15cb2a6749e66ad435d3f1f115ccbd7e326676bbe5f2b8874564e5533b0c218b

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 57KB
Sample260528-mwtx2aey51
SHA256 15cb2a6749e66ad435d3f1f115ccbd7e326676bbe5f2b8874564e5533b0c218b
MD5 13a44985c1e764b9b11dabca8a3b77bd
SHA1 c32b565708e80410be404d0bad5b757af8160a66
SHA512 52e51daae7c87adc9047f28a00142d49b9f9d66b445a27593e17ed9124e8c6d95ac750a817ef6dec07c743318f2be5667193bfbe14a522e860063b85def7b393
SSDEEP 768:a/yvV72MqMZRfmzOt26Ws/g36Or9v96AgtWGyvV72MqgZRfZtWL/g36Or9v96AGH:a/akfxOeHfxDe
TLSH
T1FE43CC6CA62C1EC44E698EE11DA162B16A1E036F8749F70CC3A7C774B52C0EDED51D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3468	msedge.exe
664	chrome.exe
3992	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244389760367128"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{77404865-2CEF-4F3A-85F4-FEAAE4AE0872}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe
700	chrome.exe
700	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe
Token: SeShutdownPrivilege	6084	chrome.exe
Token: SeCreatePagefilePrivilege	6084	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe
700	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3308	1500	msedge.exe	79
PID 1500 wrote to memory of 3468	1500	msedge.exe	80
PID 1500 wrote to memory of 2732	1500	msedge.exe	82
PID 1500 wrote to memory of 2732	1500	msedge.exe	82
PID 1500 wrote to memory of 2892	1500	msedge.exe	81
PID 1500 wrote to memory of 2892	1500	msedge.exe	81
PID 1500 wrote to memory of 2892	1500	msedge.exe	81
PID 1500 wrote to memory of 3984	1500	msedge.exe	84
PID 1500 wrote to memory of 3984	1500	msedge.exe	84
PID 1500 wrote to memory of 3984	1500	msedge.exe	84
PID 1500 wrote to memory of 1732	1500	msedge.exe	85
PID 1500 wrote to memory of 1732	1500	msedge.exe	85
PID 1500 wrote to memory of 1732	1500	msedge.exe	85
PID 1500 wrote to memory of 4164	1500	msedge.exe	87
PID 1500 wrote to memory of 2292	1500	msedge.exe	88
PID 1500 wrote to memory of 1320	1500	msedge.exe	89
PID 1500 wrote to memory of 4164	1500	msedge.exe	87
PID 1500 wrote to memory of 4164	1500	msedge.exe	87
PID 1500 wrote to memory of 3332	1500	msedge.exe	90
PID 1500 wrote to memory of 2292	1500	msedge.exe	88
PID 1500 wrote to memory of 2292	1500	msedge.exe	88
PID 1500 wrote to memory of 1320	1500	msedge.exe	89
PID 1500 wrote to memory of 1320	1500	msedge.exe	89
PID 1500 wrote to memory of 3332	1500	msedge.exe	90
PID 1500 wrote to memory of 3332	1500	msedge.exe	90
PID 1500 wrote to memory of 1428	1500	msedge.exe	91
PID 1500 wrote to memory of 1428	1500	msedge.exe	91
PID 1500 wrote to memory of 1412	1500	msedge.exe	92
PID 1500 wrote to memory of 1412	1500	msedge.exe	92
PID 1500 wrote to memory of 1344	1500	msedge.exe	94
PID 1500 wrote to memory of 4148	1500	msedge.exe	95
PID 1500 wrote to memory of 1344	1500	msedge.exe	94
PID 1500 wrote to memory of 4148	1500	msedge.exe	95
PID 1500 wrote to memory of 2740	1500	msedge.exe	96
PID 1500 wrote to memory of 4056	1500	msedge.exe	98
PID 2740 wrote to memory of 1948	2740	msedge.exe	99
PID 1500 wrote to memory of 2840	1500	msedge.exe	100
PID 1500 wrote to memory of 2840	1500	msedge.exe	100
PID 1500 wrote to memory of 3776	1500	msedge.exe	101
PID 1500 wrote to memory of 3776	1500	msedge.exe	101
PID 1500 wrote to memory of 3452	1500	msedge.exe	102
PID 1500 wrote to memory of 3452	1500	msedge.exe	102
PID 1500 wrote to memory of 4340	1500	msedge.exe	103
PID 1500 wrote to memory of 4340	1500	msedge.exe	103
PID 1500 wrote to memory of 4536	1500	msedge.exe	104
PID 1500 wrote to memory of 4536	1500	msedge.exe	104
PID 1500 wrote to memory of 2932	1500	msedge.exe	105
PID 1500 wrote to memory of 2932	1500	msedge.exe	105
PID 1500 wrote to memory of 2932	1500	msedge.exe	105
PID 1500 wrote to memory of 5504	1500	msedge.exe	106
PID 1500 wrote to memory of 5504	1500	msedge.exe	106
PID 1500 wrote to memory of 5504	1500	msedge.exe	106
PID 1500 wrote to memory of 2824	1500	msedge.exe	108
PID 1500 wrote to memory of 2824	1500	msedge.exe	108
PID 1500 wrote to memory of 2824	1500	msedge.exe	108
PID 1500 wrote to memory of 5788	1500	msedge.exe	109
PID 1500 wrote to memory of 5788	1500	msedge.exe	109
PID 1500 wrote to memory of 5788	1500	msedge.exe	109
PID 1500 wrote to memory of 5832	1500	msedge.exe	110
PID 1500 wrote to memory of 5832	1500	msedge.exe	110
PID 1500 wrote to memory of 5832	1500	msedge.exe	110
PID 1500 wrote to memory of 1256	1500	msedge.exe	111
PID 1500 wrote to memory of 1256	1500	msedge.exe	111
PID 1500 wrote to memory of 5916	1500	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffa127dc188,0x7ffa127dc194,0x7ffa127dc1a0
