37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c

Analysis

user interaction
yes
max time kernel
899s
max time network
897s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sad.zip
Size 23KB
Sample260522-ezxt4ahs31
SHA256 37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c
MD5 38bdf29a2c9275fb68ae37771ac6b6cd
SHA1 b6b944585bbd359bf798dc7b386a73bf3606790f
SHA512 f101865ee644b5ba538caf9ab6810713a8d33d40495a1d1b6255ff8d9d7683709193c319c7cd5c680f2afb9eac8f846b33c35fe8dddef169c44911dad300e966
SSDEEP 384:Q5OkPtEuYgunMgP4nJ8xev8F411zQ7GVpp+dRl7ueZohv/5Le4jIyZuizHWYgHlH:Q5D/yfP4nmxev8FoQ7E+dRlqeZoR/UO8
TLSH
T195B2E0049D1F259DFFA6D67DAEF3595F060805AA0EA0766E521563FB0C18BC1CD32884
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
313	5344	msedge.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rTDxrddYaSeVILqiWFRAf\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\rTDxrddYaSeVILqiWFRAf"	kdmapper_Release.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
102	api.gofile.io
104	api.gofile.io
148	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2488	chrome.exe
5344	msedge.exe
3636	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238974563374903"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{63E822AA-F3C6-4C06-9B78-EB489D7AE899}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{AAB4364A-8C2E-4DCE-8A37-56DDF8F6894F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
436	chrome.exe
436	chrome.exe
2924	kdmapper_Release.exe
2924	kdmapper_Release.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2924	kdmapper_Release.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2924	kdmapper_Release.exe
2020	kdmapper_Release.exe
5452	kdmapper_Release.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3084	3252	chrome.exe	104
PID 3252 wrote to memory of 2488	3252	chrome.exe	106
PID 3252 wrote to memory of 556	3252	chrome.exe	107
PID 3252 wrote to memory of 556	3252	chrome.exe	107
PID 3252 wrote to memory of 4296	3252	chrome.exe	108
PID 3252 wrote to memory of 4296	3252	chrome.exe	108
PID 3252 wrote to memory of 5016	3252	chrome.exe	110
PID 3252 wrote to memory of 5016	3252	chrome.exe	110
PID 3252 wrote to memory of 5636	3252	chrome.exe	111
PID 3252 wrote to memory of 5636	3252	chrome.exe	111
PID 3252 wrote to memory of 1056	3252	chrome.exe	112
PID 3252 wrote to memory of 1056	3252	chrome.exe	112
PID 3252 wrote to memory of 1096	3252	chrome.exe	114
PID 3252 wrote to memory of 1096	3252	chrome.exe	114
PID 3252 wrote to memory of 2148	3252	chrome.exe	115
PID 3252 wrote to memory of 3196	3252	chrome.exe	122
PID 3252 wrote to memory of 3196	3252	chrome.exe	122
PID 3252 wrote to memory of 1688	3252	chrome.exe	123
PID 3252 wrote to memory of 1688	3252	chrome.exe	123
PID 3252 wrote to memory of 4680	3252	chrome.exe	124
PID 3252 wrote to memory of 4148	3252	chrome.exe	125
PID 3252 wrote to memory of 3336	3252	chrome.exe	126
PID 3252 wrote to memory of 1844	3252	chrome.exe	128
PID 3252 wrote to memory of 1844	3252	chrome.exe	128
PID 3252 wrote to memory of 5512	3252	chrome.exe	129
PID 3252 wrote to memory of 5512	3252	chrome.exe	129
PID 3252 wrote to memory of 1940	3252	chrome.exe	130
PID 3252 wrote to memory of 1940	3252	chrome.exe	130
PID 3252 wrote to memory of 4376	3252	chrome.exe	131
PID 3252 wrote to memory of 4376	3252	chrome.exe	131
PID 3252 wrote to memory of 1908	3252	chrome.exe	132
PID 3252 wrote to memory of 1908	3252	chrome.exe	132
PID 3252 wrote to memory of 5312	3252	chrome.exe	135
PID 3252 wrote to memory of 5312	3252	chrome.exe	135
PID 3252 wrote to memory of 6076	3252	chrome.exe	136
PID 3252 wrote to memory of 436	3252	chrome.exe	137
PID 3252 wrote to memory of 3764	3252	chrome.exe	141
PID 3252 wrote to memory of 3764	3252	chrome.exe	141
PID 3252 wrote to memory of 2068	3252	chrome.exe	162
PID 3252 wrote to memory of 2068	3252	chrome.exe	162
PID 3252 wrote to memory of 3464	3252	chrome.exe	163
PID 3252 wrote to memory of 3464	3252	chrome.exe	163
PID 3252 wrote to memory of 4532	3252	chrome.exe	164
PID 3252 wrote to memory of 4532	3252	chrome.exe	164
PID 3252 wrote to memory of 4104	3252	chrome.exe	165
PID 3252 wrote to memory of 4104	3252	chrome.exe	165
PID 3252 wrote to memory of 4600	3252	chrome.exe	166
PID 3252 wrote to memory of 4600	3252	chrome.exe	166
PID 3252 wrote to memory of 3224	3252	chrome.exe	167
PID 3252 wrote to memory of 3224	3252	chrome.exe	167
PID 3252 wrote to memory of 1784	3252	chrome.exe	168
PID 2192 wrote to memory of 4688	2192	msedge.exe	182
PID 4688 wrote to memory of 2348	4688	msedge.exe	183
PID 4688 wrote to memory of 5344	4688	msedge.exe	184
PID 4688 wrote to memory of 5560	4688	msedge.exe	185
PID 4688 wrote to memory of 5560	4688	msedge.exe	185
PID 4688 wrote to memory of 5560	4688	msedge.exe	185
PID 4688 wrote to memory of 2392	4688	msedge.exe	187
PID 4688 wrote to memory of 2392	4688	msedge.exe	187
PID 4688 wrote to memory of 5028	4688	msedge.exe	188
PID 4688 wrote to memory of 4888	4688	msedge.exe	189
PID 4688 wrote to memory of 4888	4688	msedge.exe	189
PID 4688 wrote to memory of 4888	4688	msedge.exe	189
PID 4688 wrote to memory of 5028	4688	msedge.exe	188

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sad.zip
1⤵
PID:2328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdf613c728,0x7ffdf613c734,0x7ffdf613c740
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14508108399763435179,10073713488698699243,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9031093529017503262,9926773359856954627,262144 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,4499516284578308078,6320072411769764901,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,12117573346582463505,14094696301517164810,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,5140732939205743453,8650654100701234321,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4356,i,8445805042153230857,13522643985708294568,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,4021420260611598039,462824689903034129,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,17789817101040485504,4718862341121643261,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,4213733132648524025,15607054597877829585,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4756,i,6349673402989959389,12988014941218116367,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,10779647862763508594,4336791329671532868,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,15875536479504085183,18440235778083817326,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,4530839495847567077,1388464710934290471,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=864,i,15746145107499539312,10334568340490766802,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3280,i,3159379475867701165,7022153190547511189,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5900,i,4950566757926198197,2648165015131647855,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3716,i,9575284361628099991,13638029579547042986,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6080,i,3992195432248174655,18325862387707928937,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5888,i,15279781737153448937,14561468314281747791,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,17862502808436420311,1795571463112126630,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4808,i,15142881632382231514,17882208680783353818,262144 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,14273196543892855216,682180003750973968,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6044,i,2964889236828402396,10654817088581068271,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6436,i,16219468063720357974,10818596145742489709,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6052,i,18387305121315827057,17223602306976253422,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6000,i,11662045488771049814,11877561522986008957,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1216 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6184,i,9324856905070934865,6053342936707839184,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=1520,i,6170107519466506351,8266271145502671946,2097152 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,11167723766224712065,16110573152075395884,524288 --field-trial-handle=1796,i,11631791385002709125,3432184322953282974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:1784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4628

C:\Users\Admin\Downloads\sad\sad\blood-mapper.exe
"C:\Users\Admin\Downloads\sad\sad\blood-mapper.exe" C:\Users\Admin\Downloads\sad\sad\bypass-b.sys
1⤵
PID:5300

