f24850b8d5fcf453c46cdb214f4b2c7e17af7094edee5ccf68908aac86db19c
MD5 f08f6d4b12bbef6dbb245c101fcd3139
SHA1 5ebaba26397c7f9efe9af5bd45113e77aa27bf57
SHA512 1a3f67c12b450aca9308011501dad7ad7c636232a75c37bd618e1523cbd2cb7b585b2cd0c555d53c3875897dbb80ba8bab80cddb74c7ce5278c46b50bf1c378f
SSDEEP 3072:7fOwrrxB90WZNnKadRisN12Yd7dqloCorU:P9K
TLSH
T147B3C84E21D93AEBCA0D81B50C614AA15BFA2E09148C709FF4D57A2DA7B7F912374D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000008.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000008.ldb
Size 17KB
SHA256 71e3c4a6ec02e0e0052440d94299d49747fd9d7fd396cd7d4863adac70686026
MD5 0e0d1eedf7abd3058cf13e20303d102a
SHA1 63247a5ef5390110afa4bc5a0f5cbb64411cb17d
SHA512 9e4c5355826ff1de76711ba53887c8dc81c48d3721de829451245a2fc03f0361747460108ebdb4fe11f8954eccf4027c0533c434e5472ad72f9f61bc820ec1fb
SSDEEP 384:YDn8l+1DUbe/cFku+eseRu2MtjJ7AJeOI3mSmap4o:YlR/cxvXRuV97AJe/2To
TLSH
T18482AEA75AE088DBC5B6F376E4FC135A6E20E80731D4E0EC26C7310C1562AF225ACE56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000009.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000009.log
Size 44KB
SHA256 92623f4c9bbfb2825d1d57f20ca1fdad64967f00e8e76d43b748c7e9f4bc502d
MD5 fa68f0d6922f378a302cd18a1ecfa047
SHA1 45a5534cd22ab573afbafee081028463478f335e
SHA512 9b9a29a43883ce7305fa5fe8d74f111c65a21e455d65fb9c1be6bd48852b2cc2988e426d9765316867cb8678fbe522b36e4612c7a5d1b67b8da281fd612e3e63
SSDEEP 768:Ku6MHXH46G4GML6ELuaimOS62U93LbfPbLnmq0sIQsUoQCHyZUzelwP6hc7GN438:Ku6M3Y6G4GML/QvXQQ3DozqEH45hQnrM
TLSH
T10123556F81D08ADBC705D1F58D690B5A4F3A6D0528E870EEF08A3B1EF5366601F71E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000011.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000011.ldb
Size 12KB
SHA256 084f14090e0a40f3f7acfc539a5806aad71daaf249b13111ec779c5f00b641d2
MD5 ce4f0f18cff8debb7deeb902e0d57659
SHA1 acd0043c3c0936aae8e88938ad27ecfa6ad8e23f
SHA512 9a983ad5289d866f8e6c5bbf636358b8b7b27ba20d49cf323b08b93087363f82fa639627f68be84df81a0f932645dc6bc8e8055b3db4b61c822252ea43a07eaa
SSDEEP 192:tRcIEZVsHuhGEeVGdtokQxVC2lUYvZFgf68iwscy/89ffjsbtJeOSJSLqLG0ZI7M:PcIEZVlhVeeRCSjJ7AJeOI3mSmap4E80
TLSH
T1BB429E96BEE5C8D7E4B16235B4F953596E21F80F3028D1AC53C7112C0832BBB1429F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 3KB
SHA256 238f7f2d698019fc8ab0a2909851f9dffb3028f8ac87833653a79ed3885bfdcc
MD5 0be1ef999716706ff50b64fb4a203d6d
SHA1 56bd5ed09731e75b0b507890179ceeb68f5ab636
SHA512 7ed37d5eaf2c4d1a713df157fe126c83a597267a7f2e7bfac8c2aba423e5d4de72ab31bbdda17f643b8dd10059e40fa2586b87f1fc945093d7b5b976bed2adb3
TLSH
T1DB71CEC7058488F800F2F2E2C628A445DDCDA25D565D9F5576FCEA8F17E840BB2DD0B9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 513ee2f88712ef216336d86d6a28b73ae690100e43e4c6554587b4dc38ef05e0
MD5 31ab43e53d21466fa1b8e90953ae94b6
SHA1 182419d7e66ec1fcd107c9a15c71dee8f894840d