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10071561401833253331,4212195245921468299,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,16038556285064407276,15555930191099465859,262144 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,16406833307788494733,8488586098289083038,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,14462453634241765054,7015414731810093408,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,17419886290466156940,16124469096650889513,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,8267513398830386887,4442464331979527672,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,4363256620268319730,5067251797225905024,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,1553409304558763825,11431475255287496125,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4308,i,8143321750649597967,14676872000394747323,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:9
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,15616957857743772345,9343697512500894019,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7329797241665505116,11549343893269056373,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,8146346733611508565,5011942553819213359,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,16851193301923477443,12645295084102894185,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17017414129231679289,14008191523818769918,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15252510091690450477,16850903619201843712,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15252510091690450477,16850903619201843712,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9486565497146143882,12990559395668055992,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,2099264805197357133,1320593271808902891,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3840374871258512567,15085123403563968170,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,18068098734385339579,13682394545570223904,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5743708032761791844,17131694946656619503,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6724,i,5426093891098976003,10608190245827675956,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5144,i,3651255296460646796,9941688903611543901,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7072,i,7532612437171497447,10157860185040310973,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7124,i,12639200817443406062,15959590577589064545,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3968,i,13287452910442711132,2472546089344990788,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,345041281536240671,2152430437053585286,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:12
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,15565251689627441443,5475931603256172413,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,8713884277325719946,5322138881531901552,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,11503535412128219046,14220540726594158698,524288 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6952,i,17889452932657392110,10538278036673508615,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6940,i,4482173571939724928,1518698024573829067,2097152 --field-trial-handle=2060,i,4941725151852255857,18197529817180684217,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffa1243c728,0x7ffa1243c734,0x7ffa1243c740
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,2356288770004313233,6604181506034501238,262144 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,16327548504903803372,16274727646496408988,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,5169480314429943396,10025552666380238021,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2128 /prefetch:13
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,6381932197721701214,17459695849278712853,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,9527240228846540177,16037727604276754561,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,12914386646754016766,9223857067394556044,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,12673638052789534465,5973325155338360821,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,3026553857594798625,7842423171722617870,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,1326343416498647522,15362891229610445068,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3388,i,3908215451957647649,14862451539898697343,2097152 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,13014613755098384700,18351503797322696349,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3392 /prefetch:12
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,18084222859229150945,8699302549555993680,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,5956106359194952245,7633580278341909280,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4300,i,17724319172074107687,4115395809178630478,524288 --field-trial-handle=2088,i,12526952402617944133,15084373809509057635,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:4092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1243c728,0x7ffa1243c734,0x7ffa1243c740
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1788,i,16257356037891640024,1958885998565822200,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,72797583036702672,5023832966000139022,262144 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,16744735043462933134,6805642628062421398,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=1740 /prefetch:13
