684c022b6dacc0fa674db84afca4120aafa06315be967aaaff72b8894a2b91f5

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xenite V2.exe
Size 1.0MB
Sample260522-2yctvsfy2k
SHA256 684c022b6dacc0fa674db84afca4120aafa06315be967aaaff72b8894a2b91f5
MD5 488c442cb8e9068ae4e8325cd5b65621
SHA1 24afefefdde37e30be666ef0f3f90ecb9bc9f37e
SHA512 4569f65b2560768ad361d1b5dc074877271112ef5583f3634ef78d83b86ed0d58a477c47248b3d10c2f24d941440ca1e48ccf3346fa11c70adf7b0d3617c1ceb
SSDEEP 24576:8iMm/hDKLEvSVFhFlp1ZEkp9jNIUmsO5tkdRt:Xb6VFLlnZFp9jN0kLt
TLSH
T18F35E01EF6E64E5BE3A52D31C8A20520E7B2F94E6772F7CF27201AB12D532A05D36351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
284	4476	chrome.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_1503186001\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_871715733\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_974886147\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_974886147\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_120762859\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_120762859\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_1503186001\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3644_1503186001\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe
2292	msedge.exe
4476	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239643596281407"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9E907A23-5D55-4169-9522-C8EFCEF6D4D9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{478A5E1E-BDAE-449A-BA00-C3B08990561D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	chrome.exe
2256	chrome.exe
3644	msedge.exe
3644	msedge.exe
2256	chrome.exe
2256	chrome.exe
5436	msedge.exe
5436	msedge.exe
5620	chrome.exe
5620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2100	4708	Xenite V2.exe	88
PID 2100 wrote to memory of 748	2100	msedge.exe	89
PID 2100 wrote to memory of 1784	2100	msedge.exe	90
PID 2100 wrote to memory of 4284	2100	msedge.exe	91
PID 2100 wrote to memory of 1784	2100	msedge.exe	90
PID 2100 wrote to memory of 1784	2100	msedge.exe	90
PID 2100 wrote to memory of 1204	2100	msedge.exe	92
PID 2100 wrote to memory of 1204	2100	msedge.exe	92
PID 2100 wrote to memory of 3316	2100	msedge.exe	93
PID 2100 wrote to memory of 3316	2100	msedge.exe	93
PID 2100 wrote to memory of 3316	2100	msedge.exe	93
PID 2100 wrote to memory of 2440	2100	msedge.exe	94
PID 2100 wrote to memory of 2440	2100	msedge.exe	94
PID 2100 wrote to memory of 2440	2100	msedge.exe	94
PID 2100 wrote to memory of 1912	2100	msedge.exe	96
PID 2100 wrote to memory of 1912	2100	msedge.exe	96
PID 2100 wrote to memory of 1912	2100	msedge.exe	96
PID 2100 wrote to memory of 1768	2100	msedge.exe	97
PID 2100 wrote to memory of 1768	2100	msedge.exe	97
PID 2100 wrote to memory of 1768	2100	msedge.exe	97
PID 2100 wrote to memory of 3084	2100	msedge.exe	102
PID 2100 wrote to memory of 3084	2100	msedge.exe	102
PID 2100 wrote to memory of 1180	2100	msedge.exe	103
PID 2100 wrote to memory of 1180	2100	msedge.exe	103
PID 2100 wrote to memory of 1076	2100	msedge.exe	104
PID 2100 wrote to memory of 1076	2100	msedge.exe	104
PID 2100 wrote to memory of 1076	2100	msedge.exe	104
PID 2100 wrote to memory of 1216	2100	msedge.exe	106
PID 2100 wrote to memory of 1472	2100	msedge.exe	107
PID 2100 wrote to memory of 1216	2100	msedge.exe	106
PID 2100 wrote to memory of 1472	2100	msedge.exe	107
PID 2100 wrote to memory of 2916	2100	msedge.exe	109
PID 2100 wrote to memory of 3572	2100	msedge.exe	112
PID 2100 wrote to memory of 3572	2100	msedge.exe	112
PID 2100 wrote to memory of 4320	2100	msedge.exe	113
PID 2100 wrote to memory of 4320	2100	msedge.exe	113
PID 2100 wrote to memory of 3644	2100	msedge.exe	114
PID 3644 wrote to memory of 2412	3644	msedge.exe	115
PID 3644 wrote to memory of 2292	3644	msedge.exe	116
PID 3644 wrote to memory of 3412	3644	msedge.exe	117
PID 3644 wrote to memory of 3412	3644	msedge.exe	117
PID 3644 wrote to memory of 3412	3644	msedge.exe	117
PID 3644 wrote to memory of 3668	3644	msedge.exe	118
PID 3644 wrote to memory of 3668	3644	msedge.exe	118
PID 3644 wrote to memory of 2964	3644	msedge.exe	121
PID 3644 wrote to memory of 3264	3644	msedge.exe	127
PID 3644 wrote to memory of 3264	3644	msedge.exe	127
PID 3644 wrote to memory of 4996	3644	msedge.exe	123
PID 3644 wrote to memory of 4996	3644	msedge.exe	123
PID 3644 wrote to memory of 4304	3644	msedge.exe	124
PID 3644 wrote to memory of 4304	3644	msedge.exe	124
PID 3644 wrote to memory of 1076	3644	msedge.exe	125
PID 3644 wrote to memory of 1076	3644	msedge.exe	125
PID 3644 wrote to memory of 3264	3644	msedge.exe	127
PID 3644 wrote to memory of 3264	3644	msedge.exe	127
PID 3644 wrote to memory of 3496	3644	msedge.exe	128
PID 3644 wrote to memory of 3496	3644	msedge.exe	128
PID 2256 wrote to memory of 1912	2256	chrome.exe	136
PID 2256 wrote to memory of 4892	2256	chrome.exe	137
PID 2256 wrote to memory of 4892	2256	chrome.exe	137