SHA512 5ed027db5afaade414d17d413959a26c87c527be215d16175a5fbd0718ab3114e8652c18093e9a3e0cece0ca734d452ebbec011a58ecb0b13f81a8ce5a62ecd0
TLSH
T190E0201898C9C5DF11A485E795307F0EDEDA560DD7CDEDA54F95DC1470CA80CD0EC251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 611B
SHA256 7b0602ed9c344e70faa0beff7b0079b25ad2db4bf95e0bbb29471e11844c136c
MD5 e6eaefe1d443e79011a0a338611b7c0d
SHA1 b79ba6d45c82c3d53c1480d234eb683a322a7f37
SHA512 2ce4be3bc4963cf762f5d313cb2aae6913100fdd9f725cb8c5cbecc19e22cfdc0284ec03a769141ac36f527a645d28c3408bee74e9374f9ca330deeb032231a7
TLSH
T121F0C2A0DFE8D4D1E9B60E74053D70AA6F25B0CE1D1FDD0E011A116A1273A40DD74D25
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0617188b10ec866d83d09d6c34d37f4d0007ff81ebe9a6cb34a5d20fce14ea44
MD5 9e525105ef17454320b781c94f4b5f96
SHA1 6133cb82a2adecd0b45ec2db0626b963f87a4767
SHA512 04cfd869786f35d0f64fca3a1319a600426208dfba224b1df0656684a8e26c4f8c85e846a6a16a9fc3f185ea8f763bdf2365d27a97091ade481ae0c073c9e27a
SSDEEP 192:D+Wlu13woGze8BaIa9394SGRfGGRlB2ruubvtDq:D+Wlu13woGze8BaIa9394SGRfGGRlB2w
TLSH
T1E1E179F3C3D8C67DD82156F4EA143A1FDD290E2453183C6AC9E5AF4B63E9472D24168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c4d2611ab8a379974c4b2f13a7b541efd38f32a01b24ea0fc4558c9f0a00115c
MD5 4e4b57c4567e53220986b96ccdccacd4
SHA1 0590552e515b322957dec05aaea39f0cedc89bbb
SHA512 6a8958c0988b71d6e5fd6b17742f439f5a09deb96ce33f490bd2f8ea428030f64bc9ee4ef1c9eb8272a1eb363ef9dd4bfc8daaa2ae561ad42726e15e93323b30
SSDEEP 192:HR+5v/2nneBTXPVjv7ZpIhAPRp2VYP79wHsb+WNn7oikz2/2C2tEWeDJ+kfaY5Mq:HR+539dlE8X/OwsN2+C2tE3JTaY5Mt8
TLSH
T14652F82EB9246A3B5DD7D32AF921771BD7F5102168802E88E7FCCA2C15E75CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 890002d363e734813cb45e2bfce40900a29c7fe463d12b8f9864b519cb310311
MD5 14a159fd0a2864b45aa223994ce4e3a5
SHA1 e6fdacdb062d4b36933f080a6fbbcba29dcaf688
SHA512 67ba8d6a88ee5f035454c3b7466f60fbe89fe70b6384617aa7e099c3140cd214e9094269a5ceac41c433629c6faed7ea34b89324dc971f232d39736803acc7db
SSDEEP 192:sR+5v/2nneBTXRTVjv7opIVAPRp2CaVPu9wHsb+WNm5bTJkz2R2C2tEWeDJ+kfao:sR+539HTl3gXPOwmO2UC2tE3JTam5Mte
TLSH
T1DE52D62AB9106A3B9DE7D31AF911771BD7F1102169C42E84E7FCCA2C21E76DC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6633637d46be3e057d5c1fd4355cdc057a5779dfd58e1092cc270486bb0008a4
MD5 5caace4d63fafb943d83bd2b593b6eb2
SHA1 d6042c385d7a897ca7e42db3af0a31707eac7d13
SHA512 455b471f231fdbd225a8c6aa7b1af4aa68c0cdc6be3368303b6a5003a1090b14b41f2d776d1655e1e0608cc85643788d6f6975dad302911e4e6638fb4403c58b
SSDEEP 192:sR+5v/2nneBTXPVjv7opIMAPRp2CaVPu9wHsb+WNm5bTJkz2L2C2tEWeDJ+kfaYl:sR+539dl3tXPOwmO26C2tE3JTaY5Mt8
TLSH
T12E52D62AB9206A3B5DD7D32AF921771BD7F1102165C42E84E7FCCA2C20E76DC621781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fbe16026b4e21e68e4e966fed53b3dd7bc2de61d2f0df44e974d2d7ef9685b81
MD5 069aa9adc8933e993ad52e7735300f62