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,4393887877152773765,10651684687385135759,2097152 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,17969348502341897006,2594934848323490958,2097152 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,12438589871021131660,12755596832534201414,2097152 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,12262750660554004075,6855456013023725969,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5384,i,4771556604791225779,3871234484055890251,2097152 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4396,i,10947720790010004815,84355399184011971,2097152 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3392,i,11900816316348705557,2567702237695337342,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=3680 /prefetch:12
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,10697998413207822026,4410904338097965237,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,6696018135695289592,2795697155352210997,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,16666746859397748102,11430267486483311100,524288 --field-trial-handle=2052,i,10773052979420490735,8040867454629360296,262144 --variations-seed-version=20260527-170108.803000-production --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 1e4f54776b1b40b456dd805327615b3c5deffcf2db33e589d5bc6b52bbcd1933
MD5 56b10e1e74b6706b57dde96bf766dbf9
SHA1 56a34e375e70b12c244295648d6e0641f33011f6
SHA512 cf469396d294424e4fef7dd376eea71d95d97f34c8e8a07031474ca3189e64ade1b89bd27e7df381f2778fea721f119ccd253914777f827b6f0f4644ac130a61
MD5 SHA1 SHA512

Submit Download

08711752-ceb6-46e1-abd7-be17b79fc36f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\08711752-ceb6-46e1-abd7-be17b79fc36f.tmp
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5e43e58bcb56715beb323fd20ee38bb7fb933e1ab60d667fc5744f29613ca607
MD5 8fd2b41a68507fdb0d9b9e898148077a
SHA1 0807e867f59cf284de1abebfb4f1f86bd9725ec2
SHA512 12ea72ac93231a69fec28ae68c60b2645bac5a6e54e948e5dbc94a4f68504937223462b8bc431e1f3673307b24f840b7b62def4bbb13c01d2ed8aee397d69e05
TLSH
T1B5F0F4A6CD21AC3718FD1B1C74A50B4AF754136B2B8149AF3B3C920D8FB463F458582C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 648B
SHA256 bd5eef691d6b247ce47a444e0611f974955f1344632f8ce9e411ab164fbdf424
MD5 5de682f4cd6ea6d88e26f043d2f08ed2
SHA1 c49169d1a1043efee88d5bc913b205218fd5bfdf
SHA512 c7e0aa729378447de2410659b9c60c34fcac962e41ce54b34140ee4f44abe6f6a424c6b2e8bab55b360fb2ca6d6c0d09d0025e6b2fc6d78c7ed50ab2e5827f7d
TLSH
T11BF052C023C01C50CBE40EB314EECE6405A784B9B8912E0ADB8098887D03ABCE8CA811
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1a4a85ba9413d2e6108ac4239e892a58b6ebf3b3fd833a8e93188b31f64fd18e
MD5 3f64b2ee72ba9388dc1df62bff15eb2f
SHA1 1ce160c98ad9bb7302344fc345f821c60715e7ca
SHA512 fa756796ec02e0b07cf30a89473acf72e57138f8a8794e82c4c9d9813444ca779fd81ddf9b17815b660632f8cf04e22f66263acf2299f82335a5cb2965f3e5f5
TLSH
T1EF1168D07FC61D60DBCB1AFF54AED63559C74178F8902A068780D488BD9317DE89A852
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 4436b455f827722c07f0bd7c181d95319334d0a8765ac75835c69cb3942c0436
MD5 d4c7ce7b8b047ae670446b8e4015d71f
SHA1 4da274f7319171013f7021ddd73dde882e4dd5ef
SHA512 a7d2a70afa80631901c01f74429df2506d391412d9f2c40b016d034bf65dee22f41207c8c4ca5794721c8b7a249efd30137fc27742ffc7d0cbc311c64e497f0b
SSDEEP 192:ZcJA+r1reSrWrKQRAtYUAlOPA1AA1tbduN1pMXk7w7cbFs:mAiJnqZrUu8K71tduNTgJobFs
TLSH
T108D24CBFEA387933EF6918BE20215434DD73920E8D0E5C857C11C8221CB4E94502D6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 ff3bffa180df880434309ef894f5772fd6fee12d7038199e8a91fd5fcfec898b
MD5 9fd8e7203753c86168099cada7d1fab7
SHA1 06a31a39d1e4ba03e4ac80ff467cde3b6644fd87
SHA512 57f7da468fca668e0e4271426caa7b0e489933433a12e0396d657de2340ce11b86de8fa5e29128f0e9284187d4a2b6add8a3a7f00ce0011a20a16863866dcb79
SSDEEP 384:fRURs/tIkUI3ijVYWNkqpam5Mr66hxsmy:fRUR664idkqsm5Mr66hxsmy
TLSH
T1E0F3526FAE303712CDBDD1BA68E285A69C3DE02FC71355C97CA14471CEE2A52601D4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ea243cd2d4b8a0918e065e6d967a2af7e40f9a1b6e2b5de3d40d515f052add1f
MD5 79fa2beb3fa9640e21d6dc0b26db943c
SHA1 ddb9f3751dd7219630f90c68e966ff2129b7919b
SHA512 d5eb59d371463085fb1ccbd9eaf07944ea175022c6ca605e4234fa1c691deedc9a883d0f5a5c817448b9698b6846c3ac6e377917af7a554f4c6367515954ad18
SSDEEP 192:DJsyv9RSaJ6yVIZCfrujanBYIBdIXNAOsAXa:DJsyv9RSaJ6cIZCfrujanBYIBdIXNAOw
TLSH
T109E1BEF7C3D8C62DC81156F4AB256E1ECE2E0A68432C3D26C9D5EF4B93E2871D25065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 3ad8afa2bbef6de00cb7ef24ec8c31a79e6ccb74c5a943c1686c3ae618e14692
MD5 8d69d417501b31662e460fc4c8e2478a
SHA1 637ab896d4f7e2438a3f758016fa3a2614d6eaac
SHA512 d09349e9bb1aeaeeb1708c31a0ae15675e7353ae7a2b76aae6bd6c781309e55c78abd912eeca2a6a77290fa34bedc498863717fcc04dc9c8dbe04f3af11d1636
TLSH
T136F0C9A7DBB9B07320B808EE1D04BC095DB6B836068134ECDEEA813CB0845F31B0A843
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 59fd21e6680f0320215356d048ef173b0b90c83ab8a6689cd5d1d3f13a54a02f
MD5 be31a19cb0cbca524dccfa49ce1fac20
SHA1 5c9701234a74e67f63f8d1bf08d0a61252fd4a78