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5328

C:\Users\Admin\Downloads\sad\sad\blood-mapper.exe
"C:\Users\Admin\Downloads\sad\sad\blood-mapper.exe" C:\Users\Admin\Downloads\sad\sad\bypass-b.sys
1⤵
PID:1176

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe"
1⤵
PID:6116

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe"
1⤵
PID:2376

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\bypass-b.sys
1⤵
PID:3468

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\bypass-b.sys
1⤵
PID:4980

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
1⤵
PID:2612

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\bypass-b.sys C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
1⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7ffe0287c188,0x7ffe0287c194,0x7ffe0287c1a0
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,360114764075016868,10434168601490602522,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3803556546065573916,7285983790678196413,262144 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,9948904889408055819,18387012330723998514,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,3057770109089719376,7446336462443200452,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7522562799226388027,5244950317808801057,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,14131642392001505415,11709307885982836124,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10266227412171793963,10686538022715693686,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,779880357328242724,3437747646021245440,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7222664133099490121,8665998509661389272,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7222664133099490121,8665998509661389272,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5184,i,17439851331148484092,3123157714728656324,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6564,i,15879588345420422692,410996380037810244,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6412,i,1752484721955061203,15334254092191976670,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3468,i,6071480234304030341,1847543650233373764,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,18286773423970445487,3788798634569252220,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6736,i,1742066963898632412,14995690844202885718,2097152 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,11478545512464495543,4695130305433469123,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,12421490198239611159,10826214608050067420,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,1647283234385505684,10045265208366319192,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14291340766836332705,4408054556155409571,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:8
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,6527354526810246526,3476531071876915501,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:8
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,11103478773845138652,13114438989652596816,524288 --field-trial-handle=2308,i,17009251619006399548,12139370438361225350,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0287c188,0x7ffe0287c194,0x7ffe0287c1a0
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13980583299744440515,471016589304452416,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
      4⤵
      System Time Discovery
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,9877639795074319890,6978698060220631617,262144 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,14205210543247161167,15327534366160391377,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,5480979616896529809,17546556035433951491,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,5480979616896529809,17546556035433951491,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4840,i,3018895246077813893,8301132223768249548,2097152 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7796464318472735647,10580886096085495198,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,870279837994677895,328415526031569522,524288 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5576,i,14470303301669808512,7649619938075039661,2097152 --field-trial-handle=2412,i,15710680182356503337,3266344679637183983,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:408

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\bypass-b.sys
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:2924

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\ntoskrnl.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:5452