SHA1 067aff299b822876eefddd67c8290dcc375d2d36
SHA512 5efe026dbdc17ea085a48796fc59eb675d2ecfaf7b6abf295315686794751b079af221991233c59253a4b9116edabc66929e4b8c4ee0a60b678184c7d928b0b9
SSDEEP 192:sR+5v/2nneBTXRTuv7opIVUPRpWCaVPu9wHsb+WNm5CBskz2v2C2tEWeDJ+kfa4T:sR+539HTK38XvOwJ32OC2tE3JTa45Mte
TLSH
T1BD62D62AB9106A3B9DD7D31AF915B72BD7F1102165C02E88E7FCCA2C25E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7085bd26a00ea25f436317507845db76624f1e305c5ea5c1633f0710fb2525e9
MD5 6fedf8e0cda28604a18bc21b3b3a9b01
SHA1 6e736322a4f9228617a8d1dccd80d010032b80ff
SHA512 7c43690cde2a8678a5465e416e0cead981d993013a68eccf60d0f0f8520df5a31229546fee29023f6dada5f06f5e8901b2628e5ccb2a58fa5dcaf82771739eca
SSDEEP 384:UO62joO6z7KxkXqKf/pUZNCgVLH2HfgslBr7pLuLcifKO6/XODoO6P+ErU3f6HGy:UO62oO6z7KxkXqKf/pUZNCgVLH2Hfgsr
TLSH
T18972E9676C4C9E770F94CACCD816BE4FADB5010B65D9886843FA982903D4BDB11462FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\03185f13-cbce-4362-9db1-d5f99a466337\index-dir\the-real-index
Size 2KB
SHA256 1f28c2340fea2e03269815e6ae19db630609cb6c9be17749f96b6c2a8d8abf0e
MD5 cf45d2f6f196c3d18d567eaffd76cab6
SHA1 6cbcb9aa99524d04030d00842f1c79112c61c28c
SHA512 107a4cbb78b606aebcc15f76e22accb1262cbfe5a7be1e1541deb9f4ed7da9b56a488b18be04db7a692268a024300d41907b0dd9861b43fd2d4aafe401783179
TLSH
T1EA41444DCC90A7ADEC7551F92DD815F683762D38FC58C6524554B2A53403A680B879FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595450.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\03185f13-cbce-4362-9db1-d5f99a466337\index-dir\the-real-index~RFe595450.TMP
Size 48B
SHA256 346f062dfdce49488f87efc0b1131ebe05492982a59103ec192b117dde7578be
MD5 0b9a1ed63cef48d7550970b3db9f70bc
SHA1 fffcedc2f38f5523c29e4e495510ae0df31920ed
SHA512 c6c91baa1e198ea399021caff41c6e9def68047c38171c336cf9f35fc589f40672e5f0a851b7edeac4463b7a3511ab467b4039d203c10249eaff5be1316199c0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\86c6529b-ea74-48b7-b5e0-4de7b41fc933\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\86c6529b-ea74-48b7-b5e0-4de7b41fc933\index-dir\the-real-index
Size 576B
SHA256 b91333034bf2309c21ce4cb1b175cc191119f569b34c4da15a8d1f0962ea22d2
MD5 bc24da95da1e4540bd6a31845db73c3d
SHA1 2a2c9372389b1f63bd1794313e85be4629c97892
SHA512 dd3a86d83552b60ed9a7facfe0e9c0d5aa4f1cf0c48e9d5ae5dd2f6184bd3f02dc2d06eba75320c38af69c88d432123cf04ad7c0a6a90c153b96df9216b0f86a
TLSH
T17CF0F1389A7DC05EEE040C7902B1086CB3B87C1A1D95A2C32010306F9BAF5338E01306
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b164.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\86c6529b-ea74-48b7-b5e0-4de7b41fc933\index-dir\the-real-index~RFe59b164.TMP
Size 48B
SHA256 9e1a9177c01b7ebfad880bcf174a0c1a9551d74d9698f85326384b8c1476f390
MD5 b4d1affc06da438585e8eebad0577e90
SHA1 dbf7e9fcb91c3bd7f44ad8b8f712f53cf4cbae9e