PID 2256 wrote to memory of 4476	2256	chrome.exe	138
PID 2256 wrote to memory of 2388	2256	chrome.exe	139
PID 2256 wrote to memory of 2388	2256	chrome.exe	139
PID 2256 wrote to memory of 5216	2256	chrome.exe	141

C:\Users\Admin\AppData\Local\Temp\Xenite V2.exe
"C:\Users\Admin\AppData\Local\Temp\Xenite V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffad0b4c188,0x7ffad0b4c194,0x7ffad0b4c1a0
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,2738786826498931276,2287899984768164269,262144 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,1576479030119332251,519124219265429583,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,7271791989012534955,1951770027301232797,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,18224308740131883630,14083002876241880043,2097152 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12053427241515943786,14348382160452336853,2097152 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,232805966546914215,2854900636824323573,2097152 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,1375445620424174546,14673435706088334082,2097152 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,3544394922142723887,6739945789499806017,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1329688968051743641,2252861501521232801,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5380,i,16250644707929570088,5489663709959589654,2097152 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,12562846445239559814,12591770430708720102,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6743097062286113301,952064306050546046,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,18135958200476212391,6273373877090138795,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,18135958200476212391,6273373877090138795,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3522097412254197577,15591344232119192039,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15387886530131328045,14323209493549052118,524288 --field-trial-handle=2272,i,9506193013102817880,11048390214844707568,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffad0b4c188,0x7ffad0b4c194,0x7ffad0b4c1a0
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,6875035860312407005,16200514645399777801,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      System Time Discovery
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,5438327848073082990,17060511248069793118,262144 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,5490268817872038134,1732750761512307319,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,1748075328924292050,13049262392614050849,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,1748075328924292050,13049262392614050849,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,8315121903769719802,13807856338093652609,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,17442153992256566545,12500272978394255127,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,918426628959345943,1097908020974687342,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,1413697497272330941,16143418521571275879,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,15723964370577640419,11844183346383770070,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,4366515623144533419,5965591518023386277,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,7006601886103206461,5680312052432470584,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10117441771329119716,596420047787655740,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,9621963565736060257,10923736907562760342,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,11454264030531000978,9022559634445511818,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,18201841490691134743,2527516934129296653,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,17908324140760212469,12501105729225189582,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5324,i,17878701726654054001,727802473795588582,262144 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,2625211433462737703,15281594089649741681,524288 --field-trial-handle=2240,i,11300077622550238268,5586889789050559708,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
      4⤵
      PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffacf00c728,0x7ffacf00c734,0x7ffacf00c740