C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe
"C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\blood-mapper.exe" C:\Users\Admin\Downloads\dfsdfsdf\dfsdfsdf\kdmapper_Release.exe
1⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d7bf24c4ec6ba45aacda1fd1438f3f6b0ff37982d5e28d0bc24584b2da62bf17
MD5 a155b748cb6e9b6003f709d78f375995
SHA1 eec9dbb609158995ebf6c1cba9af672ac7af0714
SHA512 fc08b5a60547ac30e8468425256e7fbac5d8366efb7cd3b25873f4fad65c5bc1b47c364ce1ee2e5c7afc2950334a051403ffc08527a77afac4926bfae4446f56
TLSH
T10AF0F4AAD921EC3718FC0B2970545B46EB54135B3B80888B3B3C860D8FB563B465681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 67KB
SHA256 8f9a1d2362f66337acbc53b184b0d2357181e528b07deda233bb523975d7a150
MD5 ff494801761ad6200f0dd1ff4a1271c4
SHA1 35f4c6c2ffb330a8f4b524fe605b1e5095a317c2
SHA512 685c2aed797913d1262e8884976fbb1326bcc71936e39c08692f0e0bf6234dbcf0881e30b62732d19c6ffe7935effa819f16ebd0d0ae6f46803fad2a802186c5
SSDEEP 1536:CMZwRZMNj/XLaLeY8MPvAXlkV/xEZh+HfkeRt3nIyXs40eM:YZMR/z6QXCPEAvjs5eM
TLSH
T1EA6302F5BA6DC5AE730A0D76A5CF8003F87A6697223508D58883D13F2DD1798BD602C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 26KB
SHA256 cfb5d4507523aede2fcc838704843a673ff116db5711e529ee8244a9527da2ce
MD5 9bb599ed87050effeddc96e2373835b6
SHA1 9e78953498454b6e0d332529306a14b0176714f0
SHA512 b266314fa6495dd5edb91209159a3bedf862409ba07a50a2e902f9b65be6994f88cc8ba3d90f5b145cac78cb971afc8a55c8a9b1defff6fb6f7c8e1293a1c132
SSDEEP 768:xmV20udmvQ6a6UTWo467I+FJ4IFCun8Kr/ZA:x5o8C679JjT8KrRA
TLSH
T116C2E11F271AC18ED22FE140B11ECDE2B3571E28AA28CF5033D5B9DE11991DC0696BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 30KB
SHA256 e5c08777ce33ff034fdfe72bf308c7a1359e994a70af188f2f920669cc62766c
MD5 ef6ebe949bff0c57f67c60e60ff9f802
SHA1 2bbc13594e358b6b63cf7fb06fc989b0ed588958
SHA512 bc387784e1382feb2657aeee05476c5b01df2bf392a042b4749159047f6978dae5a677b92b1cd0b41e96d774f1eab1ae8ec18da313a39fcddc40ca9be0544a92
SSDEEP 768:oL3JVr+GxKnwJhQGp7lOB4AI+A1t3YK59Qi:o7OwJ9hOB4AI+L89Qi
TLSH
T168D2F12924E9A07CE4B1F1030B7998DD5FCF96000332019EA653FAF4535B87C67BA4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 153KB
SHA256 1f0189e087fcefbf654fad74a3a06668b782c01353a61d5c0b7f0bf23e33c020
MD5 237f4a0afbdb652fb2330ee7e1567dd3
SHA1 69335cd6a6ac82253ea5545899cccde35af39131
SHA512 27e8e1f91507179c207f93a19485738ed5d372a977eb27d44a4ed163013097d38b117c7a5bf4336ecc9862ca514d78ffcd2b8a07e304bbfe1b2cce9c087baa38
SSDEEP 3072:Qeqp46DjdHdb7UT/IGFc27+78oGmfIXe0pGRDH9tQm1pbYqup:Q16n/IqpoG2IXZYTtxrbdO
TLSH
T15CE3125BF5E6DBE5525E6D64FB5478972B1030823EE11CF12CE2206EB889317399E08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 115KB
SHA256 c411f11975d26eb04cd2aa3c071181d4b18e489f1fb97060d4176a3531dfb36e
MD5 715d593456fa02fe72a008a72398f5be
SHA1 e948290773216dc1b50c2121314a8cf918c22b54
SHA512 1f63209c93a462c2690442c9cf1c3e5a67f2df7a67dfcda2cb81292a2dbb90641aa0ab81c25323a1f2d9f0fa09b3421d136ae5228c47e581c51912ba284de46e
SSDEEP 3072:3wqMZaMDlYfb+t0YI4WlLL7rE2ZjX+B+pdJpimtm:gpZNYfytUxH7rnZj+Szpiz
TLSH
T171B3137922E526408E9D0E3BBF7B6A6EC7F8719DDBD4C10AA7D18469001738ED8D842C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 db50307366ee43da4d5d2546f2fbce1af7762401c8f0ea9878ea610b6c79b091
MD5 da7a77c16a8e165f9fb16e70eec7cd3c
SHA1 791d21b55e775df7bb0a0c8d3e34fa9190b15415
SHA512 b57935dad44c1a32454bba949c1372f3d430fba4f6f1a4f7fb897d8b1678473622f990fb4e2d69b133a8bff61d47bbc5f0e00b16187f1c87c5e85d6cbc09f4cf
TLSH
T1FD012B634495D2A5D3517E3892C9B56C3DBB576800173D167096C7F4A125F84103A32D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 a24959224d2ab192fbcf11bcbec7112542cd53413ba3b7f26374de7fe84ff60d
MD5 14151316eaaa07e69ba85d595089a8bf
SHA1 c951ba8381a2d322c7b45f88d939f01523d3bae3
SHA512 b3eb519ba05fdabd4c863729adebf2f575e453a6f5c200657de9c7cad33fe53423b562db77cd97319786700b3110a345fe76dd952e086ab28985dc09cbb473c8
TLSH
T15601AB2A7889F2A0E3423EF492C9B62C303B376400031C1520D2C1FF5510F80000D32D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 2c50290a2f20a9213311583444406a8bb56db72ef20a80f93a9d749467ef7795
MD5 952a73009ca107da6afe21ba4024693b
SHA1 4cebc29f571c66b43c8f61ef4c04c0f974b63dfa
SHA512 eb4e24c9bfee48e07cbbea91d70582ea0e48d0e8c194cf0e0862a143715fcfa456feaff4d3cff278e7cb6a8bcc7fbb0cf9b33c191d227fef26166358b643c4e3
TLSH
T153019ED2C4A2F2B2D3E017F8870561BC61679795400105166644D5A474384793047B3E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9d6fd805f29c1d8536d48ddeb3d879fe6e752239438a1d5df4c4cd9ced6217f0
MD5 4bfacdda1556699242a6d6fd7179c153
SHA1 d39271e31765892b7aa30596531e5a5755f1a6b7
SHA512 3ac6ee940d69f64945e639ecf734dc55105196ac983b1579ec0b2bb2ad3b258630a77fed60f809680479d2edf28d9435b6716b307ac121fce84104b0a5a2ac6f
TLSH
T142B0121320924013C74113B01441200425250A6D1142030A80D0C85540377A0A00D102
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2a486fc2df62da7a1ab886dcf81bec941fcf3d33085f0ea5b34e719fd4ce0e4b
MD5 c6ccf4372d2d286d246fd0ec9e38fdf6
SHA1 2d9d7b2e647713c8f5eeb4bae04499f4c3644878
SHA512 3e767793a901b1786d3368a0b4cd9261276335b194718344b55536aed810dc1a19d5b8ec33d943e811622697c534ddbc5b7e18f7633ef6c2c4261a6fbe897720
SSDEEP 48:YALlqYqOqshSmhe82CsrRsafoKsFXLshgmzsCW+sPjhhnONgfsN1osg4sC7SP+pS:DBh1HknFawSRjhnmQC7SP+KB
TLSH
T111819DF3D3E8866DC91196F4AB156E2FCD290918532C3D66C8D4EF4B53E2972D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2e746fd39756a2f89d6db80a57e8376fcee23ab1f27c04f9d989fe5d1927991b
MD5 b7ca140272d6ba3d33d9a75dc88fa1b3
SHA1 277203b32d837f665678aaf4c743b2a1636b28e5
SHA512 3689836e6909554c8d50acd2a8a2f067108b394db7b3301d2555b90e387b72d2c457631691ae8c54579e13e68b7e696019b9ae8a20c8f72e19189c1a91279e19
TLSH
T1A961AEF793E8866DC91196F4EB156E1FDD6D0924532C3C66C8D4AE0B53E2972D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 684382df4850c0eb62a26d99df2c1b51d6fe03753fdc7c1770cf7b41d97347d1
MD5 0084969b7d2986b0efcc72b85db6da7c
SHA1 430a938b854ae32ba6b1299d26b131d3339fd7fb
SHA512 9d1750153f71b7afa44a8c7dc57b3641165d037ca112e57cf2a82d2384a5c1d1a00d70c836646abfc7c940af14d87bc9f4b2b000c832388e2a789295985c207f
TLSH
T157719FF3D3E8866EC91152F4AB156E2FDD2D0924532C3C66C8D4AF4B53E2972D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b75af5f9a0d503958ba9fcd0a498021546d2afb94a8e539bb67f8f0154a7524b
MD5 e212beda851f8ff78fb413cf6943586b
SHA1 9ef6567986428dbf5dad907ec14b768fba348555
SHA512 5f132ae976047af4aa0f207ca14874e3da92c2565e6b7c9e4d98055c718ac4a5b95805bcf3b79d219825a83b3b8b7c357d7f764d542a21d455fef658342b1309
TLSH
T14C818DF3C3E8866DC81156F4AB156E2FDD2E0924532C3C66C8D4AF4B53E2972D24039E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2bd0f0007808bb9721e231c15f91494133d70b922dc79e26088d9fe17973ce46
MD5 d8741c7cab70ad15875488f6e4767990
SHA1 db5247355b1ff777af9c7d271b4dc429374e22d4
SHA512 f9f91535f7ddc1eeb1410e34e09c66230858bb2ee9f545c96ec00e85dbbd63647594b18b27f8917b32b0ed629f03fcbd8fc73aca0510cf581855e3826cb12cdb
TLSH
T179214CB3F3BEB42750790CAB1E54BC2A297FA43612D254F4DEAB815EB0805B31B16917
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9ebddd7bab1baca53551ff483e46da1f79d3f29da131c28115a7bfe11d60bc0b