SHA512 01752c92954953dab413dbafaf7c70e67af1079774f2e6ffac36cc1a42c04c31828872fa262ba138b61bfbaad5a30b0c31ee96458fd9fb054777220c251705e8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 32ea14d8007ef8eaf199b411958797528177b90853ac2b6e0a98cca4d8804588
MD5 2d277ffb73e38ded06ab33d9cf54a20d
SHA1 e669dddfddd79c353ee70cfd6c8bb57859ee3f38
SHA512 d74d0fe72b2007e929b9c197db911724424e2994c5f861c58cb7a7a0d9405df710ab41dc887afbebd8f28e95824c5e55be703577026a94e4c3eb2664afa236fb
TLSH
T1BDD0A7DBED642587827A6FDC3034757D931A7088CC92DCB85654120173F4913C870A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 c6d1426c1b6a65dce07e3dea1853d787fab57b7ff04464a377fa3f7b44abc4d5
MD5 46be4c80335ab7b95950c6a1e4a86668
SHA1 b055446fa5e811b0dab58b317c3b415fa7021273
SHA512 9113630bceebb588ea3fcf8b32505b2515cecb5e59bab9040b3f93becf203f349a39310d36443d988ab17e2a80e1b38d85146d583bda3d80b4e45195f946c0b9
TLSH
T18DD0A7D78434694A93346B542124134E513E6D568884DCE44484B04234B4502C412768
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 b97974f5973fc188bd1141ab43e5c076d626ced05c303cc2868c53b60906bcc0
MD5 76b92c22917e8ef6ab78aa2ad5171db5
SHA1 89383e42370475cb60f5894320e0bf198e04fb76
SHA512 1b28334bccfbcbb3c9e41aeb77092f04a67fb8a80ba14f51d9e5c9ef0bce85fb9b2949c67259dd5ca81a06a7b41d4e2bff3a26214051a31d4f3881bac1f496f3
TLSH
T140C09BE7C818998BC774BFC83134575DB21F615DC4D4DCE45144514134745134851579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 808b285c625c5847f85a149e2d3ad04fe9461e9efc8793ad21a68bb0e2dbc151
MD5 90efcc9aed08a6340bcb5bbed91e2b51
SHA1 0dfbf57cbdaa95f335f207d7177629503f1ca2ba
SHA512 27e90672db7b370aaf9d7dec33e6b80e2d85f56f0d1eeb2b5d64dd425f288c8a9ae21725b2a829dd16e4aaec592355bfe483386c01227faffb8bd4a8ca90762c
TLSH
T1F3D0A7EBC934A597A734A7843134154D5229685A84909CD09814B14230F4602C421929
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 b43ecd685d433488532bf68084db9ba33b77a30d38bc7ad208e9a037b123376b
MD5 4770bc112c6f6bae04c06dbb3970bbbb
SHA1 52ca9f09cbd4f628ee9cebb322acdc4e2cffc28e
SHA512 3174de15319b05eef520f2403bbf2787c2c1a1955487450cee7862117b6b6db4fca8e7829c29404348cdd45e334e6cf58240fe53c0dbb3b9abb3a86caa358ddf
TLSH
T1E0D0A79BEC64158682796FDC3034756D922B6C88CC82DCB99554710173F4513C860A79
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 cfba6783e08be268bb5f2f1c7b635685f259e450b867c318a02ba96201012e4c
MD5 6f96df228bd05c7040848162e7229833
SHA1 fa20599070aa1d4bbceb1b1a63d3de73ff669c8c
SHA512 b435392e02a4f10e103763e940e7105115db612202d1a1c0f6c838d7f3eefe560525fcf0433afad64971f9c54fc5ace98acaebce19f1819c677658d2f0eff931
TLSH
T1D9C09BEB8C1465C7C674BBC83134665DB31F615DC4D4DCE49544554231F55138851979
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5944c0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5944c0.TMP
Size 137B
SHA256 de34743c6f6403435cdf52d30c53a43480ce630392fb4a70e5ee9061d9c097b4
MD5 c59721bfea282918daf679325417107a