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,16078590743858774597,3126620596536261221,262144 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,4322974027285060188,6956674717533516375,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,8712603650837810869,145508822804637486,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,1699919006472648819,16312233034324640929,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,17836672371824729883,17778756113822263270,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,2819177467622474912,10127321765640092703,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,544678380755355316,4944105850024667966,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,10102240423551343400,3225139020417033468,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,3574327540249892716,17175054383408284005,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5968,i,7233573571232809042,13275012984836484298,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3600,i,5552179344353107273,3452438658204607248,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,4215960505799859796,2522039318771809218,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,2549764268269626314,13979927788487530691,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4452,i,5654379389111712551,16602415551280689143,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3532,i,16580234154098509327,11929323889713639201,2097152 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3440,i,16205376720377835894,9834169257819873274,262144 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,7277640819512186015,15923093342511600202,524288 --field-trial-handle=1956,i,12131217292258963822,13260071328340105037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3644_120762859\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3644_1503186001\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3644_871715733\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3644_974886147\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b4c05422356d4c896c9ff9ed33fd07f4711e042cccc6622e1a11192dd7c6111f
MD5 79cf967871da868c8c42e585f91c334b
SHA1 cb84291378d4279dc5869b290a3faeb3df7a842d
SHA512 6546c7d45231a75f343c763b67c7c411ccadcbc42c7efdfc1afec9cb1294c8085fd062c11ba735c6e515abe8b92290aace835b3fc68d1662a59fc233e6770af7
TLSH
T1DAF0F4B9D922EC3B18FC1B2974B5474AE751132B2781989B3B3D820C4FB863B4686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 f78ad08da74f2f7043e330c83e0a1bf759548b54dae054f609c92a39568fa547
MD5 b9aeb16d7ccbe453da9c90c9fa2b8f5e
SHA1 b7f4798bbbcb1ba03dfa8a6619bfdbde78c2ce34
SHA512 2ae2dfaf8ab619e1b8247d3a93ebf69ad79f319361854b24a535da507fabdb44586603a6c07d1623cad93c0eca2cf9b2dc70c6311c59d59cfd8b22e38f827f1b
TLSH
T13DF02708F483D758DFD874744AB60C136561C71B0A8D1E5A8364841B15D3B6C771F862
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5edb5bff15f870a02f8507cd50a547de7de8d14c10293654b2cd9886ae44ee60
MD5 8b6f84cfd358b850f94a00bbd9252fbe
SHA1 4efab92d016fe9e901f9f07f115fa69a947ad604
SHA512 3c71f5f6562e61b5ff42a090530229f1dea4fa93a5c117144da525cf4627297457328d164af88e8403913127703e584c411c28cac8d388f8b379427f9de4b82b
SSDEEP 192:DjSIp7wAmTSlf6QOl1jkhf8U5eP5KfdlGBZCK:DjSIp7wAmTSlf6QOl1jkt8U5eP5KfdA1
TLSH
T1F0D18EF7C3E4C52DC91156F4AB15AF2FCE2D0A14532C3C66C9D4AE5B93E28B2E21125E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 867cacff74fe8928f641793191fc9580db0c74445093970717f09ea1035eaedf
MD5 8db63ce43dff91a680d46971081387cc
SHA1 ef301074fa4ced872a729e24b56aff227b689e65
SHA512 10bc150401a1b6ee19642160bf58ef17d16571b2331f5916f3b5f3c9401cbc9b2820e1aa450b614c587a78121af13abd92eeca6f8c52b5f2b253d59993e2b724
SSDEEP 192:ARjcBz7x5e+b8v7MF+pAPRp2z0oM9HHsb+WNMX1sLh54992HK2veIHJWAfWVyIsB:ARjmz7FogoUXd1wUurS2q2zJWiue
TLSH
T15C52B85BF9212A776CDBD219FA26BB57D3F5103121C42E80EAFD8A1C15E7ACC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d0f2f4b7567f889a7106fd6d614010059f0ea196529fa394fa336786176e1ed3
MD5 0cb99192e39deb301854f8afff156910
SHA1 c88b5a2ae24901900c53df31ef966e678ab22d7c
SHA512 e21cccc2b8e48dba4106d0cbdce37e44ed0d964016d45d11f201c5744ec040d074294a678d4ef8095c039a8ecd4153ec36c0adb9107e254fb3f6e87e21efcaf4
SSDEEP 192:ARjcBz7x5e+bKv7MF+pAPRp2z0wM9HHsb+WN7sLh54992rK2veIHJWAfwVyIsnA4:ARjmz7FGgoUXl1wwrS2O2zJWi08
TLSH
T19F52A75BBD21697B5CCBC21AFE26BB57D3F5103121852E80EAFD891C14E7ACC2217857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 40f89b8f21a69b02f910bca430a404c8b944a8ffd3b8fecdabe66ec8e921f8c5
MD5 404f9b14a4aeec06e278e5d66d2fde88
SHA1 4f92930848654cefdd71f44e96ecf6d4fc9fa6e8
SHA512 2335c2a8ba09bc3ae3fcfffa855763188ff794f4ddeba6ddfe1c01bf12de8d984b707dd873bdc9ad7fc68f70a94040fdaefeeee52d38655a513f1c34dd0985a3
SSDEEP 192:ARjcBz7x5e+bOv7MF+p9PRptz0oM9HHsb+WNMX1sLh54992ZK2veIHJWAfCVyIsB:ARjmz7FqgoHXo1wUurS2k2zJWiCe
TLSH
T19C52C85BF9212A776CDBD219F916BB57D3F4103122C42E84EAFD8A1C15EB6CC2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 398a6b096f9bf9ac97a3380e3bb0514816fc90038f228850f72aafbcf025e2fa
MD5 1b9ff5803c53e0bd985799b576a2cef8
SHA1 0483bb504e8d84cd4c97b7331a52702d6c040829
SHA512 b6b7cce1537a43d426ebb2ad21e562ad5bd945833382ee332d8e987e038791ea1bbc94e0122fd338c8c0deab9d9a00a4092e7bbb12ca6612c312ff13eaa007e4
SSDEEP 192:ARjcBz7x5e+5lv7MF+p9PRptz0o69HHsb+WNMXJLh5UgG+992kK2veIHJWAfCVyr:ARjmz7LVgoHXO1wUtu8272zJWiCe
TLSH
T15152C86BF9211A775CDBC22AF916BB57D3F5103222C42E84EAFD8A1C14E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fd6ee78dee010d7802668d5d9f23c9a3a1eb476928b3937b1784c0fac1e86001
MD5 1f775e804af8cac9f6210d03b3984eec
SHA1 461912a01aaf04a2c5a0fec1c36dd5a9936723a1