MD5 8805e5a045846ad0186048bab8e5e0a0
SHA1 9dff61dc38b7628cefc65dfb3ef868ad8e4fcf6c
SHA512 8a259eb4c6c20663b5e9b00ef0fb0fb4b47becdcccd2977db69b9a9edc942cb03e8ecac490aa8cbe43c3915b9e1fc6ede80a427352c1d2cc806400366de1c45a
SSDEEP 192:zRmzcrSnml4Zov71hTqPRpIGlk92Hsb+WNaHcrx4rZUDp2vekouVyIsnAUgraJ:zRmz7v0BhwXOQwaGKUN2Ne
TLSH
T10C52C56FA92069BBACDBD21AFD257B53E7F5102525E01E80E7FC8A5C05E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 250e3356d88c1f9b2c853912ab076b27ea4791302cc996e325155d6cd2421e4e
MD5 0b72fa51173ded741c05e040c238fbb6
SHA1 92c0b767d48b9f52392ceeb1aec89013567874cd
SHA512 e95a71116b6d3de3722c2fc56e3a45a4f2c2ab35d8b10a1f0d353c37a55ee540793fa3e83c57c14ec7bf7fbc10d98a08bd38b4aaa95a0eea1b05292c97083c01
SSDEEP 192:zRmqcrSnml4zBov71hTqPRpIGl892Hsb+WNaHcrx4K4s2p2vekouVyIsnAUgraJ:zRmq730BhwXCQwaGWsO2Ne
TLSH
T1F452C52FA82069BBACDBD21AF9257B53E7F5102525E01E80E7FC8A5C05E75CC222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3e16f4dd8f9acdb5eaa805b53689a4bfb570a4d3f38755c2c7cd3fff58043a62
MD5 750ec2e36f78c4bbddc645efa6c81ed2
SHA1 ac5c52b41997c840773f412846f63cef0d9db24b
SHA512 4f39ecf7fda928597e575056e9b93692382d1dbb9267ab97815ce67b62f40ef3e17cb28d63bb7e06cedd04406e8cefb955b5a10d4d4a46c2893a919c51f98fb0
SSDEEP 192:zRFqcrSnml4zBOv71hTqPRpIGl892Hsb+WNaHcrx4JpQNp2vekouVyIsnAUgraJ:zRFq73qBhwXCQwaGYQj2Ne
TLSH
T16452C52FA82069BB6DDBD22AF9157B53D7F5102525E01E80EBFC8A5C05E76CC222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3012fe0fae7c090fea6178a55211113890c92220834b4143d131ee43b0f09c23
MD5 e95639b978cd801de959cc25920f4ca7
SHA1 77766f80fd0c9a2986f69f0e5abfa54604e4d478
SHA512 c4f18ff98c8a5f7274824053d814da0a5ad57d161d2a603b3c8c58c4ed5828de69edd6053b748a123c10b47d5884242acede4006895701f4b20d4ad162f4dd33
SSDEEP 192:pRmzcrSnml4Zov71hwqPRpIGlY92Hsb+WNaHcd51rZU7p2vekouVyIsnAUgraJ:pRmz7v0BhTXaQwacDUV2Ne
TLSH
T16452D66FA92069BBACDBD21AFD157B53E7F5102525E01E80E7FC8A6C05D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 35ea9eda18fc22b3139f7f9a444a3f9dd3438e793aea807c9598073b40e4b61b
MD5 030bee360b8c475db77c2471d445a515
SHA1 80cc1a368c8c41a8b6f74841a37bca36bcb65680
SHA512 2f402174de804473090e2518590bf7ae0208125ed56d7f55c561546c933c8c3a3bb45fb9466d4bcfa23928e0cf2cafb5567bc22b2f2a4a45ce4b88fafa5d3bfa
SSDEEP 192:pRmX8rSnml4kgv71hwqPRpIGl792Hsb+WNnd513/edp2vekouVyIsnAUgraJ:pRmXbW8BhTXpQwnpeT2Ne
TLSH
T16752C56FA9206ABB6CDBD21AFD257B53D7F1102525E01E80E7FC8A6C05E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ea9cd562467c92155afbf8dfca6ea7a289a258c62841f0988ad746644a38e823
MD5 6b7ee9d8a734943578e9f058063d3c5d
SHA1 1ae948c9b85c6804428e70ba7c80cf10e47e3fa3
SHA512 ae9361f2479571643fd71c261fd6fe956d56603df4ead441ec1e22efc8e8d201f8b9a3f6abf362b95d8ec41896e06c99540f2c3c6091ca44fe058a00728441f4
SSDEEP 192:2RmX8rSnml4X7v71hpAPRp2g92Hsb+WNnc4dvp2vek8uVyIsnAUgtaJ:2RmXbpDBhUXDQwXdh2R8
TLSH
T16E42C52FA920A5BB6CDBD22AFD253743D7F1002525E52E80EBFC8A6C05D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 654c594e5d201c2d328a99462f7a3756c3e9bc6b9fd58d3a86460a7339e9bb55
MD5 db8a0aa6044db8e8cb5ffd935464503c
SHA1 a78b0a88e5577cce8e1c81ec0a3e45fc14d10ff4
SHA512 8e9cfb917a46459f3ac0f105de355dc4404d28d822689dc9332bc6b0c48013ee24238971ea9b06fcb2aa1dad1a0d3b0847b95f50bd41969fbd909a02e2f5490a
SSDEEP 192:zRmzcrSnml4zBov71hTqPRpIGlk92Hsb+WNaHcrx4rZUDp2vekouVyIsnAUgraJ:zRmz730BhwXOQwaGKUN2Ne
TLSH
T15952C56FA92069BBACDBD21AFD257B53E7F5102525E01E80E7FC8A5C05E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 73fab28e792deb0698b6514bae0da6aba4762d2b85013409da70278eea01d3d6
MD5 a9fce14ade9a970c29eee1d6bcafdbe6
SHA1 f84fa423831107909de88b159183959ea287ad5e
SHA512 fbf877363a3b81349f5b81a6b057dec967b72ad5140e7386f19ca86c9f9a16e5a0ae0a55c4ece8cc9efffe258492b3830a79b4fc6dc48896f873d08ee88ddf2b
SSDEEP 192:2RmX8rSnml4k7v71hpAPRp2Gl792Hsb+WNnc4uH/2Np2vekWuVyIsnAUgraJ:2RmXbWDBhUX3QwXK2j2/e
TLSH
T15142D72FA920A9BB6DDBD21AFD253B53D7F1102525E41E80E7FC8A5C05E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1b9d2ebf6e243c7edb5539f6c9070663a7fa2d8f5f847bba8c382fc5415ced3d
MD5 36c103c5af3d2200d9ce540902c07764
SHA1 9755f24aa61de7213bccc64ed0ffcaa1dcf07935
SHA512 ce96ab93511830edeacf914b1c965f2a8781d0d0ff8929c5ec55082f4a93e61566c0d6f3be8e28a77f073af079f8866a1e933b0b7aaa1691fcc3e8e0496b5368
SSDEEP 192:2RmX8rSnml4D7v71hpAPRp2g92Hsb+WNnc4dvp2vek8uVyIsnAUgtaJ:2RmXbRDBhUXDQwXdh2R8
TLSH
T19A42C52FA920A5BB6CDBD22AFD253743D7F5002525E52E80E7FC8A6C05D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b81930cab3693e312420f184f315685b935887a9db3b5f5008425d3d532e2009
MD5 1d9acf8909eba1895b9f3ed9648f2114
SHA1 2bd145ceb053af3f630c719b90b18ec9e01034c3
SHA512 1f8f66f8bde663ccadab5b83b3eff897d3cadc0f468361ea7e62a3bef18fde9160df5ee16931dd2927e137d7c3c5b7a1734740b372ef0810604f55fedc35db60
SSDEEP 192:pRmX8rSnml47Cv71hwqPRpIGl692Hsb+WNnd51gEe4p2vekouVyIsnAUgraJ:pRmXbpOBhTXQQwn9e82Ne
TLSH
T16B52C56FA920A9BB6CDBD21AFD257B53D7F1102525E01E80E7FC8A6C05E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a632b9cf7927d0c4a78aa2d6c09c2f4d3e21fab7d92e33eb3d5c7c055f9c5452
MD5 6cd143b58e7fa8b1133c07993394334f
SHA1 6a82a358f32b6cf9056eb6622bc79ae1b4ec389a
SHA512 cab4f13f6a766fa8c58b47e39992417b93163d6790adccf0d3b106a132e4b7813fa6b53d46619242f3b0f73e0a6fd5a531738fb292fc02a48d7f6ccd1e5c1d76
SSDEEP 192:pRmX8rSnml4kyv71hwqPRpIGlD92Hsb+WNnd51/Xknp2vekouVyIsnAUgraJ:pRmXbWeBhTXxQwn5kp2Ne
TLSH
T13A52C56FA920A9BB6DDBD21AFD257B53D7F1102525E01E80E7FC8A6C05E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e9d6989b7b6d7928c7d23463fc942cf0411e306676816c2d304f5a48956e8336
MD5 18ab4ceb0ca932381411227227272c9a
SHA1 e0d27dda5e9aef6c3827ba6dd46ba182780df762
SHA512 087c50d9553b3d9d1c3159002d3d4df8b1d924be648e6b444caab6d892e09dbc77a9b7c3f70d791e5fcb572c2d1506dc5703b19b4278257e1787f3cbacf7f091
SSDEEP 192:pRmz8rSnml47Cv71hwqPRpIGld92Hsb+WNaHcd51Hv2rp2vekouVyIsnAUgraJ:pRmzbpOBhTX/Qwac52l2Ne
TLSH
T1F152C56FA82069BB6CDBD22AF9257B53D7F1102525E01E80E7FC8A6C05E75CC222701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b692630bd2d0638e727efa386859a10c1b70aada83ca05cc3baa373b06271653
MD5 bba36e924affa59fbf2b976a19bd78a3
SHA1 2078009bf63c4798b24b5b64d123fc6d173bfd88
SHA512 4423edfa8170fcf03ce9ac0d37cdc7c8f80a43f3f7ce9d9ae83db38d50ba9d1f261176a3e04d8e7f979cd666f32060f7a1e497e71e57ab5bb752d28042dc67a3
TLSH
T17DB01251C0035116C44246F42D5614887114BF10960A270143E47A22DC2616180184A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd1c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dd1c.TMP
Size 96B
SHA256 578ce5fa67cdef34ab868bcbd0e90992a9874100ab1289a851f83d10f50b6503
MD5 8445d618b32edc8c27919954f81c0474
SHA1 45d7940fb9ecc1b7e1a8bbb95985f78fd5235f59
SHA512 898f10591c72eeefb941015f4abf8eb57d930a4848b0cd3746190922c475e4f2d739fabafd4cae5bc3dd3be72d512dbf158fc89ecb7efa7be2d9de076774b420
TLSH
T183B02288C2023202C08203B0288880ECB3B0FF22CB032222A3F00A22CC2A2300028220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 776031eb8d8b40dedc4e3731dc2b0ec1a731d29897e9de81d8f7ee272bfff5a6
MD5 15085635e7f47560f3bcdf6394e857fb