SHA1 32be33ada5157d115041b48c1ed637594ffa86ee
SHA512 20b11cd2d9e6ce4429618c7292352ba8d803e31750ed0326d31a61a766f54643bbd74fe7b7e5efcf4ab9b340937afeb14e16021f318fc8a14441d7710010a283
TLSH
T128C09BF788245587C7757BC52134565DA23F6D5EC8C4DCE49145714230745138451579
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 6f9d6c4959d179a3cc70dda9cddb3e968589a13b702872641da697e661642fb5
MD5 8dd14fd737501a9ea85273755aedc10b
SHA1 6d899fd71b8f2117d384cb9bdcbe195ca76e6aa1
SHA512 d0e6f1e378b12e5fb0361ed75271cf3f05698c2f7bc08254627c52109865b066111b4eff2a20470c320d4ef480f420d6b4fabab81360b96751a1574a18210804
TLSH
T1D9C09B608541D113C05905B4155554DD7674EF95C7150B1171F8692B7CB75365414161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a80e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a80e.TMP
Size 96B
SHA256 cc2d05899bcb1df46b03c31f3ab58b07ca3e8e86e435af7ffefbe6be14ad56a1
MD5 2cdb1b01f1c11f026c3fe5f020f80897
SHA1 8419f6b2de1c555d7223f2fbce3f6e40615669c9
SHA512 480992edd6a584ce2cdba12ed7553b203b39b2bfaf88394230544b66855ebd77d6e8354c7128558abf588e4a45f6f8a633ddb320efacf713f0b0ca83cd9b5d3b
TLSH
T1DDB02220C002E202E00203B0288E88C833A0CF3AC303032282E00B33CC3C22080200A0
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5548_417664487\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5548_826065512\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e7537de88977426000cf535f51c50337339a74dcafbc57f4a8e3da6e72d6bb7f
MD5 3f4622732a64b2bd7f0b6c9165fdf499
SHA1 cfaf799b98b045b88b2782476b16804266a3255e
SHA512 d410b3fb37228f08481a033f2936f76726b00fc09888a1336d738ed0fa7d240ee67a98479702bd7521cc5f9900fe9428134a3797a1b4ed08f4225561de626bc1
TLSH
T19C512B185350539340B98C5ECB530DA19CF2CBD24ABF82E8B80C274855AAF24BA88FC1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 2a2fab613fde178e8f25d734742d3a590868df2f417560c9d35c02b9f46a7e93
MD5 184b0e48aab6b4149e30dfd8e39ee87e
SHA1 f390a53ff135e682f11ac893a898e135bacb863e
SHA512 6168432a9d16e039ee8ec7c233074b30b4e0168e5ff3ef4571c2ef37901d014505661b920cf162cbce13bc2f2e12cbfa68be02a2905c6b396fb17461c8062402
SSDEEP 1536:YqcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3u:V3Qw/xLANk0mUW5GmRntSFCjEEN4
TLSH
T12C9302BA9E174AEB957D4A8176AE7909CE12230D70AFA9CC315C538C31D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 a8ea93cbe3980ae5f842a4e24178703f7dac9599d79a4042031579b9470a73a6
MD5 464b19b2cf418202098cb0e484d83ebb
SHA1 34e3006d6bf2e75761207d5bac0b8de397a2e9dc
SHA512 cac6707f840fd59a5580e640e450c720a3ea60507a3cf37b0c2235942aba4131f63337943be2c7f05d34d15b3c820cf50550e8bb58b2d388aa3f9bef74dd1260
SSDEEP 3072:4hV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/R3Qw/xLANk0mUW5GmRntSFCjEENn:W6OgB2HWv3G8YnOn5rOk0HOGm/SFyEEt
TLSH
T17A1412264A259DF5113DA2C1B11F3D41CE11665AE4DFB8C9B2A5338E52D43483F8BF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 b9e303e1bdc6367249b48e691cf980627cf851b6e3a75fbd48a4f5bf738a270c