SHA512 11ef9e5ee1191342d4c28f46613b538e79c06cfd96800354e488b5a8ae63495fd40396300981ebbc169a03578f6c8bedc137f2000cd262ad4b4f8d588ed1edf0
SSDEEP 192:ARjcBznx5e+56v7MF+p9PRptz0oBs9HHsb+WNMXJLh5UBad0e992fwK2veIHJWAf:ARjmznLWgoHX9s1wUt200c2fX2zJWiCe
TLSH
T1ED52D96BF9211A7B6CDBC229F916BB57D3F5103221C42E44EAFD8A1C14E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ee41d30e470c5212edb536d4a19638c0ea2f7440c3d19312ea543154242d0f4e
MD5 f6943d2c74aff22901b0ed7b96dca0c5
SHA1 a3dff655d69a3b50609a035bd61804e561f4cc7b
SHA512 15032cb9698ebde9dca69ff55108b74632fd8b368fc4fa912c8f5feea222834406b500fc1a90958faf8ef44b044da8097618c9f6c8d47ea4fb645f5fa28cd19b
SSDEEP 192:ARjcBz7x5e+6Ov7MF+p9PRptz0oM9HHsb+WNMX1sLh54992ZK2veIHJWAfCVyIsB:ARjmz7EqgoHXo1wUurS2k2zJWiCe
TLSH
T10552D95BF92129776CDBD219F916BB57D3F4103122C42E44EAFD8A1C15EB6CC2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 91ae847db54faa0b68f1a86ca88f72c1559c49ff119d52ddc310eab5f686d710
MD5 8371fd1d25eba14210a7063493eb08e5
SHA1 5a93bcc51ab89830290b5b834bd3b37625bb449a
SHA512 03794d1a503457b1357c89724c914e7cd3599078c7206106075830152a747699d8402fc86798141afbcdcc890f17d2e1e593196a9333e102257a8c0204259a3c
TLSH
T107B0124080826242C04202B4214214CC7124DF10970E1B0243E46926C8275618414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a96a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a96a.TMP
Size 96B
SHA256 ce716da89ac2fb04122cf7dbab93eeb1366391b5b6d5d2504617ce45fe703f39
MD5 526601ead74c0077d1b379ea60779467
SHA1 b2fc665d0852168c17200818d078d5a24b677c91
SHA512 9360091f4779909163a40a095841dc410457bc7b280f339e478a3139b13d9aa4e447ae20db3efc23ece2ccd334ef53d78403d0017cd09085b54ea211ad017ff8
TLSH
T1B7B00255D203732ED44243B06EE595F87170EF35C64F3B1296E12A76EC266714527670
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f566922709f5843202879730685a3c4cbf470794b8dcadc70494bbcdde64f049
MD5 e689d1c929f4d733f2c9e786ab2e7e75
SHA1 e4a2be8e1bb41da0295e51d346109722f9d1267b
SHA512 449e3780682cba9118be66974ff870e74fcbcbee72ea0f1dca66d96918bb67ce072463a86b0fd9f126c000641b73923f595116f6ed808062c6da076094566e84
TLSH
T1D2A0025012E50D45ED481A7112910DC527A0CC145385C343C194148999A75835245600
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8ede9c393bdf4f5115572e031cbd07ae7f1c4447e718299e5c74ab50a6e17424
MD5 148c6b06baf66146fe623b7c92380c19
SHA1 eeece9e52085f40a434723680fca87f59d5eb7d5
SHA512 029d0ff9f317163a531e1ce2b365a33f936fdcd0cd835dcf989fb850bf2c26dc6d59ebaefe42d419a1e05c290ece408bf94e749ab4378ebb0e5302488aaeb8ba
SSDEEP 3072:/GGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/xm7Rkm1tYpBeh2BAoM
TLSH
T163C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 8cbab862f22cb62f2f10600f7630f8139052946c621cb1d4fd7eea702a5b596d
MD5 c9e317e25336dbc1bc4b1cd631f7c98f
SHA1 72f15cb9dcd91d6e924819455537224939338a69
SHA512 fded402b5cd5fdd168cd3c7933cbd6b6797ed784815b2716cbcbc7a54a32905d5ea47011e84b8ab9d7ca2ca0ba9f564ae2af4211514b8dc60f1a7e77715d27f3
SSDEEP 6144:phTeanz4miJ8FCt0WkL/75Eh6m7Rkm1tYpBeh2BAoD:pZncm88CkL/tOV9oBGcAoD
TLSH
T1F43412315DB93C7548F4572A725D7B0B2FB1A9A6D02CDDD590D62A0073E93CD4F888B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 e79e893b13fccab1c8a421bba770e3881f6cd2c64dca8dd1a47123c8190195f4
MD5 6d0f33fbe3b4f28dda4aea6ea2d8e434
SHA1 9c11742532affa01ea70e0f80c314cbc0d10586d
SHA512 f81d710208473e59e7d03438a4037ea98a2c04054a87dccee6ed0b9591b0decafd7ceb964372a5ca3037f1a3ef677853a7e1b953070bf58cb718c27357e27103
SSDEEP 6144:+zeanz4miJ8FCt0WkL/75Eh6m7Rkm1tYpBeh2BAoD:+/ncm88CkL/tOV9oBGcAoD
TLSH
T1813412219EB97C7548B45727725D7F0F6FB158A6D02DEED680E22B0027E93CD4B888B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 036c71a6aa4e1f2479314e0f3bf113bf0763461bf05c7d0c6bd14cfc8c7c5dc4
MD5 0a06724adb848d025323b536197f8edb
SHA1 2536c8a0be6ef1f79e025d61a0f17d4278f2cc4a
SHA512 d95c20cc083e1d058face69300ec4d3e0a80115cf1ab3dadb93781a12ff304fbea40c766991642f5df9c365c04620182bbfc026cb9a1307ab2f9000a6c832909
SSDEEP 6144:pzeanz4miJ8FCt0WkL/75Eh6m7Rkm1tYpBeh2BAoD:p/ncm88CkL/tOV9oBGcAoD
TLSH
T1463412219EB97C7548B45727725D7F0F6FB158A6D02DEED680E22B0027E93CD4B888B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 704dec10103df49791cc14146852844b400daaa1cd0781771f755189010bb6f2
MD5 9907534812150e4b74d1c858e650fa22
SHA1 a3cd000d640872916cd77d5fff67e349057fcfc9
SHA512 c3c64d89b6b0f47f78fd046402e466718ca4fe4af0034d5aea66032eb873b0b93621ad61a65bc103bbeb50c5fe017e761dbba273f4f9fd4559804c055dde0e49
TLSH
T1E5D08070FD1058B5D1377177116547000F5C4873015316DC6938382CDDF8885C8A1F96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06ef566c59dd5047533543ad480c80b6d704377ba15d77eff9be3ad6ba0f169
MD5 a6b10f025955386f7e4e5e58a0e1068c
SHA1 20d8e4dda07984b539da9759af6e94dedd9e95a3
SHA512 6041b870fed08395795db36d12062b72924e93dd0d212c15abc744293b6ce44d3beb6ca48467dfd6968bf054281581c73b1b9ad7c01d5158036fdf584d881a1e
TLSH
T166D0CC20FE808C20C02BB033208AC3000F0C88A000A300EC8838323CACE8888C0EA322
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3ae8ce101214ba4ab863e0bfb1a62a56c16a6a94c5654fa3a94f2e05c52bb523