SHA1 36ad80505bd86fd51e9b8497b39f0de51ffe3b35
SHA512 b614e571827969423749941ff1b82c005aae3168d312a66a014055c0e634c87d169910b581cb9899f9f2f23301fce9b034649cbd164de590d23e1ba6429461bc
SSDEEP 6144:voZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:voZEQosMzTEPx9oBGcAos
TLSH
T1963412379C677A758C34A319B04E4F0E0EF259B79A29DDA8C9E84F0057DA7D81E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9fb6d3dbe07702a14533000fcc76ac93998fd8ccbd7c25897473425cf3036759
MD5 544c307e7dca78a81b682a8cd5f0a726
SHA1 b4aaa063ca783962f859b5cda6301a538ea66da8
SHA512 acbfc197faf8f79dbe00f788d50e4962112a851fd984ae5e57ed6ca7963f0456381e9eac616b325d09b535f4a3e6711e5cb744b574b6bf7bfcadce61ee9f9ac6
SSDEEP 3072:1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:cm7Rkm1tYpBeh2BAo3
TLSH
T1F6C312275D71E9375979AB4EB08E0B1F1EF24AA6CD30DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 38f2d10c66f612ba8f458efd75223475f0ffaf812588d8f9e3e2af28c5ea2259
MD5 469d2fd2a15312009a44fff10e8c2b01
SHA1 fee753fc2fcf4a4a45f4421ec32f45e90f3d386f
SHA512 b72c78d25d3444b7d663489367cdb7f88564e26d5c06afc74534aa76a320835da84e6842cd50272647c3d7c8a1d67b14bbfe087e3953883a35ad4fa1a8a6793b
SSDEEP 6144:qoZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:qoZEQosMzTEPx9oBGcAos
TLSH
T1C13422374C6A7A798C28B319B04E4F1E0EF25DB69A29DDE5C9E84F0057D67D80E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 6071b50319df4a864310b30e57739d8df76e821b1372bce41c04b2406df3eb34
MD5 805199bf1877e93beeb7dd1f2f6fb9ef
SHA1 caca21751dd73f9bafad9e111e75326c66953ded
SHA512 4e56245c54cd32d7769645c7ffa35ec2b68227f17cdce59d211943ba7e08df783f4d95977fc680d2f2c91eb40763181b97cc939f74f50aee44f5984c0655acb4
SSDEEP 6144:xoZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:xoZEQosMzTEPx9oBGcAos
TLSH
T1F93412375C677A758C34A319B04E4F0E0EF299B79A29DDA8C9E84F0057DA7D81E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9378406b039cdeb097cd98e43bcfdf0317f52f1808629082b4f8a3d8bbacfe79
MD5 8b13fdb398c1d89a381ae6996216923f
SHA1 371ab2a7fabd94b63a436c25bb08e896dcd0a775
SHA512 604ed0cc08bf115fa05fc0591d46e4ed01bb1c64d78676e88714bda708a76a821664c8d6897a82584a5cf997d7308ebb53b504155575b5a893a8f798863e2863
SSDEEP 6144:2oZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:2oZEQosMzTEPx9oBGcAos
TLSH
T1D23412379C677A758C34A319B04E4F0E0EF259B79A29DDA8C9E84F0057DA7D81E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a00be5b77c43ec31226af550a75175b31b979b66d6ad9c34bfe32af39c9d8f65
MD5 95c961e886edf23e3de3bc9c3ba26e3b
SHA1 66af176feb005c4abefbb8cea2ef6e44cd684f1b
SHA512 5424144ac4de9c66f3d0bdf8d80a4ee6d9346a62aa60f497d601923b1c7a3a243700404c7ee874ddf34d14a8bf0d15fafb4efb7e3c9efea3f24c1bb60a00dee4
SSDEEP 6144:yoZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:yoZEQosMzTEPx9oBGcAos
TLSH
T1843412375C677A758C34A319B04E4F0E0EF299B79A29DDA8C9E84F0057DA7D81E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 ed0e1d94a3bcf732dd4381df6b9a1d1478d8cce49820461011e4d47589f8aadb
MD5 577bd291cbe34dc21a2c028397c991ed
SHA1 15b4b78b0eb2f142377bb79d5628e1d70f5d9bf5
SHA512 0363c50fa36afa2f9f8d15fedeecd39251efb513231035bb924a3a9476a341b6282147443c29430ad298b3351e0c0e3800cdd457492e5191f36d0ac762ba1c26
SSDEEP 6144:doZV2S13JosdSHIOTe/8cXtRWuYm7Rkm1tYpBeh2BAos:doZEQosMzTEPx9oBGcAos
TLSH
T1E23422374C6A7A798C28B319B04E4F1E0EF25DB69A29DDE5C9E84F0057D67D80E1893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d54380203f5f16c3ad8d14eb64030314d6769b71363efe7e014288e29085b334
MD5 c2fc5cf63130e4c2e68b49ef3aaa1635
SHA1 c06d216b86d185a793ad40555ba4586ab6d5dcb1
SHA512 b3f042c5315e9af1d4d2d813fcbebeacbdbef167663843b4b044a1fabb269773d85e51a9cc095238e3b6029f10b5b7cea48ef64ab95339eda6b4dfe84775d541
TLSH
T14CD0A7D85E2679D4F2B80D3A24B44A20764C5BD31A0267499A5E68068CAA0B23482AD8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce25f80e25bb7d5d193723184d7b2f1084a3ecec40244947dc03cb401e86fb3d
MD5 c91c522ad2a49e7fbf541b68e5a9c07b
SHA1 3cd2081af7f51ad709a0287f1c8cb32aeebe7042
SHA512 d441ca00bead603348c74b7d0dfa5b8308d42258dc926d2f8479b0c04b1a71926368c03b849716b79cad2c0fc1451f80dbf28f58fc2ede668699b6fdb389bae1
TLSH
T1BAD097E81E063400F2F84E32387C4B20B70C9BC226026B84099E20051C4A471208A2D4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b6c4d142fe4828f75c19ed44911d91449786976d55330bb345ac6e3a6f5e96c
MD5 caba7548439305f42bf2b8a77028cae8
SHA1 a9738da7dd38f2b655f29297a551fadc5acf5c84
SHA512 cd7f11eaeb033661935411506057204c969dd3e7a4834967f1cfcf1b059b7ebc2ca327665a6d05f2535d6e270f3c1c41d06de43c707e8f57c271ec36108d0fe3
TLSH
T188D097E81E022400F2E44E3238BC4B20B70C97C226026B88099E20052C49471208A2D4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f87c908b45d3fc0559fe4de3788b762be6526a8c041f8d444f9cd53a7a3ce09a
MD5 9060c694428699c0a8be88298a4aa045
SHA1 8b9fb5478152c0018b419a3c394d4290377a4194
SHA512 33d44a8fa1789ea1e52908e27b2c2526fcb5bab6af162b044d7338e9555066bb7d65201d6003a965f7339ef63e8528ccf1d3eeb864528ba657347e35d151438c
TLSH
T134F02D76D921EC3718FD0B6870594747EB9013172780499F7B3C530D4FB563B458981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 0b40870d313a7f45a7dd60d4133a97e36c7858463f8f96f768f7fed1cd9510bc
MD5 5703dce3fd013e8c6ab573282080e58f
SHA1 c482c32433e90639b13a07beeee5288ec2f7af7e
SHA512 ca128a40c4389713bb222a5a880bd75cbfe0f1b5d97a966dca900e734ea10533cc78bf64e7725ce88cc9d6536cadb007313e05a1f3f22d4da71aab9734c4cfbb
SSDEEP 192:wRgKb4RFwOX0ItiB6cfeb6/atxZ1BKhLTh4Ap2eYcLmIq4o17ekjoulfQ+zQaUNr:wRgKb4RFwOEIMB6ieb6/atxZ1BKhvqAh
TLSH
T10912627C6CC8615BCF47463181E6191C30B9A4D6FEAB9E4A2148ADF4ACF3FBE0976414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe650730.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe650730.TMP
Size 3KB
SHA256 5435d6038890c13daff3689986e810fb24bd22b7e22e2539eb08d08c6870fb99
MD5 e6a9e72cabe827782d495c811e3ea682
SHA1 cc8d3b1b40a9d370ef9a0a5e8a86adb8c06ba6df
SHA512 a3621bbb743a1fd0857268d92357a062237f3110307dd987277228ff88250ac937506e314280350f3eb9e4cf3bae1736aa05f8a7a1195c47aa483c0ea3243283
TLSH
T13581EA30091291A3D393893181E85624347299E9FDD3EE9E21902CF6FCFAF73857B956
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1fcf82ea4c51d3a96fd35a9b11762a4ff0cce28861dea3e0e1ee9d234cbd7abb
MD5 b807b14b7c641060186bdfcda745f453
SHA1 feb258b8c87673d435f3075042ecc806b635ed26
SHA512 6b05e23b875c6208f2c6ddb737cac57fb9b403132aebf9954be22c97165667d3366d49661327b8fa983821c3c228596ab6667bd3456e00c42146bccd04f74a20
SSDEEP 3:MsEllllkEthXllkl2zE/lE1:/M/xT02zv1
TLSH
T1E44404057FC10C0FC505D3704053C3743370D41007175743745515335CCDF404C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 04574558b5bad987b1930e038815c8bb9d45ffa1a5cb06fa6e21e2da1c790740
MD5 e39efe74ed08745df59457939ad2e4f5
SHA1 fa79fe5c3a27df9e3201f8b8247796572a1d039a
SHA512 8d00637e3d69b6b6f9286c95016f069214f390fe83de6fb6bbe8c859fa7d02a8b593f7cbba0c27dbcdfb07aab2f12a2fa1582557395e1703a1dd74e4c4290c9c
SSDEEP 192:H3MOMhMdfDom8tHtUoTCmea/yZ9IIhEM0:XMBhMVoPjmsu9IzP
TLSH
T1A1D229A7DD727841CB815EBE016D2EB6CE33E16CCFA6EE583534001188388BA55716FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 4ebefa485b8398a5d883be0a4181385d7a09fd79ee1902adf1771e34a283e283
