hxxps://urlpad[.]net/#plain[:]H4sIAPiENWoCA3XMuw6CMBhA4VdpiIEJihUJgRA3Vyc3l9JWqBT60wuFtxcfwOWbTo4MBqVPI1EyOAe2xjiEkHGjodNbxvSELVP4LfF8VcWiy4oyMhIKVbnllx7P2gmgHCCbrLwZNYq9nZQdts_ubZ8PPaFFyThbO0LG2LpWU0uC9iTmqj0nKH14d5dKoOgk5rWmAJw6-rKCeeOB_65Rgw7FJlh2gLBEf1OEl7n5ArhAKR7SAAAA

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://urlpad.net/#plain:H4sIAPiENWoCA3XMuw6CMBhA4VdpiIEJihUJgRA3Vyc3l9JWqBT60wuFtxcfwOWbTo4MBqVPI1EyOAe2xjiEkHGjodNbxvSELVP4LfF8VcWiy4oyMhIKVbnllx7P2gmgHCCbrLwZNYq9nZQdts_ubZ8PPaFFyThbO0LG2LpWU0uC9iTmqj0nKH14d5dKoOgk5rWmAJw6-rKCeeOB_65Rgw7FJlh2gLBEf1OEl7n5ArhAKR7SAAAA
Sample260620-gdccdaev9s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3648	chrome.exe
3248	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264076701097350"	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{F67EC176-839C-407C-95C8-B8474D9F0F83}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\notepadpp.msi:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5220	msedge.exe
5220	msedge.exe
5564	chrome.exe
5564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
3792	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 5104	3792	msedge.exe	81
PID 3792 wrote to memory of 2912	3792	msedge.exe	83
PID 3792 wrote to memory of 3248	3792	msedge.exe	82
PID 3792 wrote to memory of 2912	3792	msedge.exe	83
PID 3792 wrote to memory of 2912	3792	msedge.exe	83
PID 3792 wrote to memory of 2128	3792	msedge.exe	84
PID 3792 wrote to memory of 2128	3792	msedge.exe	84
PID 3792 wrote to memory of 1588	3792	msedge.exe	85
PID 3792 wrote to memory of 1588	3792	msedge.exe	85
PID 3792 wrote to memory of 1588	3792	msedge.exe	85
PID 3792 wrote to memory of 776	3792	msedge.exe	86
PID 3792 wrote to memory of 776	3792	msedge.exe	86
PID 3792 wrote to memory of 776	3792	msedge.exe	86
PID 3792 wrote to memory of 3920	3792	msedge.exe	89
PID 3792 wrote to memory of 1040	3792	msedge.exe	90
PID 3792 wrote to memory of 3536	3792	msedge.exe	91
PID 3792 wrote to memory of 3784	3792	msedge.exe	92
PID 3792 wrote to memory of 3920	3792	msedge.exe	89
PID 3792 wrote to memory of 3920	3792	msedge.exe	89
PID 3792 wrote to memory of 1040	3792	msedge.exe	90
PID 3792 wrote to memory of 1040	3792	msedge.exe	90
PID 3792 wrote to memory of 3536	3792	msedge.exe	91
PID 3792 wrote to memory of 3536	3792	msedge.exe	91
PID 3792 wrote to memory of 3784	3792	msedge.exe	92
PID 3792 wrote to memory of 3784	3792	msedge.exe	92
PID 3792 wrote to memory of 4844	3792	msedge.exe	94
PID 3792 wrote to memory of 2772	3792	msedge.exe	95
PID 3792 wrote to memory of 4844	3792	msedge.exe	94
PID 3792 wrote to memory of 2772	3792	msedge.exe	95
PID 3792 wrote to memory of 4380	3792	msedge.exe	96
PID 3792 wrote to memory of 2996	3792	msedge.exe	98
PID 4380 wrote to memory of 3076	4380	msedge.exe	99
PID 3792 wrote to memory of 5064	3792	msedge.exe	100
PID 3792 wrote to memory of 5064	3792	msedge.exe	100
PID 3792 wrote to memory of 5064	3792	msedge.exe	100
PID 5068 wrote to memory of 3784	5068	chrome.exe	102