MD5 b9e79608fef13d47b8ec2e97b6ae7e9b
SHA1 cbbae3edaa9037c69093352d9221ebd468adfbd6
SHA512 94f692f2ee461b9ae67cffd75b63ddc9cff098f4588cf4161d0263d1d1cf1c64ddcc28293d95fb3a23836a51d86bb7c1d28547803a0cb81bfd69b79086f8af06
SSDEEP 3072:EhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/R3Qw/xLANk0mUW5GmRntSFCjEENn:i6OgB2HWv3G8YnOn5rOk0HOGm/SFyEEt
TLSH
T1BA1412264A259DF5113DA2C1B11F3D01CE11665AE4DFB8C9B2A5338E52D43483F8BF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 67b30e5dd44f55385a875550bea41f4f83577655b894a6ae43ee356da6405323
MD5 9f80633d58ce5fe81217416516863fb2
SHA1 6d1cce2e6d280680ce21695fb754646a4ed481e9
SHA512 99f4257c4a6ac3b34da8bdd2cabde935ff526f0cbb787c621b8f33cb4b39fe9f9bfb4e6bcbe98abafd38c70f4fb1c5c04211aad579b042256994ee878c1afc09
SSDEEP 3072:9hV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/R3Qw/xLANk0mUW5GmRntSFCjEENn:N6OgB2HWv3G8YnOn5rOk0HOGm/SFyEEt
TLSH
T1EA1412264A259DF5113DA2C1B11F3D01CE11665AE4DFB8C9B2A5338E52D53483F8BF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 ac1a415e4bab9d1a0e750ec5acb41a6560545ae4b23b7b59b95f45d467a860bd
MD5 9ca59c44869d32372c8286c3527f7dde
SHA1 1433a233e51202e231c56aa18a04e735823e68a8
SHA512 ecdd462302c90993073c399ddd37d40fe15a44c00d93481fe3d408791bb4cbfe5f6f86c351c013fa9813f7ebcbae629bdbbe9d5f4960c0c5397805b516dd1791
SSDEEP 3072:BhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/R3Qw/xLANk0mUW5GmRntSFCjEENn:R6OgB2HWv3G8YnOn5rOk0HOGm/SFyEEt
TLSH
T1AC1412364A259DF5113DA381B11E2E01CE21665BE4DFB8CDB265638D52D83483F8BF3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5cc77a69e2933d0235ac8a539206200c479816f5bda04a32fda5a396eed16f10
MD5 1c0c83b8e90dc2addc52496554af3ff3
SHA1 d51d2e4f19bae4673952b8a9a969fbf594f3b774
SHA512 8953275d791ff6c9f0be1af08ed082a774a4afed8467fd458e4c175381ed8191baebfe40ebe8844eaf7a7054a60441da2d5759499d2bd067a8d0315d8593071f
TLSH
T1F3D0C04810B11C30D49D90734C4877873408C9538C4397331073386C0C030A01685187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2118f3debea8e2640977d8aaf949f09ebd1208d30ba20757560f958087279634
MD5 8d9c606cac641db39043b73620b9af30
SHA1 5641a30c54a84af71f1a3aab03ca11b81a4d3457
SHA512 e3db3c84d1a85989aeb2ab3f1c4235705e72fc3ef797e27988b927948b985b91f9a11ed453d521868095f672866c1590fad569dfc486201d39a6df77306d4a6d
TLSH
T13ED0C04810711C30D09D90734C4977873408C9538C4357321073386C0C030601685187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5b456653be6741bb3a8a04b6ad49c3009aab01cf28060ded3e7c0114f928a5a9
MD5 bae07b0aaac665e97662e3d392b99815
SHA1 8be303d074303a59a79d14108204835dc0a4d3fb
SHA512 6bbccc2b90fe4d96672a64f2f67092b921859b8a0a3c24ed61ae217c81faa3f1550d7139dcf22c7c2a017b3c8235e471444b16438ef16bdb5add9ffb091de6ba
TLSH
T18CD09732290D6021E12E1132C513C2812319024028434961E229C08C8CB80E423C1283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e0b011b78a1995ae8bd744d772534a4e53b937ebe024b0b96d811660b3fbe1f0