MD5 ef94c27f4c79b97e2d49ca5404426069
SHA1 99a38d1eb255166b2dd0bb45c3acb6ccbaa7c3d1
SHA512 afa70079c4eeef0186e8d97bfbb8c9acaad2f3e1c995ef16e97acf59dacaaeafaf09f04573f592ad948e01528ca13837d29cb060770f82ac3a9ccdf7e0be4f10
TLSH
T102D0CC20FE80CC20C02BB03328AAC3002F0C88A800A300EC883C323C8CE8888C0EA322
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1a4207121c26360c38e2f069031be35652bd1412a3c65030f6a9c4a0307c4f1c
MD5 fb53bbe49966922d905bd21d6ad37851
SHA1 1f53457d4af9a09b4a7af66468a2e3184763a8f0
SHA512 df532c6e04d0392758c7ab1c002e43b02c126597885f46fa5deefcaf3fc2c58c20f22a8fcf4f668af3df7912d935fa9a13737938998e485cccd1ee4390c22ac7
TLSH
T1C2E02BBACD22E82B08FE071961545A47E70103766750684F3A3D820C8FF063A0586C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1940b9b13b42f273c30a0a3c5e5ee2117e56318e38356a8287427326de3fd677
MD5 4ca98e949357c5af091ca7653c446e42
SHA1 85da1fe9ce39718b3545eef8f965a2a28bd6ef97
SHA512 dfdfe1122f9b49724baee70f37ebef80aef2cbe0214153e7df8782faf08aba7ec766315dd835d1d74bb8088c673b20f3948cd9e4a1e3eca1edfbe65f35354c6c
TLSH
T19A61D6750A9312B1EF14C63294DD025D3773C6F7FA1B6E8990809633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583a93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583a93.TMP
Size 3KB
SHA256 53d1215961a1b4bf60be9f0610e3a94506260ab09a0d0165aff1f6fd01a40197
MD5 db2f1b1ca40c371c4721fad2307d7b8e
SHA1 f4d919cdf9347136223dee136ef920840409d5f7
SHA512 5784e30f725a3be1dff19e4056f238c5366e76ded398929ec67dc729c0f6dbcc3390830f1443a09b0d7bfb18665dec9755b15f4f28d51f1bb6a1c07e616f8ebe
TLSH
T1C861B4750A9312B1EF24C63294DD025D3773C6F7FA1B6E8A90805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

8cc6f160-3010-4324-99bb-bd9d7fe9c6c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8cc6f160-3010-4324-99bb-bd9d7fe9c6c7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 4937d22bc554b385c753c52edb284fdc5beb24d0817063a581b708f0075cd7a9
MD5 832d28206a30ce4a56dab69cc098f326
SHA1 f2ce2f6fcd4862278a680bffd992822cac51124a
SHA512 f36a1867108d07a04854daf5da144cd0e453481a6eeeab9e8946d78ac1fb2afc45cf8428aa5fdd491e42b574c6619a03dae1d05ff4049f1d16108088474ae28d
TLSH
T10EE0209956EEC21DB53038C792349758C3C43447F6C5AD331704CCC4B656001B387756
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 7194f5d83676809976c73e562eb2c68a7da2c323b5dfe2a30745e9120c956b94
MD5 4ef566c0baaee67c035eda3e7ba11c01
SHA1 56ad13819372adfc4d1ee124b91711de36021796
SHA512 dfe2b5bdb31418550463d9d64ace36c3b1b87272a8eee38d690b3cf88fc78c7762109c772d1244baa633ce0102911c9730b2b77ea67846b74c3a8b75b95308a0
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jvnW5L4/K5fKFtIeqYpz:Tyi+7f+UZD4jJ/BDWxYCKFOeTpz
TLSH
T1EDE2E08C3B11F512C4ED737EA0C2C6F09EBC686C878DB1B1923859768C52A61F49E51E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 4e719b16d4fc2f24bef04765ee0c42cd2d40a694b609372f96166971b504dc56
MD5 b412d8d377d27474e9a4f83d6883c80b
SHA1 4a3ccb6a9be193831ee9638f527e16a4e558c1e8
SHA512 267aaf3b56c993f2e700f498b9573407db119b898ae9dc760da1057943210a921c5126130775982ea7cc60a20dab1ccf0f098a592359defd5f5de195cb824614
TLSH
T141E0869846E9C22AB05478D7C37DD708D7D13447B6C879231709E8D47542A45A29B390
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir3644_1128182835\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir3644_1128182835\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 284ce86c871cec7af4fdb976204c3f77e2bf8abb5ecb75b0ca81d225f7b3e149
MD5 d86404c57076625a2701f80671329c3a
SHA1 fbaf2eceec73763d4b0b44b060c18d568146130a
SHA512 6b785cfa705d4553fde19dfb18ecfec2fb3911bd8678342a0f31c998f61368c028d8000385799bd600833724bb27064c8aadda8d84c2f2559b136e9f35416c3d
SSDEEP 96:QWRivWR/IU+bGz83uy3+u4tgp4DLjGQLBze9z3NxvWRkWRIjBHMsDEuspU0wbtqh:dPpf+G83uy3Ct7XBBK5o/SH7DXspU3iD
TLSH
T1A514330E5F243722CDBD417669E644B35DBDF03F8B5266C96C6114B0CEE3A52A02C9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5ea7dd11e4c4c6cc0699c92047ed1163d6a49ca6cdcdf0cab4d5e3d83dc2519f
MD5 8e13f97a315a7d7cfbbfd096fee32213
SHA1 901d3120b638459320ba81f8ef5fb253b60d62a3
SHA512 d08a065666ca76d586e55174ff7205120454d044198d8993a5eb2a2c1d749bc58acc297e470320613c8a1d5ccbbaa8430272c7aa32570e636c0487c6b293a8f4
TLSH
T112E0D86945FDC22D7244608FC329A708D3E03406F6C82F611B04EC84F186104A39B3D1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9412024831760afe125af07e8f54b2e3144199b79ffe1cbd84f2593f29f15f7c
MD5 acdef8c2a2a69cfd47b3d80cdb6a6e3d
SHA1 cb6a696099cdf442301da163f2625e23859e6848
SHA512 ad8b4942e86c65b1789c002083c17fce350abd5a093dccf694e0b4d61a6e5ad9b336553334b25abd9fd2c1a6ce6cd4f78e5e2958883f9a8fd5dbd728cd6e8bc7
TLSH
T1A7319DF7C3E4897E9A0146F0BB18AF1BCE2D0511931C3D5A85E4AE1BA3E34A5E04195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5980ac09e753a41a3d81280aa618dd437fa9f03cbeada88e43ffa198acd35753
MD5 b89613e2fbf18dc0a2943383ad64c87e
SHA1 7d1130162fc2633caeb4e3636bc397f2cdeddd4f