PID 5068 wrote to memory of 3456	5068	chrome.exe	103
PID 5068 wrote to memory of 3456	5068	chrome.exe	103
PID 5068 wrote to memory of 3648	5068	chrome.exe	104
PID 5068 wrote to memory of 652	5068	chrome.exe	105
PID 5068 wrote to memory of 652	5068	chrome.exe	105
PID 5068 wrote to memory of 1800	5068	chrome.exe	106
PID 5068 wrote to memory of 1800	5068	chrome.exe	106
PID 5068 wrote to memory of 3800	5068	chrome.exe	107
PID 5068 wrote to memory of 3800	5068	chrome.exe	107
PID 5068 wrote to memory of 4124	5068	chrome.exe	108
PID 5068 wrote to memory of 4124	5068	chrome.exe	108
PID 5068 wrote to memory of 944	5068	chrome.exe	110
PID 5068 wrote to memory of 944	5068	chrome.exe	110
PID 5068 wrote to memory of 5188	5068	chrome.exe	111
PID 5068 wrote to memory of 5188	5068	chrome.exe	111
PID 5068 wrote to memory of 5264	5068	chrome.exe	112
PID 5068 wrote to memory of 5264	5068	chrome.exe	112
PID 5068 wrote to memory of 5816	5068	chrome.exe	113
PID 3792 wrote to memory of 6116	3792	msedge.exe	115
PID 3792 wrote to memory of 6124	3792	msedge.exe	116
PID 3792 wrote to memory of 6132	3792	msedge.exe	117
PID 5068 wrote to memory of 5412	5068	chrome.exe	118
PID 5068 wrote to memory of 5412	5068	chrome.exe	118
PID 5068 wrote to memory of 5788	5068	chrome.exe	119
PID 5068 wrote to memory of 6076	5068	chrome.exe	121
PID 5068 wrote to memory of 6084	5068	chrome.exe	122
PID 5068 wrote to memory of 564	5068	chrome.exe	123
PID 3792 wrote to memory of 5356	3792	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://urlpad.net/#plain:H4sIAPiENWoCA3XMuw6CMBhA4VdpiIEJihUJgRA3Vyc3l9JWqBT60wuFtxcfwOWbTo4MBqVPI1EyOAe2xjiEkHGjodNbxvSELVP4LfF8VcWiy4oyMhIKVbnllx7P2gmgHCCbrLwZNYq9nZQdts_ubZ8PPaFFyThbO0LG2LpWU0uC9iTmqj0nKH14d5dKoOgk5rWmAJw6-rKCeeOB_65Rgw7FJlh2gLBEf1OEl7n5ArhAKR7SAAAA
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffa2e93c188,0x7ffa2e93c194,0x7ffa2e93c1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8816306072434043814,4892942328765043941,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,698611058331488688,15162157786603857395,262144 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,18164192261005239175,16493853188478335899,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2971034837403471552,9651280086508420243,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2301357770601251157,529636927775142856,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,10839696304599719300,1220398453260409671,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,12227447300785110716,9895738873133337806,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4144,i,1358730465594301237,5356242638382024320,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,11940597126820619175,13689614011945629214,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3018774286475173955,6532608302637888030,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10698084267351919048,13601822370400946088,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4307499654535332471,4311021466966541421,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5460678447104918190,11902433961141060113,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5460678447104918190,11902433961141060113,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4996,i,2931317168843033356,18045595878474563706,2097152 