SHA512 72434060a5a7e0509fb3dc9fe5ed53c7a4ea7b80b8e36b5b5b6c371e3f330733f76c1f35435528334ebb8be2f96f7982ff516ae407073f869ed67caa6a65ee81
SSDEEP 192:cR2cBz/ua4lVlv7+pAPRp24HQJS99uHsb+WNKlyp4kD8QH04mbkwus+VyIsnAUge:cR2mz/OV6UX6EUwVPL05Me
TLSH
T1DF52C62EA950693B5CDBC329F9217767E7F5112762812E84F6FC8E2C14E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 896edafa97eb47b3ec3b1d795c35f083ca4dbb6c0d21abb15c05ce9b35b29403
MD5 540e4c0edc855487acaf3948aefced08
SHA1 b4e317073727973f8a4a0d1de490f216b5c79b47
SHA512 ab2e6bba714d48b7379751a8e85351544804723e0c980fcd7862c9cc771edd7eb116e7e93bf5dca1e017844f9138adb1ff92191eecab72f1fb727e7068d72991
SSDEEP 192:cRO/ua4lVTv7+pAPRp24Z/9uHsb+WNnyp4kD2jmbkwuj+VyIsnAUgtaJ:cRO/Or6UXbUw4P2wZ8
TLSH
T15D42F82EAA14653B5CCBC329F9227757E7F5112672952E84F7FC8A2C04E7ACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3059e1074b84203158215938e4e539721c024bc9f51a6bb361f41139b7dff449
MD5 d68cc94570d230ad75b4a0034b159be8
SHA1 34a0e0c7790f233b11dc421bff86ab238c875429
SHA512 2c87800f0783ff0a109e36e6fa8b32e4a60564669074faae05677427637f464009b24f8aa48465dfa287704f03f1db6347227a7f8be2e1e932a68e6b7d7ad33b
SSDEEP 192:cR2cBz/ua4lVlv7+pAPRp24HQJS99uHsb+WNKDByp4kD8iJcRmbkwusHPyIsnAUp:cR2mz/OV6UX6EUwHPTc2xe
TLSH
T16252C62EA950693B9CDAC329F9617757E7F5212761C12E84FAFC8E2C10E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 facc391cf673d247264e95d0cd5d9321f7b0f957b1bb0c7619453c5d2c1577f8
MD5 8cbcff8b9099dff3b1b9a99824e111d9
SHA1 cb37b721daf3f942cffb392fec4e795829991d95
SHA512 b04a1a603df7ab7f435f24a2e7079451effd0645ee476654ae6486392bec1e62b7bae9c5f3e2e5f390f309989367edb49b73c4b1053c6ad19a345dbafcf348fb
SSDEEP 192:cR2cBz/ua4lVvv7+pAPRp24HQJS99uHsb+WNKlyp4kD2jmbkwuj+VyIsnAUgtaJ:cR2mz/On6UX6EUwVP2wZ8
TLSH
T12A52F82FAA50653B5CCBC329F9217757E7F5112762952E84FAFC8A2C04E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 324bc3b9aabc91d125af1699a8f8cd9f18dc519862c4186b839841447914d963
MD5 7a7e71853432918460e66fd5765d8d72
SHA1 df9e81e5f7ad63b982c9a06c428255d19df5f334
SHA512 0f1a5cc01ca5210910dd1d34723632fd704489e7d6fab54c2214d133a688956d590f1e8049173cdbac49958a3eb1ac43f110bed8a24636da203118f6ba6c2fd3
SSDEEP 192:ORgcBz/ua4lVH9v7+pAPRp24CDC9uHsb+WNDlB+8B/lcvlEvmbkwusP+VyIsnAUp:ORgmz/eH96UXrUwtnmEsB2e
TLSH
T1D062C72FA950253B9CDAC329F9617767E7F9212762C52E84F6FC8A1C10E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 174df52226f5e935df52c4069cf6967abb1bea2627018c01ab03565bf78b3f6a
MD5 274bb6c1358dc6b85e1f74b5a36cacb6
SHA1 14cf5adf82c8ef7013cf3d9664851cfcab466254
SHA512 0406fda0a023bd689dcfd433daf6065bc34eab8cf3cc4f26ce905dbb80dde1e972a5450c336cd7496dbfe71f901f1cdbc5589fa78689b4b82428c2dbe679c56a
SSDEEP 192:OR2cBz/ua4lVHev7+pAPRp24CDK9uHsb+WNDlB+8B/lciJc/mbkwusP+VyIsnAUp:OR2mz/eHa6UXvUwtnzccB2e
TLSH
T12052B62EA950263B9CDAC329F961776BE7F5212762C52E84F6FC8A1C10E7ACC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 75cd9ca6f1ac6dd08605970166ade767f609b56c41ac06cde1aca8690677c20c
MD5 cc1ecaa55d0fa9f016eb1691314be89d
SHA1 2cde6a5f6fd7f0eafdd186148a2f4fe9a3626067
SHA512 5f6ad32fea11094f08c855752318deffe54a553c8c65f65a935616413b32099cafdec871da9c5df826ccfbf41fc3a6388a1d1c620d7057ed2c5cbec808dbf32d
TLSH
T178E0260139CBC6BD10D580830738E34EC7E47406D2CC3E0A1F84F68222CAC0872BA6F1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 03dcbddd60575b17edc60e64d90674268da1b3fb2a43a22ee51f74267127da34
MD5 cd1bf9aa4cc20705bfa6ef3f34ac5c82
SHA1 703a094fde8e60c091003d7f8d3164c7d91c8e80
SHA512 48f5030e5e02fd3d4c93cb92024966f7f50fc26ffd3f9ca2c8ff76f73cd38764a44fde168d5d8f6253da2d6a7c366a7c2f800eff071d21ebadc4fe740d2ac219
TLSH
T165B0124080415141C00202F41153148C72149F20AB0B1B0143F07D2288355908015160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5951a1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5951a1.TMP
Size 96B
SHA256 e1fa89dfcdf67644673b5ed2189bc585bb983ea19a559acae43a46d1d1418a35
MD5 3422e41fa5673993dc775177c484a260
SHA1 76a6e43c0684d39916024353f2fa6ff536ffdfac
SHA512 58cc75307f26f3399f23f6f13856ca380299fb98fe7943350e2d66aeaae73cbc5b62d709efdf605547ce736e8684be025c57774116b52ec65ea90cae9237ce77
TLSH
T117B02228C2023302C00203F02880C3E832B0CF30C203A203C3FC0F22CC202200F38820
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13424439084501976

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13424439084501976
Size 4KB
SHA256 b4a0106260803140fa1f2d731c2f97525cca1aecd75cbe3154b480a1eccc4e5b
MD5 0c86de3c001732dcc86579735342e1b6
SHA1 8a3e2ec047647b13dd733d4bbb0cf39a1b99b410
SHA512 7d9d8947b4162b4381863207c94cbf74a61af3c5ce054768b3c5f6d0e06220c95496c651c26117edf8eb35a0ef22d15436b280a52ccb3f43d4e9383d520ab986
SSDEEP 48:3Z9oaieiD8GNipHUqoe1riMfVwD3zlOfpEwD3zlOf1j1rx9zrS9hw5q1r11rFhLH:3ZkGrQDYpHDYnrLzOprzrbLQ6yFwF
TLSH
T17BA1D072B6F0423EF37F897989B562F5AF76B90298818C4F646241050C73F424E75F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 35d3159bd0ef7fdb7dd78e2be87a6f22e2f8326fff9676c5aa9c4f85edefa48a
MD5 41eb7ae0125aa7fc0927cecfd546e22c
SHA1 977a3c7d625f853e75b9deecf7c990f6ff03e1e4
SHA512 c583a328b5fcfa4f96d3c911b5f5c06a145aa6e11e60cc75bb7882625d104e710854750cf72bb69a0a25848c48a9780cb743d104fd1c7d3d39447bfd8ab5afac