MD5 f27a956994219942da195cca89e99489
SHA1 47a4204fb873d4e490f854276863c529daba620d
SHA512 bd3c15503530a9fa885c1f5d76d9b478f492b518225b9e326756645321982a442c9b1dfcd6513661681a2a336cee1971c211aecff3c48df8bb9ea0338f98ddd3
SSDEEP 96:d2IBZY21F/aGyTMkaEPPOCPhTZjJVdGJA1rrh0T3Ky8OjjJXUvN:dDBZY21FCGyT5HRRHswFU3KajyvN
TLSH
T1DF911A10509C9056E7ED33B075EE24E2BAF0C75842CF4F8A33F7513E6626BA56036A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9c75a32729b7ddbf15b8f8cb72f40d9ea2614984e7d1ea9be15b24b24cf0c15d
MD5 46a9bd934b00baca81f850f12b608cf1
SHA1 42f2ba04c00f5950dfcc4d437c8d8235791c23ce
SHA512 0fb17ccccaa30c73be40b77cfd22786f286732226ff61200d1c4a9b0b4383f1034cd27493af1a55c5b5aa99f1bfe832c1b133a1d38f3d2ca4901bf4dbf3d2415
TLSH
T11651CCF7C3E8826EC91156F0AA187E1FCE1D0951432C3C5AD5E4AF0B97E2471E181AAE
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c32286caf5db968bb24e469047bf50096806d7baaffe6d7b539d18fe69f58383
MD5 6bbccdefdd76da4dbf01cdf1e75c4f76
SHA1 3f7a784d0a4ad7624a0d510c86d7f91231bc8bbd
SHA512 ab46d9a688a8e00c38f8fe54403783552cd8716c0c13fe0f98d5fb868df865a5163b84e07dab2ec7180bc36ac10ae93131c5adeb0f4ac6fe7334ddb25865ce82
SSDEEP 192:sxZVRYyM//K1Ml8lfcB1u/fpsSWpVxM2ab6zdpTnLHW6+WNq5ON/YBst9Hd4Igyy:sxZVq4m1u/fpsSWvxM96/nHb1/ZU+UJ
TLSH
T10A72C7526A24D9778DD6D60DFA35BF13C6F50422DA914E4CAAFCCA0C00EA6FD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ae502d2cfd142224e90b9a64b6cc58165e438fb56752be288e969244f5b74ee5
MD5 f757a71d2f3fce3d126784df10f2185b
SHA1 5f03fdafeb32e60c4201210e81174f73dc9c0d35
SHA512 043bb36b5ca0ce24777ced35cf05bf17486a0332ce2d3a6455031fe6cf486198a7a0b2dd1f4d28af02bf0a4ff67c88b79fc4b743e4759d60b28266f8fce3265b
SSDEEP 768:JpU2Je27pLuLn7nWvB3u/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKLjsLl4CpRKrop:JpU2JeWEn7nWvB3u/u1javLjsLiaRhVT
TLSH
T199F20C3B3C4CCB7E4F804E9CEC2ABE9E6DE8018B9698895447F9844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5aad4601e488c9b61da8955e6eae57602de01a9bd4566672e9a77b70d5d73fa3
MD5 fcdb22899bf88368523799070503eea3
SHA1 9cb1d348468fbaaaafd779abeb66f35a8d741657
SHA512 3674fba35068c3d3507d77b2770cab5c2f7d7398a8e79311a89a88fe25e5bfcd163cc7851985281a0e586176fc18d8a1744b485e0bd7ceef1a12d4af92885197
SSDEEP 96:K88gKFGNmLqKMcm2T+KosUn6hl315/mhsWkt/Kcukr/QvHkRJUFileioIYimAzRY:KMxphjjBh
TLSH
T132E16511713B12423A7E298ED57AB41F16D1B0A33464A82B7FB910A50F67E20DDFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a803c577eb089fe2d81fb583e739be1a83a59290c000488db87e200dd54de631
MD5 29158b615aeac109cd505548a26ddd0a
SHA1 39f150b70cd2b2a8b5f7af8bf89f7a304b016880
SHA512 45897ee9ed1ad6024091e75ce8181b877e4b4201b9c53d8d52594309455a87387814518db2b81ebb6ba1d1abadf640deeb72f6e439ececb5838559ae60ed1866
SSDEEP 192:tONp6xIQmiUyCTM8R/j2wzNSus6fhzWHffU6:tONp6aRMW/j2s4usgO3U6
TLSH