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,14753158584307701888,15158937795400744153,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,15068580350526926009,14792581976946926556,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,10549522227982072819,2713373172139366700,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3208,i,16395396160611082096,5591717449676091859,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6524,i,9444912756555378304,9216704371848049703,262144 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,222665690603639355,18338398071915645936,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,710945864557080385,15400777742963394727,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,6890737381776324512,5813059858365536812,524288 --field-trial-handle=2288,i,447609915000573948,1074687581160449984,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1dc4c728,0x7ffa1dc4c734,0x7ffa1dc4c740
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,15171692582925665555,8341443427960605910,262144 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,9932314711673873369,1374703817418993687,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1836 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,1698621475043874314,983669380451933310,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,3319474037266650315,9642784061961130401,2097152 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3544,i,10763979720862002959,8540431535822758412,2097152 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,3074706070457492627,16955397232984612230,2097152 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,17151891195155235480,3692767730280039685,2097152 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,6668738170671331612,1067045936594854325,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,14281994976406704316,9165175056162903097,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,13816344211766233040,17017590605841397758,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5388,i,9126308597387781889,4088237500141794172,2097152 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,4335233697978747371,1730384010710268068,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,16334860616379160836,914705841660231937,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,2536980328321523085,197141909499605761,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,18114769519336004507,3134388850239194384,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6164,i,17990449604976985749,11699768253905729684,262144 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1504,i,10524210471450874863,9729425924494965510,524288 --field-trial-handle=1956,i,5834254326309779493,785576122024166264,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:14