MD5 56eaee56501f744316a353b03f68890c
SHA1 a18852f0f010abb06d46e21f0768412aacb19912
SHA512 2f86ad8deb0a0c014d74d5f10a5b135cf1b86eb9a1fe136b101c2e51812bfa5fefa0783f7b8970331daa8ebb4c4d53e9aa88b1873680db04bc1b246fece5d39c
SSDEEP 384:JM5MqMhjM/83uICtTBB2KMbMNM/MyMk7DXspU3it:R2ptTBB2sU3W
TLSH
T10614C75F5A763711CDBC91B958EF19E75C7EF03ECB0295CA287010A0CEE2666A11C4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c8e3288cf486892c2bb1fbe8f430a080ea64ac9c6acf59c5f91d6648ffb6d798
MD5 4f5686c0ab1d5af0cc787910e301fb61
SHA1 444fe86f1eac88230aebe665e0f20f2dccb94bce
SHA512 bd8c309dd84a7fabc0cbc4bc44f025654b96ca10035158192a6244b302e9f5afd8f4b7733fe6af8e5c82f8a676a3c20164cbed6071ce53f765da4f9a9933c5f8
SSDEEP 96:D18OI4FOumpkaij63zBGO5cH/hsGtjEBBs5mrmnBmOkRmDmt0wBmVkx:D13I4FOumpkaij63175cfhsGtjgmmrm2
TLSH
T1CBC1CDF783F5826DCA1155F0AA18AE1FCE2D0551436C3C5A84E46F4BE3F2871E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 01c9d8809038e66de9c41cdd9074c2be74cec996e6c305b97ef5da81f059f278
MD5 331d83393a264d6afb0fd6260bfba801
SHA1 dbcc34b7c7bc602177584c5392816d933743fbfb
SHA512 bcc23b4a70ea373977d39a81320a485014216205b4f5f2dfb34df1f3723909d7397580e6ec8393487c2ac4c916f6e76cabd74e5274b98840479f613e6b054706
TLSH
T183D02233232070F5E97D6F81506EECAFC32F502A58C3DDDA10E198982531AAC4A07244
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 895b766fb03229b93973363168635e617e5cd819586d36361ca3dd5933f1864e
MD5 5546522beedd08adaa849831ab74f420
SHA1 f181570cc811e8c8baefafe5d1c09d7deebb84cc
SHA512 38d1599633d038fe4c1a3ef2d7b6c83e65a823491ff22fa1cf53365a48aee0c35d5c0065674a036a595629e4985ae01b4698d541be6810b5921e08fe4faadcca
SSDEEP 384:sxZmnOdpym4m/fYsRWvrfBzIKYHfoKHbIc/x1ndoM0tn:sYOdMm4m/fNYDBzEHb3xktn
TLSH
T108B2D7466524897BCDD7D669FA317F52DBB910279D904E489AFCCE0C00DA6FD231282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0355d7aa8da1fcd05cd69aa4422ee6a496d66c87f89f1a1588f95a6b03f24528
MD5 73aff4a42271742d94ba899a739843df
SHA1 bc7c91c7b6e5524be4f316c008840c9df2763c06
SHA512 fee21b183ace363d7611f3c3d13b4e3564308c4616b309ccc63b5b53cdb6c7b2480524f9939a3330cfdb969f2ee20c858bd17caee7ef8cc96eff13d810c2e30c
SSDEEP 384:sxZmnLdp/m/fYss2fzazIKYHFXEHbn/Z10j5:sYLdxm/fgqzazbHb/ZQ
TLSH
T1398208066A24497BCDD7D219FA067FA3D7F91163A5904E44A5FC8E0C04EBBED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a2d0f649a3364cb4d6bcf088272c603022df19a6d687c14578c1c62a987244c4
MD5 df296954f56322e6e40548fd6e81e57f
SHA1 948fd4de6a7351f800b64e367a099a7e23efbac4
SHA512 20860b8a1fb7214a5a5f0942e45e81709fb1046061864135ef8b010d6687519b3690384b13b63ee3f9b0c108536a5fe5fd664c93338ac7688661c31ca3392284
SSDEEP 384:sxZmnOdpnm4m/fYsgfzazIKYHEoKHbmc/y10LUM0tn:sYOdFm4m/fszazfHb1yltn
TLSH
T1F3A2D7466524897BCDC7D629F9727F52D7F910639D904E889AFCCA0C04EA6FD231282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b82cb093b569b72b72ecbfaa8ab5dc09407264e172689ba436b4754856be58cf
MD5 cb07d4ad9c2432ef7aa33701fb7d7160
SHA1 f39c8c7851bb30237f9f9c52999ea8a979632315
SHA512 fb79e182b35aff060836c6ca8669c1a02d03352c05bc67fb8d519952e9db415828ab8d0ddbe0d7a0ab2f37575b5dd17b558bebfdd0dd7576486434ed3356a1bb
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9ysy10LlC:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuOC
TLSH
T1E9F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1d51754365627661a54cd0d92afdd3d976164a18110cb13c1ee55e811a6834b8
MD5 f3f19857e327e1ca84457129dd89cc95
SHA1 3237ceae9f79079bb0d5484fca807466f6a6241e
SHA512 e09ff28e937d63d2d6bf3efa96fa690a5c9088ddfbf809fd914645c6b23ab64894ad95cf6bb29ae7eb8b46144e437629ed35fb380507ec901a89c38b72c7f902
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyysy10Ll0:eY8Od/HEnFhWvFvmXu1jaGt10Lm2NuUm
TLSH
T10FF2FB3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 ae2f9f344a711a22cb71105f36a10a92b37dca524942487e3c73cc5c7b8012d5
MD5 653b31e05340894a92a06be18066a240
SHA1 757d64e10855b97a1a56c91b64211bec71609709
SHA512 404f43e6fcbbc1037dda48a3af5ca08052d5adfe679b27825f8cf482b9b57b5cea77fd112deee619a6f9bbea2e4fae7ae43a36d5241d49217a682e5e93686829
TLSH
T12241968D4D609A6FFC64407304F2609437B0D4DD661596279CBC22356C5375D294B7EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 536aa5f62f9f7af5dc8a4a3f346af140cf0d4f454afa2b70f461144d02538fe1
MD5 86e62d7ec6d9c44b56e2fe764327a341
SHA1 17e0a819c5fecb78fa09822b62e711693d65161a
SHA512 f746b5b59e73d204d58e41f5538ffeca9a32fcb521744692bc8cd021f786f4581780b32cf20fe22d5b8d5df49a2ec0c3e02cba3da996ec994a8f6768a3385844
TLSH
T1D151FA4E8D461524FE7C01B31CB100067735DEDE2AC0C91754FC90B4F9877691C9472C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe6469a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe6469a7.TMP
Size 2KB
SHA256 9e39e0c3eb0c58fb97dbc7a92f1deac8170a4439d43065c8c8f9d3f564f37c17
MD5 8cc116c9098bd0ee9f9f4d01bcece979
SHA1 cc22fe8667d144b97e2e1f9d0ddfee7e8ed55f06
SHA512 79ed5c402f50be8ff20e957b7f8cea2ff33f9485f79116f07422d997285af63f98adbea036b7da14e3d4766438a874db805981e97e8f1c6c86fe92d887a07fff
TLSH
T1A541BA854E81861FFC8440730DD3A4B47335940087127B4774BC5536A8627ED2E4A1D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 b80ccc8b54e602179b1d716bc50cf644fbbcbdd06d6f4fe9425e1d18f94c71ca
MD5 333bd9d8edf230d77c65f97ba79f03d8
SHA1 8a4747e1426ed771e787eea0d323f6cad2825941
SHA512 a4e0096f2e920970644cfb6f343bc246cd2dfa4abbb6b3129a7041b0bab10e20e03e109ccfcf52d15d328183fcbb54fae54e875d270cad8606745cffdbf10302
TLSH
T1EDA002101390C057C45225F6FD5212413341D8A036005307419D0088CC944518DD140F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 91bf7196caebbc528c2aade35c62ee120219a547701f81009b24425f2539998c
MD5 68d9943599cc4b53658162ad1c63fe81
SHA1 56afd410cf0226a05d0e3af9ac6b2d02d7cdb9c0
SHA512 438de4cc2dbc771a399e50347634cb410d82d62bda56c846dbceccc0b5baa9bb412f247e590992b6a2f39f4154e965309ded5144cabf6183fa0c19b5f7284ec3
TLSH
T1A5A0022406810482C10A52F427D702533F546D760271670946D18C4CD95065D555110D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3d0197497443d82ce3d760a7a5eb158a3bc0af083e97d1c85dfbe8c3471348c4
MD5 c66430dd9b8f6cc55e7d27d273a3b733
SHA1 1e585b7f281238f00396728617e8cca549e98525
SHA512 0eebf9ba4ea79a9975eef0d7f4a796d440cc1c4ad1d457abca9307fa965991b2e76388c979cf3add75ae7b481b1ce45f140f279fb7e8c500d90547e4af99fde8
TLSH
T1F7E068F37EFB1C50FCAB97C6213058A00005755098409D0F681AB38364B1319201ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 98f393aedf65cafc8e66882d4eaae980dbe8964da9be1cc1aa8580bc76eff1a1
MD5 ffcb0bc0ef03eaf66d49243a3e897674
SHA1 4045a9e2860971553ef4ddafd1121af10bda52c8
SHA512 05ed67a22ed9dc6c2996e677ad5aa82013a7a51f0b0766dc4e4630e7976ec7b7ad0766cf4f526b934b1b201fffa5f9e68f77780af7adc250f53aa3b09a3076d6
TLSH
T1C2F027B37FFB1C54FDBBD3D6203018A005097D549451DD1F2826B287A0B231D216DCB6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 df2ab92c7de931b8173c7d7513b398d7d92b66693417336313605bf3e626edf9
MD5 5b37efa975894ead91371191c25885ca
SHA1 3c80b907a328b176b87889be561b75eb9b626581
SHA512 e58fa8af450a59ca62d989f9d78e9526ccdefbac6f019e3820202d3d9989c8b24129a11672377e17de9d0f6bce18fd375e03071f4fc87e6fc31fea2e32001eed