TLSH
T1E1A0021073C13C05CC4116F410C18A54A658AC1461498723A5901154CC677486285040
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 d884dcf696201cec8543f4df40543b6f71c3f3d12d6e1322a26aecd5341239e1
MD5 149d6571367ed118e629993b58f31c65
SHA1 087fcd5d3a60985e33ef05992bc0c0cc4e96f53e
SHA512 f726eec247ac627e7e540af15d4ff3394b4d59eea18b46ab43b88cb2bad0299b6a224be5cfc421a7332c857b332523bdaa89d11c5f136ccdbb391a35207a7bad
TLSH
T1A0C08C483B60860AF8C41B3001615B909B84F8A2517224B3EC146E20CC4FAB42E88C84
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 89f6eb97672f0755184c7edb9d69bccfbd5dd434c97ca25258c42e284dc2878f
MD5 ec2e93573d6ffa6faa1a0668b47a32a5
SHA1 34592643bb0cb5460ab2306b6f8f2d40c557cf1e
SHA512 b65b0eb347e611b17635c932b7b8ba3f7fbf749cb5be57bc004ed322308c46752caed9d36774273b6454062241967b08414baa1cb0610951d7aa092f65935516
TLSH
T18BE0DF2136CB8B6E11C6809B6339F34DC6E17405E6DD1A2A2B0CF180628A40472AA6F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 6e8157a57467a04100431116f842dbe0503ed6ea4d1ac4310f93c28c7d507062
MD5 eb55405a385f2a5405bc419c6b41c13c
SHA1 c82ad133584758014910ec3499815c7e027bc450
SHA512 e3082a3ea6d0243bd64fdb58124d7388b1a860ccfa9482a2d52fd6c906f9a99af23549b9c02b1b4b03fc680819e261c86d7a0fbec0db432b06acb9336f8e1413
TLSH
T14DE0DF7569CA8BBD00C080828378F75DCAE06809A3CD2F0E470CA884618640461B92E0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 c6c66906fcec07aeed99ad983dd7b1d3cd24e6bfe79d31371f795b38c85ce552
MD5 49fcb339b2fba10febfe6e28e7238556
SHA1 38d8bd4df960073ae7ecd1eb97ee4ab649efe252
SHA512 ab385a410bf1e49f6ea83efca88d532d034c75143f1b2462f456222811d8e174ac5560f80d5e723634a1b1d522c541597ab0331f6ae28132b5642156135af706
SSDEEP 6144:uNJxPWC5HRzG6lrgGrCrwCcmXKegIh6jh9Jvexhh:a5oIg/rwCHHgVUxL
TLSH
T1D4341267616E3DA984BC2BF7351F33494BE3AFB12E00F45BA048CF4A0196D6545DAC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 75a5df25ded99f802f8ab6229cbff116e725bc3f1bde0bafa044604ac3c05faa
MD5 c2b11131ac5b16ce7002a7b159b53e6d
SHA1 3efc5f06b1f842cc1ae7641d80ab4445ff2e0d4b
SHA512 fce2b2c03f42cd0462004dfb8d914dd7cf5fde80b16c87a5fdb87c77a0abf80cbc0eb67fe5db0c7ff29ac1af4c4f69db83ab2acbe9de913405db573b36bff12c
SSDEEP 3072:RV6CJxPdr7srKaC5oqVEcxmapZG6NsI5NGpGF5Hig:3NJxPWC5HRzG6lrgGrCg
TLSH
T124C31273F2AC3D79507E13DD211F220E8FF2FDA16B9059A2F6898A5D126351687C1C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 30ad5be209c1b8534a3bba707c56ead226f3dc287c489c76c6ae19a13e34f72e
MD5 c6705d032dc68b4576b5072765d651d9
SHA1 90f870aac0308c2b0d3b573c9bcbb8e7d38d5775
SHA512 55a0cae0074801ef035570807bbc3689e331e8a3eea2418eee7b434c1cff0d8b66a9aeba78372d31b186072a0ed945fc6c8661ee1260ad29433767972d10918f
SSDEEP 6144:vNJxPWC5HRzG6lrgGrCrwCcmXKegIh6jh9Jvexhh:j5oIg/rwCHHgVUxL
TLSH
T1D6341267626E3DA984BC2BF7311F33494BE3AFB12E00F49BA048CF4A0196D6545DAC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 cc96453750cc1e538ae85f641bd4306cea9cb2fcee183bf18fd8f3cc481cbf97
MD5 ae9068ce91f1c060f186f9f7e52df1d3
SHA1 4fd13680fa9c22a5faf641e5a178f12b90d94b48
SHA512 043bf3ad1468e9d8ea49d7486c0b90c4bbd76c08cceffa5d62d413c7df35722ee9851bb7356d2862b41338b4c7092203547e084914e15fd513e81973de3265f6
SSDEEP 3072:xV6CJxPdr7srKaC5oqVEcxmapZG6NsI5NGpGF5Hig:XNJxPWC5HRzG6lrgGrCg
TLSH
T1CEC31273F2AC3D79507E13DD211F220E8FF2FDA56B905DA2F6898A5D12635168781C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 55a348b6959456fe1fd91380ebf94f547a8f8785b9dd50587539415593f94426
MD5 56107177df28d0a0608a857d666aa107
SHA1 ba3d464138796358e6a8eb77da2d136e0fb0aa48
SHA512 3af75c616c0d1dc2af7b156b33215a0e9c4bf80917d75e06fdb131ae898fa2e8541aeddddb903f51f86fb53b8c143ad0fb298cbf51a4902ba2ac2820b376d894
SSDEEP 3:MsEllllkEthXllkl2zEkluRUKl/:/M/xT02znq
TLSH
T17B4404147FC0040DF54030304011C75013F1D43005115743755107135DD75404C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c07f2e8c-eab4-4394-acf4-83f72246c370.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c07f2e8c-eab4-4394-acf4-83f72246c370.tmp
Size 115KB
SHA256 6adced9fa9d634e509fffcb8d95dd7b5cee1e902e8dee37d06c074bb573f3052
MD5 4f4761a20f06f18f4395377639493dea
SHA1 abd832c1a82e2e859b03b44110c5526dff3a4db7
SHA512 341d4233b426e1700b0dc49ca66d9a2afc337f27bff22ec0dddda43eeae233a5f9c19659dda1db29c5e0c4541590e1eaee9a880ac13345be9a59d73825402383
SSDEEP 3072:28uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:QwCcmXKegIh6jh9JvexhQ
TLSH
T1F0B3125A29273DA68CBC6EB3B453338286A353A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 d92e52d40a6d8a3b067dd6909f516a08ccf3b65fb123275f1ab2cd18377efdbc
MD5 a071a41ff38522723d050ed405d578b7
SHA1 075d6ad1e3d198f540e0ca43f94b01848999725a
SHA512 e2a730152dc6b51f879c831e36527a00b4f314318f884f41a814549414b8c95c384a443b0b8c215bfb1ec223448f47243bf8dc98a5f971fb46c162e8bac8cce9
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JI:TkkhCU2QB2zbBxxMyYT1rd61rqf
TLSH
T17A23CF5E6668619AD196583EFDD28E607C7E4F49CA1B6CC218D009764CE14AE903E1BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40573910fab125adf4933fb84617c5cf7cc13848869d9d4fb8be4581f6087ade
MD5 0d4f5dc1610db60a46903b48953f9713