  2⤵
  PID:1244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4f7e094fbab73053b62226963a3ae2914151213f0355915939b7821a7a46975c
MD5 dc4af4468418148b1b752f5828570892
SHA1 819d3ec900505a34fa9b3a4c24f0a8f8a8cf8ad5
SHA512 6ece91e8269d3890c33ec669eb44dbecd6e2df4bc9bcc569e0f36098c90606f316248940b0c237144fed435984d86cecf01074972867392ab83704cdecb138ca
TLSH
T148E02BA6C831DC370CFD071860958645EB55139B2B80854F363C420C8FB167A46A5D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 27406a86725b44b8a31264237ee66fee79c1047fab3c3c7509c693519573f812
MD5 970b15b925920b5a6fa4fdf4cb8c0fa7
SHA1 342824d7292bcd981b17f164ff932dae0ad240d4
SHA512 50e9af57ee849c14baffc3da2be6ae5e2ecd6e35add5cac78b5a325e098b10a7ef8f6f729b8972a78ddb22d27f5043b5c3ca2715d3986ea74caa45fd837910b4
TLSH
T13061ADF3C3E4866DC91156F9AB157E1FCE790A24032C3C66C9D4AE5B53E2872D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff76838873fb34b66700d6d4137662c8fba096def1a9c44e50c0fe49f4500103
MD5 c016455cb2b418e03c0d52e19885da0b
SHA1 1f8e4b3fdc71f081422cc1ad8057be79c1c9e370
SHA512 ce96a4725d275cf0c14d058753e7f14ec4516ed02aaea68da217f9d8f3d4d583fcc5f2ea9a6c56fa41bfbe60c4dcef588ce5d809d6c808b16720421fa375d3cc
TLSH
T1B3519DF3C3E4866DC51156F4AB157E2FCE790A24132C3C66C9D4AE5B53E2872D20175E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6996cea86d652709cbbe5d2b2b277aa47547b5844ffa9e0acc248fa0315b4669
MD5 19c3b8834e81d871c43fed4d5e30383d
SHA1 64c8cf51c79f90ca20847b72c2f35ed7c2a41dba
SHA512 e773ff30ff1da5cbd26d7e45e71ec5c583754a98e8399a72fe625127c25b3b3196338f9644166c5ed643f167dad3e3503e6e926498e06a8befe9d91f0c8fa0d1
SSDEEP 192:vREEvPBLuFJv7H+hAPRp2X9WHsb+WNnIX40tf2HwkwkadeVyIsnAUgraJ:vREGSJi8XQUwE40t2QEadWe
TLSH
T19342B53EB950653BECDAC329FA627753E7F5202571902E84E6FC8A1C16E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 056226d343db0cefe928f98fa333b5994115e18cf9fbca4a1e4d6ba51efcd58d
MD5 5b3deef57323130dca543ff42814ee43
SHA1 7b8e73754c8f4e22a51b5ea2b6ef2d40e2777121
SHA512 77c57da05a2e251d7485440e82c03264b8de08dbfdf08b07c8e5e7faea59e2f6d62b25b7c2dfea0b5e318095d7e49421bfd9f606bc4e5c3b99d75cf7623a1b70
SSDEEP 192:vR3EvPBLuFAv7H+hAPRp2X9WHsb+WNnIX40if2HwkwkaueVyIsnAUgtaJ:vR3GSci8XQUwE40Q2QEauW8
TLSH
T16442B52EB950653B9CDAC329FA627753D7F9202571942E84E6FC8A1C06D75CC221742F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6e75a3853aad40136e257c6b79397cf0d61d36a61e9c418fb9a439e26d83aad8
MD5 56922703d1c0a57033454d0793c90430
SHA1 065b70eee41e40f3ddb00b9da6222f110b86c52c
SHA512 23577c5adff057c68827d73104b88667146470541bfe92fea9575a482de69bc32934677af1713fe6f2c3ce31e189ec937084a61779544e0329b36bcbff094449
SSDEEP 192:vREEvjBLuFJv7H+h6PRpoX9WHsb+WNnIX40Zf2HwkwkaZeVyIsnAUgraJ:vREGGJiyXmUwE40B2QEaZWe
TLSH
T1BA52C72EB950653BECDAD329FA627753D3F5202171901E84E6FC8A1C16E79CD221742F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b65f12491197f888087ce983bb580cc1dcad6f081575ec0c539150e808a4a2ca