T1D902D835682D7C7B9EF3AE46F58B77275F94203BA9912F48DAE81E1C00D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7604b4b39a8d5d9e4099fd6de4d3540e6f257143d76d72bd058154917eb563f3
MD5 1178fc2cd524ad8f3554d1685c858de6
SHA1 798c2d49021a6f0dbd2fc4c8f58d8077316c9b27
SHA512 e2a0c2aebe13a7d5ebff9d4205038e088596d7f189beafb2317003ba52fc4dc49bfddb5a6dcba84e063002e29544dd7e627b74f2a68880cfbe9ab86b9798163c
SSDEEP 192:DONa6xYQmiUyNTL8R/j2wzNSus6fhNSubG36s4qIU6:DONa6uQLW/j2s4usgGuoGU6
TLSH
T15D120A366419BC379EE3A685F64B32234EA55137EE457F44D5DC2E1C00EE66C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 daf3381ad58ee51437217f9359caf6d626e25b04ccd2d2a1c4f70accd93ee15b
MD5 f9f6244ba67b14378aef1c6f3e50b5f4
SHA1 d7f48b9721148c14a0d3e28c1a106d408928e71c
SHA512 61103a0cc7e1cf273a2e87a15f192a82f35caf25f13f6c03ea2734bfef4b8994cd2ccded13aaa50e8a247a87a7e259100e7eb680a37f3e85d4331213ff16b36f
SSDEEP 768:QEcpXfNbv/y1gGdNSjB4w5y4e0tI8p0W7:QNXfN5T7ztI8p0W7
TLSH
T1C6B26DB1E85AACF74581E1C8A58BF1135DB460378A889E1CE7F8BB3C309F5F42716925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

4a18e09e-57d3-4483-bb53-7d61d9c0a75b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a18e09e-57d3-4483-bb53-7d61d9c0a75b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 29e3065d1d737350ba287f82e8063a56096bcd56036812fdb7695293555a9266
MD5 c9ce64a10f43f9e8eba31cc092d6ece0
SHA1 c430b78af74126a8c5d7c24c878ce85cf3b9cdb9
SHA512 6d137dd46245b7bf9428b19a958b2be36709fdea8b78978a97cf5b894124a82db799d6bf249b3fb87ec6b5b4918dd24842bc31c86b4309502b09a4f719a358b5
TLSH
T13041F858B6EA110CB7B76E56AFF6A86E487AB9372F07D49D00110D4F0A63B00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

8d21019e-82e1-4769-be27-d88e6178c21f.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d21019e-82e1-4769-be27-d88e6178c21f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

902d25e7-e095-430b-b872-b11bc3f825f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\902d25e7-e095-430b-b872-b11bc3f825f5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_1556851848\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e68f4f2c-07ed-4df8-a059-fd50b088d5d0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_960562528\e68f4f2c-07ed-4df8-a059-fd50b088d5d0.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4772-6-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-7-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-8-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-9-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-10-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-11-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-12-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-1-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-0-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download

memory/4772-2-0x0000020E44130000-0x0000020E44131000-memory.dmp

Download