SHA1 30bf2e7a2487cccb955f61d4e321da300791301d
SHA512 c4c81fa45556b8a67128d368d6465978fb0df21157252ee81a7da31774808383511beea77c7b0ea3673ad5b17de9e6413a7c188f4ac46dfe40e6163a4d92c9ef
TLSH
T1D3D0A7582E3664D5E774113908D586442BCC64860305256616D91C558CE14B244809C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 202KB
SHA256 68a531cbf30989fbaad05ab3c4b8c47133ccf6a48a16beb30737d2335292ca23
MD5 38073584987c6ae6e24e89e123319da7
SHA1 f0b36c86b4f064adc50c721e7140c06fb995f08a
SHA512 1ed0058402f430d9862d200fc40d5c359d22c79a89926c7a124c34be5722d073243ae1314d9b54a167acabd62aa347e514d3e894d5c7ede440d1ad85b8e7197f
SSDEEP 3072:hNwNckLSLseINygmh3P+PericgnyCyyneg4+aa7P46i79Y5MxnXAJ/RSCJjN8xDG:/FkLSLbP1+mOcFn+z4liRFjNCbuenb7e
TLSH
T19C1412270BC178A4C886DDB3503DE26ABC17CF5AAB319ACAB5523D9EE3307C15B1550A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 196724db9d3b975c2c8b3e52899962afe7ed0dbd7bd42dd617d59bad96fa007f
MD5 a905cbea00fcd7b0a370b78c30a1a7a8
SHA1 f417ea9c19202517e3103904d317116daaa84a24
SHA512 515d0eebf12b8aeb483ef0715cccf0d3894b60a5b582920274f98cc5641e005790f70ffd98f8f1b8b30d48203010c2e706a1893e5293747369ef6145d0c180c5
SSDEEP 96:45V7KF6q+4gW2L5BaWLQiaBOB9Xz4/6lhhJ9lAMY1L/frP/3iEyM:45V7w6v4gWGaW5aK9XXSfL/3ivM
TLSH
T19BD1F914A7EB7A71FB940930B4E22A2BB93174790E072F0647C55EB910ABBD5CD588CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ec30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec30.TMP
Size 3KB
SHA256 29711a697e249ca305f930bf174c529b9280fd0a575b1cb29fb0a2cece7886a2
MD5 75819b0009fa22f80ed5129493dd3704
SHA1 fde21cb4089620add1698835eb0cd842798195d4
SHA512 d7192820e8197e16522c4d109613dd1f1bea148c582d5f6efcd2575900c2ebfbe7af48fb0f704b26c19fad193b06494db94c3debf22ec86897273dafb5f982c8
TLSH
T1EB71A11936CD47A2F3600E31B4E327967DB5B4B909873E1640C09A3A61BDFE59CAC4CC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 ef7aa6a270cf4af67924a68281437b181ace66b2b7e473f7541cf8bd9490b602
MD5 9f10f5407ef8e9ea6704c208b2e4727e
SHA1 299d503876761b034325aac6b6feaa6124d95a63
SHA512 51b7c67006bd555fc0922c488051adfa44fb21e23d903bdf48a48d2e3b2387cf30fd1bd3c926f5e7495441d30571d0abea8b8da0c907dad3894d650ca2678283
SSDEEP 3:MsEllllkEthXllkl2zEkl6B:/M/xT02zn6B
TLSH
T10C4404547FC04D05C50010304051C3504370D4300533FF47355104135FD75405D04304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ba95702bd8229e33ecae2e00d05a195eeeee14bffc9145743da8031ae74187c2
MD5 432c6a5ada241e601db28b6cd23b2f88
SHA1 f38d844292c53a9b4f7f1d0c9b7e95a75313b7db
SHA512 33d1670e2b3706c6cca12746dc22c2a27a6ea5a51656ff929fde1a04d1397bbcfa2add37b1c14a9827d4fd6a5ea1836fa568f065d6bfb14b85522db9ec6dc6cc
SSDEEP 96:D0Oo4SBdnDCz7aw0ijPzEB5Bs5HzGO5+t/DwfGwvo2A7z+J:D/o4SBdnDCnaRijPzg5mT75+t/D8Gwvn
TLSH
T1C5C1CAF3C3E9866DC91196F0AE146E1BCE1D0956436C3C4A89E4AF0B93F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 28aac1742e21da39e3bb32ec39dc00053c253de552c7805ed3a37815f1b52c2c
MD5 b9559971ac0ea301c2ff4437647240f3
SHA1 03b75399d323a99f2722759d2aa807a3748d29d0
SHA512 832f0f33abe52643867db07db8283aa4444455a0cd6d95135a0ab52e3f0f2bedfd58f506579c99ab3d99412557bc8567c43e4b3c8dd4771ef3e31ad1209785d4
TLSH
T14ED02363231131F5756CEFD95055EC4FC326101C1C45E9D550E0545C0D3945D150B541
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe589bfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe589bfd.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3b47b304c2d38a871e69d718bc6d1b5d68d9a5e99a20ef14b4e664fc9bf28a6c
MD5 5027450b3ba10afb292d894f45f17659
SHA1 096d8cda901826765e9ee06ab521e83ef540ffe1
SHA512 128312fce5c7a1b30c43cfceb28aff0a551245a83cf07622e8bfe9e147e8e391a59adf460528af0fe02e38dccbffcbf393b37c6bd59719da5885c35bac8ba9d8
SSDEEP 192:sxZwQUnrR4yM/jK1Ml8M8OV/fGsWrs9uDeb2br3dpjT+/W6+WNBUr/Y00IyGJIgc:sxZ2nrKEOV/fGsWQ9AecDO/bC/5Vc
TLSH
T18F720902AA3449779CD7D218F902BB53DAF85567DA944E44EAFC8A0C04E6BDD2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 71a485891431a6c602b310fffaafc1c6555a74b41556625e4ed6510d90017bec
MD5 36466040844e9a55bf23074b8ecad1e9
SHA1 bce9e2a698639533b93cfa6c7d01db2915dc3076
SHA512 499d616d4746ae40e56159310f248e686cb98d25e24fe7d0a3b6bc0b7aba44e0bdff8f42a7c34ca7041c08f3fc32e61987bed85bce7d86c595b4b598fef6b0b2
SSDEEP 192:sxZwDUgR4yMojK1Ml8M5cB1V/fGsXrs9uDebYbrJadpj09l5/W6+WNbEeuXY00IS:sxZ5gJBm1V/fGsXQ9Aemom/bMX52bq4
TLSH
T19B82F81266308977CCD7D619F9217F57CAF85427DE950E4CAAFCCA0C04E66ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7ea5ee0ed21c3e7bf1f1c05a3635a77db7ebc3d407759c2105f4a9bd40eb25d5
MD5 cb594ea3e8e639e874dd70cf340612b3
SHA1 f25f5267a12be06c7ab41a1ccbced445de026f8b
SHA512 cc37815e4d60f41c305d673f31003eadb55e8eadb9174292d05c338596f90315cae4e92b128c4a5cc611cdc3f28457260328cb83d2f3d6d31bbedac9135aa95c
SSDEEP 768:SJ/Xh8dF2v/7pLuLXwkWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3QyhjLlC:SJ/Xh8dF2v5EXwkWRmwcQDwu1jaKQyhw
TLSH
T12E032C7B2C0CCB7F4F844E9CEC26BE9A6DE8028B9698895447FA450C03C67EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 1KB
SHA256 52918f877dc3385decc6cadea34d42a106f9106d09c3e08bcc8fe9d9ca255988
MD5 5f2dfb97903e0a84e4d45929dc91d891