SSDEEP 48:F2em5HdYlvSFJp6Hf5ZOHoXp3CGWxwp6C5ZOLpE5ZOV:F1m5He6Jp6HzXp3CGWip6rpr
TLSH
T16B91CDE38B146043C9C966FB2039F6D5552DCA066BFF87A611BD8F6E52413D63328B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 52a0021efc1c2f740acc86bcf802dc8911129f5a09e73c85d67140b426c28da3
MD5 03525ba086178a2608b05be88d5a2f86
SHA1 0e73dcea66b70f0d3d3814ce2971b2cb322dcc11
SHA512 f3b6a809e3239877d4388b4feb617f9355aea885022e81756f3725c2ab9bbcdbd7c0302837eb5b0bf23aecc1b7a299981443ee5917343ab5a3432248edfcaead
TLSH
T109E0DFA89AC8C17AA17630D746A88F4CE2EA7527D3C8BB022F09DAC46542586B196280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f775d26c219d85e54d4b925ac5e4083bce1d461bee2a405a3f338f74161930f9
MD5 ec005de6ac4b244c09abd24e425f9968
SHA1 b9213defcc53f734f38f7e395946d7192a503af5
SHA512 b68546072bce5d0dd8586f7df8d4792587d7ecfecab5ebcc7f0528fa4f5ff06d4bdf4b96485e87c25f91b4670825fb5518c3a174599f644927fa90231b416219
TLSH
T197A002138168644AC0081670B38101882663DA101E05222560A881A5FC5926141F210E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe64bca9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe64bca9.TMP
Size 48B
SHA256 10446037536cb75deb553e26edf5df1e558705b44d22d5dca42155aff9bd0987
MD5 52f3c4a977ac19706269950f5b03ee0a
SHA1 1583872c5b471295ca1f823dbc7268a7b6e87970
SHA512 93773e335d36343dede7c71514acda15ea32187513d16fb202d557e20a546545107aaa901b153d732688597a80c8e82da350f71a49bcfe73ab977f215cffc54c
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 244B
SHA256 c62087bf99935908cce4dde820acd70bde300d31c762700f945ed0d7038d068a
MD5 6e95d34d1badc6ce7793f1572a39531d
SHA1 6f6f920cebf8d2ce87c59b761ed1ab1d8dd0b067
SHA512 86b3352534b8290dbc6250088ac0a55fe26a9d9c5c41fa99591b195d7bdf0ead8796342a50eef84da028a25dcfca02efdb5c4084f78acbacd57c85f25e18fce8
TLSH
T132D0A70677401163CC475A3112204B848F94DA4200219157CB6CAE169E46AB12F03595
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 f8fc06966d5b995d45a388efb8da3461cd0618f07193dc3e613196ba7b603098
MD5 1938e62269f04e2ae1012e43a5b27542
SHA1 1dee867a0a9bbaa7e187d678bb909adff66c49df
SHA512 553805ca2b1085ba3371db8e7c6b2ae785e0ca92e5ff9dd4a2802fae3ecf619f9e8d6b9d3fa8b0a0d75dcb919adfe2c0142b3d57c7094d2fe8c2ec8f95cf3c2b
TLSH
T1FDE0D8B86AC9C63BA26530D78318D34CC2F37513D7C87A222B0DEAC4720A18172A7280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a9af063fbeb670187dd6afc01f67762fee2327a1c181720bd5fa85f5e36ad708
MD5 e593608948dfcbeefec18ac0dd1eb17d
SHA1 20f9deb74452194bde1c26974964137424fad40b
SHA512 ddeb1660c7550258455240eedd53e900beddee696fcabf66409dde23cec25fb518a123c190dfdae8df0a08723ab9736ace4c2a076379f37463c1442af45a0a52
TLSH
T1CFE026B85AC8C63A916070E3C378974EC2F27917D3C8BB22570C9484B501199B2EB2C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ede1ae0d1dfd195080b6941638e602372ea66d9e438fda3b2a76c839aef53c1e
MD5 c5516c413891dee0ef14e724579b461e
SHA1 49cfbab3652c878eddcf4ddeef4770452d39343f
SHA512 fe375f6c9452b7769afdf7690edc853e988ef951601355db64f9aa5c9a6e8cf85183cd5f2ffb7631a30f14215571a1027d9100cbd72c0c3ebdb6ffa75e2e49a0
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGV:05ppxnY753RNBvRJJdt7p5J9x9dX
TLSH
T17CB27A5A703E0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7fcca4c95d1354f8cfbbdbd901b0a4bcdc5b3546454120de880660d8cfe0da0d
MD5 46d7e1f54f62eee0972f14cdf198884a
SHA1 f00151414afce161994de5f967f5017bf19dc6e9
SHA512 3e9e6ea5dc893cce16296d688eddec484fdbe69876d83702455b1dd7bae52ad24168e7b168f3cbcbc901a82801f7d681aa61afff36e17d280dc7c893dfe167e9
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lHKphiftGm3pfaKpCe4KV8p03LBty/I:psFccps3bwgbkUZkoGm3pfaNI8p03Lj
TLSH
T168B25C36E858CABBFDE74F99A75E7A03DEE4116786D899D4DAD80D0C00970DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a709621724dceedfd5eb042f7a1bbcef99a3fd085ba7993740f2a8587386376b
MD5 e2a3f97340aa9511a4c255ad2bb01188
SHA1 de9271e31c55d7fc32cf7372352bcefde3661446
SHA512 d29f60dd9f1611374178036814d64edb35fd46b28d2c5557ee153dccdbbd43803626daea47d9628c0e12c60c4a7b7fc7b3f4439f17811a38a8c7acc05dec2d66
SSDEEP 768:xFMcpdywgpkdrooGm3p9It53n1AKRshn2lPJNHQjWn:FdiV43A1AKyhn2jNHQC
TLSH
T117F22971D8948DE7A8E6DAC9A71AF5126EE4013785CC498CD6F97D3E308F0FD1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f999d3678bd28b8548349a875f0c6b6ab61aa58c80a7ec16e2f371cff719435f
MD5 d4bad86aae43bc57cb840b993231b490
SHA1 d8e5fd41887b02f24df4f6f45e222960fc31799e
SHA512 8239c223386c0c8d59c8961c8bdd345a6f588a41758d146d30b54b6d09bf662b7879d6769c8241a3426bc3796b992c6be7fd3c250b7769d9c59bb16ef8e02b92
SSDEEP 768:pXF1cpf3ywgpkXrooGm3p9zaXb2lPJNHQjWn:4f3ix43Sr2jNHQC
TLSH
T1E9D25C36E864CAABEDE74AC9B71A35039EE44163CACC5ED5DADC0E4D00971DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f18d16e845a373be68439aae27ddddf7e06dc4350fa9bfcad9aadd3c483f9fdf
MD5 8166599dd01d3cbbffd1e1de9b35a42a
SHA1 fd8f2042c40f165ed9db3a7a91ed61543189803c
SHA512 2790d27142d6504e4aa052e1196bcba261d7f25b4ccc18c1f1f68d2d596bb73edad81ab03cd9f5633f6a0f9b32cb44fc2e6dd72fb4f20732f8e314036c415558
SSDEEP 384:npsiF9CcmyWC13sN158TUNTUlI4hThckCrZdqphiftGm3p9JLMaXbkty/7IgN:pXFccp13ywgVkkEoGm3p9qaXbt
TLSH
T1C5C23A36E868CAABEDE74B99E71A3903DEE441638ACC59D4D6DD1E0C00DB0DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a2af443b4568317e94ce602e8d2ecb59aedf14248a29cea50070d79325ea67a8
MD5 152ecc22a11085fc8e61e2dc5064ea53
SHA1 4695f9ed9da4ad610953970655f3fb1d0ab93d63
SHA512 5e049dc59b44f19e19294a43e2762b0e7925ce8c2ccceac9730f351ef6f9f2c61417f7885d541e7b9b141466c2abc221747ada3077531bd73eebfaea28fd501b
SSDEEP 768:IF1cpf3ywgpkXrooGm3p9zaXb2lPJNHQjWn:7f3ix43Sr2jNHQC
TLSH
T16CD25C36E864CAABEDE74AC9B71A35039EE44163CACC5ED5DADC0E4D00971DD130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a8d60e3f81da1953617ae21c8b2f031934954ccf569f880ed8cc4fcd8216c1f5
MD5 64a516ddd3bfa7ee7c4167819f7c011e
SHA1 97a4ac9ea2717439b2beb066ae14ecb1221ba781
SHA512 1a0eb5ab6ef3b0d3e99a31211dea324f9e4de324e1e0ba00fd7dfced690038d7d4d4d050acfbabd1f30ac5ec3f2955426bb31060bb07502cb19b7baf224e26b3
SSDEEP 768:xFMcpdywgpkurooGm3p9It53n1AKRshn2lPJNHQjWn:Fdik43A1AKyhn2jNHQC
TLSH
T167F22971D8948DE7A8E6DAC9A71AF5126EE4013785CC498CD6F97D3E308F0FD1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f7f98eeb85ec71d545ada59487c7cbc5fc5749de913a1ad527864fda1905670a
MD5 a1ffdc91cdac6f898607a00b2d18e815
SHA1 d72e385715b42664d43d8a4df7bcfb1c50690ab0
SHA512 01fa99942edbd7f09a5eb7cc76eeeee155324a5c1d28f024e725509b6065e700e06e9cb1db8fbe7fb46b6300f7bd2b6412789e6176afcec8be8c3bfa739c330f
SSDEEP 3:MsEllllkEthXllkl2zEs6TgX:/M/xT02zR4g
TLSH
T1734404447FC00515C70430314055C35C1370D455057157C73451D4337CD55700C01004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16ca1318a1aa234d2483193b245d29f7b583028d57b782825d486e6169af6a7f
MD5 b5892756b2b063a8a617c270c6b3d416
SHA1 42d707e37452918d6da8685da33f7dcd43100e4d
SHA512 ae19bfd7b7c1aadc41a749e79a02f1c0c72b2e6dc0e1029e4024669b709f2bc55d7ac775b1a6149ff7f831f4a9eb9c89d1c64e8c6b26520c6e8406631dca0f79
TLSH
T19D41185CA7F91148B3B3AE569BF6A86E483ABC732E07859D10110E4E0672A41C862733
MD5 SHA1 SHA512 TLSH