MD5 72117d565754bb7af5363c223105ad29
SHA1 564b0956d456e6cb76b80965c4f2db8fa583cf10
SHA512 1826f290d1bf5238c8d06ae88664e457de8fbf0493433fef5c3b033aa6096c6d085b49e6eaddf64b85635111bcc8bac4e3611dfb3f3a0223e47f86c8545ba1b7
TLSH
T146B012818501A181C06202F4214254CC7114AF68D60A170143E07E228826260C014060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa88.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fa88.TMP
Size 96B
SHA256 18923a98fa789ec439da09c26ef6296f334d9221745a25147ac7ee3a06e52aaf
MD5 93d918f0464921adb39a5393f6d6ae60
SHA1 6c4ce91db06e84113e112117d4fd62c4dc7a49cc
SHA512 5e043b2c274d5dc461d07285e457e673006e72ddecaa342db1906dfbd4da49d312c1b4bcea2cf537b206b3299da38e0917763ba04b6125015904c5607d22f813
TLSH
T1E0B02200C20B2202C0C303B03882F0C830E0EF28C203020382F00AB2CC30B200038A30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e4e2ff18e128d8952d5864deddf893f72fe62bab61779ef93638e00bae09e003
MD5 0fce5528ca6436cc6f37e7e8d28662c7
SHA1 def3356bb8ae19a7e32e5464704d68a123a5111d
SHA512 273ff08e049122930fb42d8b6cff6345e136249af70deb55478a18a373d67886da7b66627fe3810c01bc30700e58859cd1ac81e6d177d7218a34f5ad16704751
SSDEEP 6144:6psLiqC6IPHXi0X6vK+1ZWDfxA3OnjrYQ9EU0/hEv:6psNC6cHy0IFIDfxjjs+Co
TLSH
T1F73412B16C3AEDE609F4EA14704E2B1C9DFC8893A096DDD7A1F93F4811AA8C5403ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 2909d8ea30f4941cad6f5615cc94bcce46d8bd513d24143554bd8f42ef8e40d6
MD5 a1b959cee15bbf5f8d249f0896dd80ba
SHA1 b667b4bc25bd45cb0518ca89b77ebbeacde8bbac
SHA512 29199e9d162d1084e296bb5cfd90e42480a6769a0d9babc3943c14fefa529b96552ae2d00b8e3ee0096ee9fa7a95e4eb4286e8a4f4ecd451ad95dbd340448f50
SSDEEP 6144:epsLiqC6IPHXi0X6vK+1ZWDfxA3OnjrYQ9EU0/hEv:epsNC6cHy0IFIDfxjjs+Co
TLSH
T1753412916C3ABEE605F8EA54704E2B1D9EFC889290D2DCD7A1F63F4810E79C5402ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a6dae7e410256cd16daf064d64fae2e6a7fae729002c8d1b2fe16968079cf208
MD5 a297271b4582ac50bbf52420e372d844
SHA1 137bf18d7e7d564446098e1db19b56f1c971a0ae
SHA512 d8045225f2aeda44b7679168919f2eca4418a52a8cc3490640476d747ae1230bdfefd0272fe037524a7528bc606e3bb2be805df87ff3be9d86a8984656f9086f
SSDEEP 6144:SpsLiqC6IPHXi0X6vK+1ZWDfxA3OnjrYQ9EU0/hEv:SpsNC6cHy0IFIDfxjjs+Co
TLSH
T1543412B16C3AEDE609F4EA14704E2B1C9DFC8893A096DDD7A1F93F4811AA8C5403ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 87838d03bb540f4e71b6484fab9027630aef1727957de94c9b4010b78fdbec49
MD5 cd4c5aafafee9a4faff9ae281ea64962
SHA1 1c63775ceaa5eac133a5731067fcbda9ea960103
SHA512 071381cc49001ea9e08f766dc6b90c3490262f2855947786dae21ac878abc6f8cb24fb2ebdb63209ee26150d2cdd9ce78a180f51d5d17bbe2f8861636168e0c0
SSDEEP 3072:xzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:VWDfxA3OnjrYQ9EU0/hEV
TLSH
T1E0C302A11C3ABD660DF8EE99B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 283f0983049f1ec4312e74d30175717de0192e01aa0eb09e0756cbbb238d4084
MD5 e018cd596ca28fb18747d3fb5102e86d
SHA1 f8db4280628e1eaea418a69ff1d0df352d7ea87b