SHA512 1c26d7284321eb89d3c4d4ef69254a102382c8eea2fecb2c1d06cdf6e28c5585bd8476127fc596609d647c938852971856c1ac6743d1362762b2752b72b87a29
SSDEEP 192:sxZ9RfyM/jK1Ml8Hj7/ftsbHWpVS+wIVXEdpw2HW6+WNWV7nI/YPkjOVCIgyJ:sxZ9da7/ftsLWvS+wVvHbp/BFO
TLSH
T1C652C712AA34597BCCDAD20DFA55BF53D6F90532A2941E44A9FCDA1C04E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2fe7329125ee4fa0a3b70b110e2bbb2e028b8e2f4eebdf4304fc4c07d3f8463c
MD5 1446cd55f1f3a50df2899f55c687f225
SHA1 12830f2239270f674c4c3c121c4b5a83181b9812
SHA512 02cd566f534a325dc8a3c5a9f84f0a00c2f0408cfe24a62a346d669e350bc31aa1924cd5c19ab51b7344461b95e15021a292228724ed180dd49a0ed724bd7fb0
SSDEEP 768:6wseJQxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGcLly0pp9roxP:6wseJQxWvhfynu1jaFcL88p2B
TLSH
T16FE2FB2B280CCB7E4F844E6DEC2A6F966EE801CB57944D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 7746181a5c16f091aee47f7541754def998e8335d003ce8db3c17f83f85cd66b
MD5 996f3f8ec9c58d4bda9c4d1623f4abd2
SHA1 933faafb22ad312175ed4005a8bcf91d232f1a92
SHA512 5e6b5eb08ea6da9e9e75e0224a57d19ad9b32d5f735805ac9f447cc604c04c91ef241fed1b0c0c8cd6261199b14d65dc33a517d38e4faf3d443a75b05a1883bb
TLSH
T199E0261517F8C2BD711620CF4336C309E3F4746BE2C83D622F08E88871C2504B597394
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a5bf32a4267803ada152544901e632daf820e5de0a3c25d90a408d2da5a6e894
MD5 222a595936203f4f8c64d4b289f1b94d
SHA1 770a9ee01fa11a258a44a03a739a2f4e162e3d1c
SHA512 3e78826e51247264f1ef2e6ba469464ebd7fa78f759c92a1552c0f18ac355c8496f37c3f02c5c02b320c44624b41506980a9c33ee3f6983592400c144f1e5584
TLSH
T10FB012C6BB40911BC4CE8C770E848F41BB10E05215004603C814DF218D1A774BE418CC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 91fa86de6a4258e44404bcd97e03d0fcf3a98b5d7905df0c5cd88592371cf6f1
MD5 97eda1775f48f2c394680923907e1271
SHA1 8f4a7f312383973ff445883d67e80e774dbabc17
SHA512 4621d887173668683e793199d06fd02eb4a4dfe7b238ae696700c8506a1f6881a245b2ec99cb6948d4cebbb4fafd272b44acb95595c66e492401fc640d164585
TLSH
T136E0D8253AF9C32A715620CBA337F309D2E2B496E6C86DB16B0CE48472461407287250
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fd4c8b30aa1a08ff92724bac92cb6469fd052d7fc7000b1fb7824b8bf7bbbc24
MD5 75c134d85ca4b844b811771811dca92f
SHA1 e0effa83c6845df2eae91a87fcb5f891a4973118
SHA512 df2a1fc01574c8cc86c93010a370df385dab17ae5fdda0a9c0ecc3145d02b13f81d2f323357e00f290e701f7f1f87359cb20b1e4df886da7c3f8685f989d5f6b
TLSH
T1FBE026759AF8C339715060C793BAE70DD3F07816A3C83AE2D7089484B141501B2EBA90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa35af7d104ddfffd86841ec96a9e64362a10a17d17bccfa6f88607830c2f367
MD5 e632ac3543d99024be9fa27e821fd45d
SHA1 7ebc88b9324ba9eb36e622e8f24a35eae4bb2200
SHA512 17d78e6fbde6d8950cbf8f50ad823c1cc9e2da77f71ae983c152e08774db771c9018d65457d08a0d9f7ef5a3adb23c0c59081e661d598c2f6de138088b5b58ce
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EM:KYHIhKggkXySdIxK+cMjyB+InKDq0vyC
TLSH
T105917706357B12033D7D284CA292A5765E4131A37468B4BF7FB850A19E66E210FFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 45eb1f6c42bde886e8c800ed9c7f69945fd33091f3f020a834295398b5b02b40
MD5 4a06bb608627eb099db3192f45f2a7c8
SHA1 9df3256299c616714c79505b7de42206c29dc501
SHA512 0dead2f0f785b8e9b4fb4fbce46603416b96bcd62d859f11a7be8b743a9c0e68f26fb75e5b40aed3ca0214d1f9342157bd60d7aa311b4150f9c5eaf5c311de6e
SSDEEP 48:KYHIhKggkXySdIxK+cMjyB+InKDq0vyxqI/KnqA20U:KYH+KggmBd+K+cii+wKDqmCqEKnqR0U
TLSH
T136B14006717B02033D7D284DA292A5769E4231A27028A47F7FB850A19E77E210FFF9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d11e0dee8e5a981fa95d3b573a5a8fd902f7988240fba203435d71772eef2d02
MD5 f145589319de41ff8f05b8e85e27f6b1
SHA1 c01daf3bda5c100dae8c03e9ef0b7997b11acd75
SHA512 5e6502e45981212d7121b4627183c90dcd6484dd530440e070fb5fece0b0fdc575b951c770ae8d01a049f1b9fa3a6f1767fdc2082bd132f263a39837ef67e8a7
SSDEEP 192:P+xWjYwfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxI3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T11A24640A7B747001EDE6DD721CB080771A3CB16DCF22A6915DB664698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 09e772cbcf94099dd6fe57b94a1b434924de3c2eae2af80122a3435b9b766537
MD5 271ec19ece98d52d358e1b4e53c45923
SHA1 5216a1263535a6b5d580a8db9b77339891eeeb66
SHA512 2a8a51522b6bf4e690491054073b8c944eb5f6c0617d1e4e09901dfc03ad502d3d5888b31b572f3e572aea12ce49ac821e4985e8e8ff9e29baa9130d02765653
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:DEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T14252879BEE342212DCEA83318AC001E17E7A903E8FC1EB0254D610211FB4691A31E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 77d4315932e3c138f80e9a41ae8c19d4e5e4b79b964115a8a220df08de0f255e
MD5 8dcd3df4273975eb4a650f30c0af1361
SHA1 97c929dcf6d4d5063c4117dd2b074398ccd51d0c
SHA512 1001fa1de6d784a5ba73295f456fd1ecf118bf4356511b8a1e7684b1eb171ebb830780159d2279ac578ea17aa229a5fa64fb9932da7c7ea72a4f4ac57a0d0384
TLSH
T1BC210CC5A3FA20967FA9B941C22B6403E8E23E65251D5C72221DD4F84F59C340FAFAF1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 08cb6680185c3110c4e74b8b327e139a2fce67e27a7e60c893a5e13550ce6ed7