SHA1 b252d2a6a3781743bff2ded6f0b129a4d14e55fb
SHA512 d05c46da813f4c931a3a687f62ffa163f839d057902b0dcc81e9ce334bf2b4d0dc48cadc47d95f93dca982fa444a22732b2b2e9a509c7c1e1876a3a285fba78f
TLSH
T10041864E8D90CA5FECA440B611BB79E433B48DCC0B62B6530CBC1536AE6732E194B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 3KB
SHA256 1bb8055ccd30a2eae055c91aa23eac9a52ddc6786936a876afaadeb94755bf6f
MD5 8e696d85d6138ba9eff3224b9481e90b
SHA1 e4351d0baeadce3836f047ddadfd12d79b0d766f
SHA512 2c03ae5b79be79c0b15c9ad7668f828fe9606b7cfc4a72839875fab8b38b75882257a1d0dc459aea000cc389f9788d67170680c8a834be175d8edf1f2a315409
TLSH
T19851B50E4D8716A6DEA842B290B3188533BD59CD3B428E1B48ED5035EDC37AB282DA35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582352.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe582352.TMP
Size 1KB
SHA256 db91478a7740868a1561366b67e58fda1347191d40ea5796c5915e8f9450953b
MD5 0d7a0fc183d402bd505c3ad487ad1710
SHA1 7780ddc633790ffd1c8d34997673490a05647210
SHA512 068d15bda85e226fe59fb3d0102117469f275103db3041ce3f5cfaef0e6257fbcc339deecdd654beffc438846b6358afad11076ebf398a92ad216110d83bc2c5
TLSH
T1D441685A4D908A1AF8C440770AA7A4B8333558404711B74364BC5135BD617AE2E5E0D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
Size 72B
SHA256 3e1f4894bd757dfb093c39709e69ed1558aaa58d0f767e11058a4fad0af200c9
MD5 db831fd2fad12776017df24a88ec57cb
SHA1 106eb8fcf3fc3d7c9bb8e2c9c915863a6ea876ab
SHA512 e295d8987b7419e4d3327575226848505f3d50734fe2de9022f1ca4d1cc7c0fcd829d8b2ec39b24d1fcc1d2f13b13535d01ad9a25d0f3c73edbb8cb5356cba94
TLSH
T19CA0021993D1B107D10656B635D6416122225DD01209336641D104CCD8E4759574600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
Size 72B
SHA256 014096952e5a5a56cfaffecbf0f39b71e95e0e3357291ae01b7e6914f1209855
MD5 f1a15f5076c99c5c90d79f6e7066b2de
SHA1 db1504673607730016f2f0f6de121ab5315ea55a
SHA512 ce8130bbf9732c3c3f05f640110208091ee1f877aa17859444a9d901cad8c73601c7dbdacd1042fb974ca133d31246b0cf472f0b9f3694c62c304214cc1ae5c5
TLSH
T111A002109B91004DD01226F159A703521352C8D41101131740E54144CC508444F9100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53647b39-565b-4d48-a325-961ff48ffc44\index-dir\the-real-index
Size 72B
SHA256 ed5d946747ac29996f37a9c65fd3b87fa232a47dada648d302515f5add9f8be1
MD5 c719f964ae58834978bdc9cbf83a006a
SHA1 c8d486df2c8e226da02da01bfd44f8e79ad44f43
SHA512 44c1a119bd0f7f277ac042e988e88b285434401973c2d436f3493549b649df49df2e7f9c027aca29fcce08be9a49d26f54f2b11c564a0bf0049869cfe65440c9
TLSH
T13FA0026917405241E00417F2B0874151B7708CD5726517C16193C444AEA51558B070CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ab20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53647b39-565b-4d48-a325-961ff48ffc44\index-dir\the-real-index~RFe58ab20.TMP
Size 48B
SHA256 221b506d3654efe026e95a1fa9019da931bea378ce76de2b5fc66dd49cd72a0b
MD5 413ac278ccf749502bf8e99fbbdad41a
SHA1 46bdaa0ef24b1aef9121a9b0e3dbb36e6a62d1be
SHA512 ef15893488700ceecf92cfc4add328d228987d339b875b6b9d6d9cf63f6be733c60b5a85801d409f2b79a257b4325112a0a60cc6e78deb806f355d17440429bc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d468a0c0-c500-42e2-a6ae-6e3ccc9723ad\index-dir\the-real-index
Size 72B
SHA256 06eace133c3852881b2767a5fa1a17c386e9de909ca97a4625bce4d24940216c
MD5 88a5e6d610d52fb79dfd4c4087f7c829
SHA1 76f2899b9f813d31685f653c83e430a02e37f0a8
SHA512 66538bd1d94a1ea219fd96d33ffaf2df1de39fde5c31892885870e7b251e267a8f979d0f16d6835b8ca718ba5a3c1a69abf26e785591a523a8a1fd17d6d8b584
TLSH
T105A0026162E410A1C2B54BFCA59212666365DC29050B43054CA40D6AC86916A450506D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 4b6aaa19ad2cd43d33ca4e6fd3927b2dd5cd062bdbee0084a163469ca82304d6
MD5 86b7226f3dcf6c27166c9fef0d9601ff
SHA1 670b0319febb028ee72efb06f108e90f6c88740d
SHA512 7cb93b035d8c4e376c0878e833dde216e5958fcaeee92eef23580e87d506d13258944179d0470ce930d5730530931a00ac7630796ca48bcae08d71919333517f
TLSH
T198F0E2BBBFF71818F8AB92D6107090A00144BC588586ED4E200AB6DB60B2356210DD61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 147cb8306ef98faba8d0c3520cb8a0544485bd1e7701b315542b7261eae6d218
MD5 ebd4bcffac0e780ca5cb6ac5a92d9752
SHA1 eab434823e4e4d81f70f2f717ab112b204489f88
SHA512 644c26a9093e78351b741e2be6a03d0feed986042893793699c088235ed014a7b8a12016c23c7aa0480a7b8e34b00b49ecd42ee2157d135fff61bc89ff7d7fe4
TLSH
T16DF0E2BB6FF71818F8ABD3D6107090A00145BC588599ED8E240AB6DB50B2315254DD61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e0cfdbf88d264a1f42af9c492e50210ff62c56a47a9b18cc0fe98ba994bbe27e
MD5 1ce9fa19b422aafbabb614f573079bf6
SHA1 08408724c372384beb8f889d4479d381173cb586
SHA512 8ab64a1959de6f04948190fe0d962c891b0a88edb4f4aa47a869b57063b7c9e4b78a90f59f26b43fc6d079ea8b4d2bcd24a3c0396d91b93d69df2e35bda554c4
TLSH
T140A0026392AD7046D2084770A2C101D6322088940A09263250B504B5E8D8342411321A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58776d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58776d.TMP
Size 48B
SHA256 97747516d38b0f443221716b74999d52fcaa07b666167a68fc5993b9f8b3c060
MD5 ec667977e42670fce6561b04dd58198c
SHA1 a35196964838a48c8ae4860ca7c84fc0ecdf5c57