SHA512 043813d14c91bbd1f05c490360a88cd12741c3c9e19f7af83497c284414beb21f350793a600d185bcc6410a0d5f7d573e2deee2bfdc899ef4dbc30c3f4de881f
SSDEEP 6144:PpsLiqC6IPHXi0X6vK+1ZWDfxA3OnjrYQ9EU0/hEv:PpsNC6cHy0IFIDfxjjs+Co
TLSH
T1CC3412916C3ABEE605F8EA54604E2B1D9EFC8C9290D2DCD7A1F63F4810E79C5402ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1715da94-3dbe-40ae-98dd-90771287dc98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1715da94-3dbe-40ae-98dd-90771287dc98.tmp
Size 22KB
SHA256 c29b7dd7e97534eed1fba89a8a0538a1de2a53e728be98d9a54e47c22378ccb9
MD5 6196161c62788bd422c8d2126a48938b
SHA1 c486a1bdeeb6621d3af1389ded32f8c8cff58612
SHA512 36d81519f091e905b1f4f09d2b5f73f225c9289ac5a5ee88515260a7bf8789680e4f73e4294a00019ae6f2678cd346dd3524c123f536bb0f36c4053b742aee68
SSDEEP 384:hviFKtNn/s3n9SS8N08TUNTUlIlxTP3EVPSy0P2K/+jYoqF9PITGT0Iix9p:h6FKj+97Rwg/cxmh/AiF9Pi+0Pvp
TLSH
T15FA26B335CA8AD3F9EA64A95F90A321B4EB401A7D6C57F95D6DC6E0C00DB2EC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 230d04ab9274e52bbb2b7d49822b03e3c2f7c4e1b57b995ddee85f366a26da69
MD5 315d80caddd6260b562260a023039727
SHA1 ea61eaf1e953acdff803500d42671f2fbb050a1c
SHA512 e18172265ba6d4f2d3fefacc778b0da33811baef6fe1aa346bd62fb1c63124e8aba3c37815027031a193b7911a7060d724bdb44b1e08950e8f148458871a17c8
SSDEEP 96:CbDWDnDl6RLgke4oV+bQhwHcd+W+9Mq/22iW07gUol/RmXnjBV:cunDl6eVh+bQSME22t07iRIBV
TLSH
T189C19350C69D73B2FBB01C7CB2D5A8CC3BA47DEE39275B1660D104B872037AEC2A2559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f935f403205bf58b908ea1c593be9a6df55714f002257100cb5801fcc4d4a992
MD5 fd01209e1a3cfd550d85ef6a59344a3d
SHA1 d19ed021fda252e231cf8605115829382eceb419
SHA512 7a3b483a1e99069be47229cee545189053e6281ef0f119a02661d2bfb4467a25d83fadbdd650a0c3a19d7794a3cd6315488b4fa12ba6b163c334ed61e1973b87
TLSH
T133615D21CB2EB7F0F36008B1B2C6A10C3675B4DE396B4E2971D458FDA617B5ED2A650C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f502e9e7b4da687bff030aa72cfbdc1bde6723de56a7faf518c803b7d075a1e5
MD5 de58e82bfce062159ddcca5da2fbb1ea
SHA1 aa40f572e512579e989cfe9894346facd87b07d2
SHA512 26510984801343dc3832ba9f874c121e71baeffbf3bef0cc48347a7949da83e66702bc0ed8178dab6a0db4f560fb1add14373860fb2ccbea16c188dfb3de5e61
TLSH
T1A1617AF2C3E6822DDD1155F0AA147E1BCE19099643783D1989E4AF5BA3F28B1E11274F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1569b4699faf319528366bcc6dac0e1c24ea70eda8dc91114603d7e294be1e93
MD5 95aa9e555ac7e7fd64a59fe467f75555
SHA1 18b24bdd837f914d1e65bc4c67c130aec28100db
SHA512 3830e72c1de47e159ff118f18c9f106a9ce0719ce17cee9b64a311e59ba89f1cd822abd36bb3a449159cd864021d9a280ea53599ce2294a82fc72c075b011a3f
TLSH
T191718BF3C3E6822DDD1155F0AA147E1BCE19099643783D1989E4AF5BA3F28B1E11274F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b12b6f49b0feb9be7a15bb2210be060c88076ed56af7218552d274696c88ad6
MD5 00118d78581d544705e82810a3114025
SHA1 c8fa4a20b6deb4284d5c27f10c1186f49881ed6b
SHA512 d798b4f1da9871598c2d82040c7a4cd8b6416d01cb8f8ea8b67875179b8cbf0842dffc2acad85d2e06a8f36789be0e41a0f5452820cffcf8978b520d84e99c60
TLSH