MD5 319f21bed4b46490e7136dbc2e935505
SHA1 f17a6668b6c5e54441bc37f6d81ebf3dbf9b53d8
SHA512 00accba1a9fefe566c2084d23e9d22c2fd2ccdb099968004d1655bd159ef64be531a9d340a7e9295f95cd447607ffb151e3d8ad1afb31c153fa40bd4f8ae9931
TLSH
T1A3E02694EBF8C36FB05870CB9239C308F3C03803FAC829261F00C4C9B443500B2AB291
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 610B
SHA256 37294b30ee0180da6767e5b003bd567befa32490c6fd3f72fc876826987032a5
MD5 97b0ca100bff7b8aa9045aff6e628395
SHA1 4460e18698a4511a20c1c846a6e5c659216b38ad
SHA512 4626345ed03c4c9b041ab7fa0622b14b681121184104ae96345a9be6ce1e126fdf413e3ff4d514342a42f8487f8d33dc82fbf8b54d0af567f3e907f207a5eb1b
TLSH
T19DF03012F328C108D04A823EA43B87362338D8579FBCDD0F447A34256E76A141E8F7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 0bf5515d905e07ccfdb1f1e07341659b8aee3733fe8b16707547234fe2173965
MD5 33e89423b2dada4cfd5dee7468aa53d8
SHA1 523cff8bd7ffbd0786a691298e93a3698a2dfc83
SHA512 c4f3a1f4950b35ba2665a3e029560e452d1c73468e12e46963299db9aa495beb67cf2191cddd0abb63059150a6a4ee9457ff34bfc39ab1f1243d485c05678297
TLSH
T187E0DF94AAE8C3AFB01470CB8379C348E3D13803FAC82E221F04C8C9A543545B69B291
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5928db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5928db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 81ee479bf36d3d29fad20aac649749c049bfc268a5c50c29e25801cee15c6f4b
MD5 a831275ae0572fa36e6e150a1f54b9aa
SHA1 701e16e8222f339b5389996cfae13604093e15c2
SHA512 76f52e539a7765893c538baaf5be9dbb64c1a3b8816cda86ee89e61c8002dc91364f400689e1849ff68405a2a05662c7ebe64c9912e64993301883c4f70ac55d
SSDEEP 768:zFsjZb5PwgKwx6KVmjz1Wo6idzicLTx10HZa/A44MUr1W9t9W/5+MPwe:O1YSAz1FTx15444MhAx+eX
TLSH
T10C2328F598D3897BD89E93C3673E6E425ABCC163B5845994BBD8690CDC870BFC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 98ba045c92d44dba1f2b968fa08ec12256cb12b23b3ddd8cfc0b79166cca63ab
MD5 09b92d724b746fb9a5512c31e3cb34ee
SHA1 c01799e4e19f03d4ff81e772b0641e13fdab580a
SHA512 31fb0062830bbfbb67cd7aeb26d24ed70dd8b4ae3c1e03e90e3878d44809726d4fe5def72f5c24d4ae2c6ea6a4f7d161f4437275c05f471555bec7d61cabbce3
SSDEEP 384:n5tNnNnb9TsNttn78gfWWzFIKPl4YDdS51/7IzHoe:5jZb5Q88Fxl4YDAe
TLSH
T14F724B716C345DA79DA7E956F26E27033FF451BB91C42E90EAEC2F0E14C615C230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1dd8e5b412c8396bce8f96e5d1de205b6e25107f57ea4a113044b38c2ecb3d8f
MD5 d171b0284bd9043b51fdd633fd0ac8db
SHA1 1cd29980409b17457f9964a345140c01b73766be
SHA512 eb958f576ccb94972592ffbce05a03cd71c6db0c1d03002daa2da5623ca20f7e56312a1521bd4de886b1396573476779caf17a5aced66cce963f13c42af4e225
SSDEEP 192:lONG6vMtPQmiUyTGThTobWCIKp847vLU/u:lONG6UtRJTiFIKRTU/u
TLSH
T152021836BC785C7B9AA7BE45F48E23131FE4217FA6905B40EAE82F1C00D765C2303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 438984162567f30f7211821138830b632a227771d308705657a2d8aa33b301ce
MD5 743ff2343c16b2c096efe6c40fd66999
SHA1 2b64b8294247ebd5a130bd4ee819ef03c74edf46
SHA512 8352c68651e3267c75d0157d3a6e227946593dc75a94e3aa134d63f6778f20c3c3a9b87869010d2458cd20f1092637a3180202e240bef85b1371e8522feba3ec
SSDEEP 192:uucLsNUxQtjM7k9gQmiU1RRJ4MTobWCIK++Wyic8z1a/Nyd/Z:n6sNUxn78ghWzFIKPlA/d/Z
TLSH
T1FD4219717C798C7799ABB146F08E33135FB410BB96C45F54EAD96F1C04C629C230AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ff83437ffaa27d50a9ef1645be9460d2dec76d13eff7c9c14bae1d30761dd922
MD5 cc56ca7c126993d3d97f97b5eae7302a
SHA1 ab3687b3376b2c1171434820c19357c6ad51ee2e
SHA512 ec4d2b1f710d629f979a8a89d3536edd657d8c125fc7f5e999912e6f51f4d27b541ec9caca6919263458a0234113699bbf7fe6c9917288e14353ade3844fb7fa
SSDEEP 384:nUsNUxn78gnWzFIKPlAkFASj81oM5mkcSd/Z:UB18FxlAPSHM5USZZ
TLSH
T1AC821BB1E8644DEB48A6F5C5614AF2132EB4413B968C4A5CF6FC7B3C309F5B85302D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 186bcc23e4a137235a8b89c6b8044766867bcd747fcfa4ac610f178f40be767d
MD5 7c9ac95df9e38aa5f816ae78b71838af
SHA1 190216266da92a7594b5c65a84472636933f170b
SHA512 2699a28f1cb209c56f078a478b27888cf453c8eba09f75d56f13121caee4305634469c13a2c14084434f54f1c120cacac059cf32074a7cb13938dea262ce54c1
SSDEEP 384:nUsNtxn78gfCWzFIKPliYDdS51/7IzA/N:UqU8FxliYDAN
TLSH
T1455228757C785CB79DA7E946F26E27032FF4107B92C45E54EAE82F1D04C625C230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 98a1d728900d6fb38a2cdab0a9d6961501d49de6c4e6cc2c3f13d11ac73ee7c3
MD5 ae393b322ae69200db2908c2d67d4b89
SHA1 4d62156f4869ada53ba00815fdb9e5bc68c2cfcb
SHA512 2060e77ac8321b462eb7259138c6d97b450588a0296f64ebdd343223328867845c009b815e9533e080f31bf5f426edf41ab0bdc3a0cc0c59b97e6ec222552c00
SSDEEP 384:nUsNUxn78gQWzFIKPlAkFASj81oM5mkcSd/Z:UBS8FxlAPSHM5USZZ
TLSH
T1A3822BB1E8644DEB8896F5C56149F2132EB4413B968C5A5CF6FC7B3C309F5B85302D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0693ddab61624dcd175c6718cf92f41442cdbae5480eadda99451741494e3ff8
MD5 e8e130a0c4a0c415e46b2a04cadba66f
SHA1 dbc1305d08b4565b485209b65731515e3bdfb0ab