Submit Download

dfsdfsdf.zip.crdownload

Path C:\Users\Admin\Downloads\dfsdfsdf.zip.crdownload
Size 6.6MB
SHA256 e5e44abf5b1bce2bb15f365674da5aa49e4bae4a04f48570e70620448d9c6982
MD5 0fdd16f79d0ad8931bbab55023c638ba
SHA1 5580b64b07ee6291d3bd92e9f55a169939e1b5f4
SHA512 50c849c8ef233c6387ae6a7948abcbee34380a6092073a1f1098634101992aad902841d3ce6b1f9086ce5fb5e40f06229ba364f79d5835a481fe361330bba22e
SSDEEP 196608:ak1JabkgBS9HgJ6ocHzi2yq4gGAju7aKO1IodJaZ/Wptq:DabtSFgJ6osuxQbufOGodkZ/h
TLSH
T1EE6633887CB8C921DFA81FBC664B502BD38F5B57D31AB96C8DCC2223451781D2DDB5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper_Release.exe.crdownload

Path C:\Users\Admin\Downloads\kdmapper_Release.exe.crdownload
Size 136KB
SHA256 f6f389462c57122122e1d17e23cf5660a9a20d5076b25626575f86a80f92a36e
MD5 645d23428130a53dc68230455ee1ea09
SHA1 6344779007122187eb8c5d30110aaa52f11e32f9
SHA512 16613131f8e9238c87483d8130a21bc3f47712836b15928f2f50a87f3cedfd664bb28e5a9e1ec2d556abcac48380ba243530fb8416a17bd8bb9967f587a42a7e
SSDEEP 3072:1AjOlKvSavifQkwZNmJTQSaMm5/6s4Kdg39NX82zb:1AuKvSaC0+Wln4KENXl
TLSH
T15DD3296763A510A9E5B7E2BC9AB60612E7B27C550734D3CF1350807E0F227D1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sad.zip

Path C:\Users\Admin\Downloads\sad.zip
Size 23KB
SHA256 37b0f3799af9587c2d14dec3bb3da3ce60b6ae57472a82bf9a6dca9569b9c63c
MD5 38bdf29a2c9275fb68ae37771ac6b6cd
SHA1 b6b944585bbd359bf798dc7b386a73bf3606790f
SHA512 f101865ee644b5ba538caf9ab6810713a8d33d40495a1d1b6255ff8d9d7683709193c319c7cd5c680f2afb9eac8f846b33c35fe8dddef169c44911dad300e966
SSDEEP 384:Q5OkPtEuYgunMgP4nJ8xev8F411zQ7GVpp+dRl7ueZohv/5Le4jIyZuizHWYgHlH:Q5D/yfP4nmxev8FoQ7E+dRlqeZoR/UO8
TLSH
T195B2E0049D1F259DFFA6D67DAEF3595F060805AA0EA0766E521563FB0C18BC1CD32884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download