SHA512 3f087994252a6d866bbbfa2eeca58f4c0fea7fce4cae3ac0c554197f93da6c96dba02c8d3a128cd9694c21dee2b5c5effc7102a0a2fa70ac28a83d7891e27ff7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c3791df12e392933d37e3275971a6d6a7d1034d5fccb70e3c2a215af7936979a
MD5 f8172c48edc486fca3ffa92762d49e95
SHA1 20b724175e7fe0c4e1cb2b3c11820d8e73bda535
SHA512 30a62cad923b4594ef23c1c8e48c2f0168285dfcf5798c7fdfa19424d81c9a8041fac09e3eac6fa8a90e7ce9ee1fa4bee0b34fb3837b507cec722dd41dd3bc4e
SSDEEP 48:KqlmpVTfrk7f0PI0NkKRBJLk9102UT15yxMIfKxGsEWrPIZKsgULyZc:KU+AKTyGyMYKxGmPqKsgyac
TLSH
T147A1640276BA02023C7E2A0C9292A7175F41F1633159AD3B77A945765E6BF211CFCACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 53c44a4ea14dd6570f7d292cf0824d86c58eb05f6190efba534438387235e481
MD5 0ac22492a5770a8c9f705886dfbbc190
SHA1 7316c898a9552ee5d30d64dc4dc8477a7c56498a
SHA512 bbee162ea2e4048af2dcd40685cf57d6342bf20d5cabefc632433cc7483df8844c28ac85739be406674f1d07a18d54810ae0faadf3bb5bfb5305685452676090
SSDEEP 384:yetNnNnb9+8Nx5TpXiSUFsdP2r/E5nIt9ZUglGFBWrvAKRxhp6BSTK3RlUVsCB:JjZbEQQsJM/ENqXlepKRxv6BST+R2lB
TLSH
T1ADC23A7C9C659D3E44AF7708BA0E2A365D68023FC9F04D58E7E90B0EC2B265CF746426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 320689e0fcf0050377fb6c6c2ce7f49374773030152f8c5d508ba2ce50df2478
MD5 16cfb73d5a3d75ac1ccb28c723ff9b6a
SHA1 2027fba6fb4800fae916326dade7acf8cdca4b11
SHA512 7f25b68fa316ab184f60301f13fae1e01f30d792a518d8db3c1fe9abb70e74e7c3470089aab20e60cb595ee8348bab6707ad8134454ae1754b9c2b427c01340a
SSDEEP 384:z7tNnNnb9+8NciTpXiSUasdP2r/E5nIt9S5BSTK3RlUVsCB:HjZbEY5sJM/ENqS5BST+R2lB
TLSH
T1A6926C356835AD7B9EA79905B50B7717AFB8427F5AD01E84DDEC1B0E02D728C130683A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 53ab28e9384f20cd6938da9948ecf24071a29d5a6efa9595aab529823bcd0280
MD5 628ae124b5b9db9904f56b8a0ddb03ea
SHA1 c2c9d88ac1a9c56c8858b9a8f1e770d945d9edeb
SHA512 f5d0d19ac6e10a5648134550ee15e7644d183024fe09467b90d392a9e9d66208087fd31f1bdb023a79d4084f56059b094c1c0256118e0b97c046e3a4a7b395b6
SSDEEP 384:y7tNnNnb9+8Nc5TpXiSUosdP2r/E5nIt9S5BSTK3RlUVsCB:ejZbE9fsJM/ENqS5BST+R2lB
TLSH
T189926C316835AD7BDAA79905B50B7717AFB8427F5AD01E84DAEC1B0E02D728C130683A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94f0a9c7f36ba0eb4654cd1e7e4ec1ec2e6443785161e3d3bdb3e9be8e4dc94d
MD5 d81db83ce6609e82572cf6f2a9ccbe7b
SHA1 b1ceb1da93ae158dbb32c8962e654bf86da2b450
SHA512 518183e509c9df48fca6135a5a6f4a9e8a8d10008c67a2fa23488e1e1eb3e9f56cb314992d2f4b69cc6f4848d9513981b991e684e0d5e2cc770ef4311ab1ef6f
SSDEEP 192:1GN26t6H3BQmiUy7HBHM2Qq/rUH5m4hJGD9MkDU6:1GN26MXf0y2Qq/E5nJ+U6
TLSH
T13802E8347868ACBB8DA39E05B48677139FA5217FEBD55F88D9E81B1C01DB68C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 28e572f1d789a449dbbed26c24a52a07c68a15351e6786a6900c75b54fa65049
MD5 2559067acfe26280f83dc647a6eee5fd
SHA1 a3168e79c1a391a1fd962dfd6b5581f669880165
SHA512 b2c1e510406f5601a34cdbacae608b1f245d41334748406e203fab6aed19d5c5c05443e69ff06b566cef537c96939b9012348a3a24dcffea269a513ebbbc6f58
SSDEEP 192:1GNl6t6H3YQmiUyr0M2Hq/rUH5m4hJgtRe/9nt/4R5U6:1GNl6MX4+2Hq/E5nItIS5U6
TLSH
T11412E8347868BCAB9EA39D01F44777139FA4217FABD50F94D9E91B2C05DB6882306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 37745eb95add7ca2d46f230fad0fcee8a37c0e39dcf221de673792201057a2a6
MD5 c1101aa4ea5e57de21fdf45a59d19827
SHA1 016d96ea7f64004219d2dbc32d5830ee78fb32ed
SHA512 e136f4c6b0f297f21a6ae90908cdcfce160d3cfa672bb35c3615b8d0463ce3a2177d4591bf3e7c73c895ee6a775c0c99c4a672201f917196b6e2642ba17fd92f
SSDEEP 384:y4tNnNnb9+8Nc5TpXiSUWsdP2r/E5nIt9S5BSTK3RlUVsCB:VjZbE99sJM/ENqS5BST+R2lB
TLSH
T1CD926C316835AD7BDAA79905B50B7717AFB8527F5AD01E84DAEC1B0F02D728C130683A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b32d211ab54b65d8a99dbc84afc38237f38fb51de4794a0f18c03282d26a06ae
MD5 299cd5b606a102b23d3bb330565dd8a5
SHA1 1e52fec469b11b2211eb366862c299fff3afbf8c
SHA512 1f5dd758752941600eaa4330856d0c2fff42988864ad542e22e25a3a7257eeb091fe52dd35b6ea35ddb5badaddf5c233ffb48f32c1b4571025bf4600e2926fbb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe588fa8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588fa8.TMP
Size 392B
SHA256 a7fefd6e9698e4034734e489ac13ff58049c86eef76266538b3cdbfba427479a
MD5 164d309f591f62317d737df63ae4519d
SHA1 2164110ce4e1ec85d7cfa559925cc56eba501e2f
SHA512 f99cdf5c56d04e20f3834db2b7575c543301ff501cd3182c75da4708d2757002db25893e493bd5f3a4b98eaaa78b4c1b5c7ea2d376181e5aa34d9bb0524711e8
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

444a1bed-4d3f-4bc2-91e7-1ba80bcbfeac.tmp

Path C:\Users\Admin\AppData\Local\Temp\444a1bed-4d3f-4bc2-91e7-1ba80bcbfeac.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea487db9-f04f-4ff3-89c2-91213e3e48d4.tmp

Path C:\Users\Admin\AppData\Local\Temp\ea487db9-f04f-4ff3-89c2-91213e3e48d4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1500_1577087875\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc8d93d2-a60d-4dd1-8fa1-0f9b9e62942c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1500_389896164\fc8d93d2-a60d-4dd1-8fa1-0f9b9e62942c.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download