T1735179F3C3E5822DDD1156F0AE147E1BCE29099643683D1989E8AF5BA3F2871E11178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d6db198ed31566f2b1370779678570502a2965bf5e9756ce046787b84479d39
MD5 6a7b2fddc0beb7ee308dac66b8b20987
SHA1 ae287c7037b8834b7fe2867107ea8c8913fe1f11
SHA512 92d69458a4ee2c8d2d34833ccc38044cb5c6d1c49bb7911518ad2f8bc43dee68646bd18aebc8312c3501af399454ea66132446779635444c1e1d9663cd0f3363
SSDEEP 192:sxZlQUnvRAyMojK1Ml8M8OP/f2s1lj3bI+dpjd9/W6+WNBViiFCXY054hxhIg5NJ:sxZNnvtEOP/f2s1l4Oz/bmlX5Et
TLSH
T16A72E712BA24597BDCDBD218FA01BB53D5F81562A6940F84E6FCDA1C04E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0b4458fe40b9d36b4ebd0b162d1123a59fee4242a772a67d0fcdc0bdf2fde2a5
MD5 a29f1b8cb1cf6f345ecc6237c4174efe
SHA1 83dd90fe26910872b631329c5aacf3f01aa46342
SHA512 3b99b7826f05b27257d069156849ebc1148015a5c9494379dde2ae5bfb5c4e56262fb6ffffb1f09a05ef6d254bb2944a1c5cfe96673d217bbe51a27c8de6618f
SSDEEP 192:sxZeRAyMojK1Ml8MFP/f2sTpRIdpB9/W6+WNDcr/Y05JxxhIgrJ:sxZetdP/f2sTpa7/bw/559
TLSH
T1F152F9126B346977CCDBD209FA55BB53D6F81572A2940E44AAFCDA1C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 87661962fc43982241afa709b27d8a5a73e2fadebba7f1d6586998cb188c3bb0
MD5 4975a5f102dec17fc577216b58d612cd
SHA1 0aed086672983f11d59196bf43d86a15b3d18396
SHA512 6488beb686058681e4583c9b85a97937d261fef684708fbb3b56913a5bd4d9aeb92c255666a622f9e557a1f03d0b27f7d5c3e1ca04c0ab2fce2b8a09ce7c3c1c
SSDEEP 768:SJzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hqwro0h:SJzXl8pZ221WRmsYQL0u1jaKu/Lpd8hV
TLSH
T138E20B3F244CCB7E4F844EACEC266F966ED801CB66984D5447FA494C03C67EB522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\21fe119b-cfbd-4e7d-a241-ecc2e61e5323\index-dir\the-real-index
Size 72B
SHA256 1774b3391fcc6162e1c15b4f1ecb74301ef2b491f66bd5fb14a192676b1154b0
MD5 da3b8c64a9e3364cdeec58bfd006368e
SHA1 3bc008815efd5af96a0569fc752a38e26e18b922
SHA512 fd0ba423572fc8d9ab2e344ffc2d1af7752c8458e92d3dbdeb75ee8a4f51150e87dae7ee318f011531cace0a56ca8d78bf8fa97d7ffda5b8b9bc729dbe50d18f
TLSH
T1A2A0021492C0304AC24652F626D607A163105EA1128133265390005CD8D0745454504E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\21fe119b-cfbd-4e7d-a241-ecc2e61e5323\index-dir\the-real-index
Size 72B
SHA256 4cc79b045e908b36fe709f09ae0791a5e2db8f5a0ab08a9996c40123cc1bbe1b
MD5 f6b1c4044b87e25d5388d077c0998d06
SHA1 7e2c5e74b6e88eaaec4be16d57d4d684647e068c
SHA512 0f059dc87e82320d38b2dfe99f12de1c6d99a00d65fd6f509e7f9167430eebcfde36230b5e9a51d24c0d93b1cd599c4cc0762ef9ebb87e86bb768b6f81225a55
TLSH
T131A00294CBD90009D06615B51A5343411741CE905910131B41D12088CC504955D4510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
Size 3KB
SHA256 f1b805eee84e7fd413b88a4799824059fa9b6b2f49baf91fb2b34f316fa6cdb8
MD5 e177e2a11c9777f5fa8ce1222e5dad7b
SHA1 7b3777086be129e512ef8f7b8a1bf5fa6dae400a
SHA512 13fe5d9293087c433e9fac81350163ef02c9fc22aee4fce838cfd1dd5a67480192ed80459c9f764c5abc58a2755e235e367923abd200bfc030199eb584b8490e
TLSH
T1F551B55E4C573B97CDAC157364B108483739B9EC6A448E27A4FC9038ACCB73428AA75C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