SHA512 475c9a6b2afeb5a9e65a5c11401e42de3d9d2aa98167ed53e1dbfc4aa030c9685cae1b1fe0ad4fb09e29ad2087a4f0f2c574fc8ff3e8e8c9cb580cd97810c0c5
SSDEEP 384:nEtNnNnb9TsNwgn78gfWWzFIKbN3xA/5+MPSDS51/7IzHoe:EjZb5a88FJ9W/5+MPRe
TLSH
T116824A71A8254DE788A6F0C5A25A67033FF4057B86881E98E6FC7B2D209F1BC1347929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 903e9211e766e691bfeff684be7673c9b002fd2bed3d20f03d39241285ab0944
MD5 a2bf4a23e5b6d20e467364bdd266f8b0
SHA1 789f6963c49b410f3ac164edf633061843dc6e55
SHA512 05d0903d277fd17c6d8acc9574a8dcb4b0d1b293cb8ef6f2747435ce0fb3224cd0a7aecb05796f210377e6f0e05e6bb6a85e1bdfb059493c247f4f3c0cd1975c
SSDEEP 384:n6tNnNnb9TsNtgn78gfWWzFIKPl4YDdS51/7IzHoe:6jZb5j88Fxl4YDAe
TLSH
T198723A716C345DA79DA7E956F26E27033FF451BB91C42E90EAEC2F0E14C625C230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2934d23be791a3ea91d73594a561ee715f8e07eb403cb366ae372219afe94b2f
MD5 09e39de28f600040d0c5bceb3b0e3585
SHA1 d8b86df4cb34f4dcb8c80acd8a92615ae2e4754d
SHA512 8ba301ff7dd0bcee10a37ca429071ebf1e984000616fa32922b3172670c73d17b299366bdd7468ef71619a32074dc17af84e514bb0949cd11e21c995a4bbf93a
SSDEEP 192:lON16vMfPQmiUy2GChTobWCIK++WyiG80Ia/NyU/u:lON16UfReCiFIKPlO/U/u
TLSH
T1341219B1BC699C6B6DA7B055F4CE23531FA421BBA9809F50FAD82F1C04D725C270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 acb0d3c4423d1054ae0ba506b8e42f4a0c0f15d44f6e51737b271bae1d239ca6
MD5 50c61d528c99531329b5ba312148c0e4
SHA1 436f6f9a473ca689d3448e1d7046236fefbbee95
SHA512 1b4e40789605fdf743f2e122cb6b5b242871fa58dbf52384c4280ecbb388adba8ae8e44141129e7d15365822ed7c564d17f33b0a1180b32560c407706a02055f
TLSH
T1ECF05498503C1C81F4C03D39E032DED9F2216C98BC01C32D544C7C52C8566724406B1B
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 ad62618694096eda09fec5152ea3803293953d9f5ed1c99887e9db0fec6ee49c
MD5 e3f49386c41e536db3f6da5a86cc6613
SHA1 def6ebc73d628cfe9be95ecbdffa10edd5694750
SHA512 7b9fa3d7dc5403ad55e7d8385e634eb50287e8c80b6a2cb52a57b1a1b0aaae5c6c608ebc581dab2ecdeb0c232e53035c1935e7d803a18604f38b63294199488b
TLSH
T11C516C8DDF0C2FD6F076CCAA28E0BB320DE259D6E0905CDD08D46C13983EB95898206C
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 832ff1479203312927bc3acdcb24f41f706ae7757646049d254d6f3f7c0a6439
MD5 2cadb9ea64ea85945c677c466c515204
SHA1 68a53e19b02ce79abc930067af2f6aa590207c28
SHA512 5a80cdab17cd6811806fde7f3138192e270e00c41c49e35971388adf65eb8db321ecc144b83a3a9ee90f343ea45727fdab95cb6a970b1f9a9d3e3350a33b8e2a
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgf:T4/IHRH34kWqB1kQnjhHmr6ITmUr
TLSH
T12123996EDA2CA9A2FEE40B3DD7D1D0127B35A60EC2E4C9F2099B506747C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 4KB
SHA256 eb5b212a2c795ee205e9aef0ab3bcaa04ca3d0c5f9020f512bddf800b1cf7b63
MD5 675404432aa35aebd31143a100cb9f6e
SHA1 63ef0813e9153e804a3929d92060fbde25f2ccb7
SHA512 98eac825cf16b565f802fb08fffce26b96def10c11c321817fd63c6db606c5505ac67da05e26edbf39ed1aba51e21737c5955be45cf5614c7ec6f99aa3391ea9
SSDEEP 3:xHlFllQ/8QuQll/lKse6SlmgcSFYojpuyOV9RUIU:xg/ZlKse+jGy2
TLSH
T13191128226009CF7EC84373F34C2009AFF725A001E81E805407498D217856047A4892B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b7298e9054025c0202fdd66f2fa10ce62946179ff5b0f91c3de1c1b2eb4cc2b3
MD5 9f056ac814760c83b96511867bf2e9b2
SHA1 c85de9dddeaca14337296ab9cb6673039af6020f
SHA512 29d66b6cdb5e62ca3252120807833adb23d1d07abd28b73ea342398a92e9b62635a97c8d9614ff8a16dddd4d855ca89bbaf0a6a6aa3264917b37515f5893d46b
TLSH
T12241E548B6E9114CB3B77E9A9BF664AD487BBC372F0AD49E10110E4F0662E41C962737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 c46a3b039453123faed8f739642281beedf5da14ce40f8ca584ffff0dfa25d61
MD5 475cf524d029aed605cb37115caf4c20
SHA1 096636f0280faec78138118033f0aff15bc5f887
SHA512 ea739a85abac495d1a824c7c9c4235395c3d8d6a0f5a29a6c3a01c62cc515a36b6fb3b4ae9ddd4544afc324c23e2581000b50c2f924acd8485b78914b7d2d71a
TLSH
T1FF515F58AAEA1158B3736E5A5FF768AE847FF9733A06905D00110E4F4A22B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

baf7f670-67a4-4782-b036-3826aa13feb0.tmp

Path C:\Users\Admin\AppData\Local\Temp\baf7f670-67a4-4782-b036-3826aa13feb0.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 468B
SHA256 dc23270b4cda07cbb4c8c5e8d2b6b8becfcfe482e3b5f70af5cb3df991773a2c
MD5 4dcb3df507264b69b6e742b064017e85
SHA1 6abd22700c67520abf4fdcc33dd667da7274f98a
SHA512 7d2e01182f099ddfa79bfa3df1ee4df1452fa1b09382c3a0a9a96064b7eb5d5c21bf750b97f5ca292c50a482cf9b1c72f0649a7d7712b9dabb03c22063cca2fd
TLSH
T1C8F0E2E47626333F07931BC8A0320C906490E194233F9EACED5A8034FD6CDB0932A7C6
MD5 SHA1 SHA512 TLSH

Submit Download

ee9f5493-b29e-46d4-8122-b29026fe0d97.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee9f5493-b29e-46d4-8122-b29026fe0d97.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cfc065c3-a508-4d8e-a8e5-e8ae376ed0ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2100_140889510\cfc065c3-a508-4d8e-a8e5-e8ae376ed0ce.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3644_1949635280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download