Size 1KB
SHA256 f054e2fddef7577db74c1aa608f59649c068b7237a0e17853b5f463c4442bc20
MD5 5fbe07ca49693a58020e07381235b256
SHA1 3641a33d0151c346d3ef535022b1398363d117f1
SHA512 409d22a3a2111494cb18005833c3595ede2e9d0861c62b33c0e43c4dd375e3881e57c13fa65668d6a4ab3cc42024382a9d4057baadac3a59343d30b7ec6a2b57
TLSH
T15E41B94A4D9089AFEC7444B215B6A4A873348DDC1B51BB575CBC51317F07729068B1FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index~RFe5899ca.TMP
Size 1KB
SHA256 73f6434994e3ca6d77f0c5196fd12cf78f0536070796272c857881630b8c115c
MD5 ad739f446548811499bf55e281f6bc6d
SHA1 e4ad726a58a8f136052aae78bc5572d94388757b
SHA512 ff43886d006a8f1d44788ad417e528125dd41675cb0b7308d1c20edf9b60c2ae87f68dbc8a51e102c973c983d335f7e33e4710ea7d796e608059e3d452d1315a
TLSH
T17C41A8464E808A1EF8C440770DE3B4B87339A40083127B4774BC5136BDA1BAE2E4E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b7978f03-500a-4266-8c8c-b504f996fc13\index-dir\the-real-index
Size 72B
SHA256 f89f3bf500120bbfdc84a996032f79a03693d113cace0c89cfcf87f6e80edfa4
MD5 a73f31aba7b8a59bf238052551ff7ed3
SHA1 27610d12ee5b61fa240c7d169f3a49581b6c3135
SHA512 ce25c2ee3a131546cf753c45be1840d8b5ec7ad6adc69f0883160bf3edf0b3a74a9a46979b73f0634ba9ebaac86e038e4eb4695c37a82d2f737171225fd59a56
TLSH
T15DA0027201650449C14106B2A5570790633AEC2D4111430598A0985B9C611694D31094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e868c7b2-d505-4bf0-8ff3-62d3df48ce9b\index-dir\the-real-index
Size 72B
SHA256 eec3274b34b2e3e3cedb43f298dd8a63bef8ef78e902c4a6db21dcf778b08604
MD5 a5f6aec02ebb23bccf0a1696368e9701
SHA1 a13f5dcab0dae8115357ce9acf10259f00a3a99a
SHA512 a35eff645e77485937ce30a0bb3a5f7a21b7692acc35b979eb749e24249d24c897c0f1ef5cc2465dd145207ead206601db8d1b98db6bedfae3d839f34fe61068
TLSH
T138A002695DCD4222D5C003B429D315C122115DE5398243818291618DC9E1A40925710C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591880.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e868c7b2-d505-4bf0-8ff3-62d3df48ce9b\index-dir\the-real-index~RFe591880.TMP
Size 48B
SHA256 ef63f9c03e54e420d45722bc7fe4e8ac42a5cb53c65db5a2bcf94f68972cca14
MD5 928378a774e8cbbcf51802bc6bd4a48d
SHA1 f562a18f5b65855f1e59ea643cd4c4a3cc79f693
SHA512 239a2f56b350379680bfd017b424453ab8b2cb682cd8fd4e2cc8526351c2b9efcde33f9aea1d2daa2e88e066b4df8e1133dacc9d848a969cab687b0833e19ca0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 b24de7cf3951a3f3c8e8fb86360952455e109c919dc8fb16e52a976a80c5c071
MD5 d64a1f5ac4c32abbfeb260ca8e2c56ac
SHA1 4e9179d941dd2c95bba08a42b981b25a37bb07d9
SHA512 258df3f86f00a242c4961d3df103e5e87096d9431a1a4fe9f5c7718597fb52e01a49d7c669eb7fc245cac60a0288539d462bf9997f3e958ef6a7828a2df1c5d2
TLSH
T162F05CBB3FF71811F8FBD6C5587160A20515BC45C999FC4F942BB6D390B2204615ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 f45973f9527c3785fd24b6093376c649a891f7525ca686bb09d00cd17425d2f2
MD5 70fbd6d7e090928e12df64d551149742
SHA1 c97b5a49e1e03237c9150d3f6179a36db6cccade
SHA512 190b1f973984a8537a09c220391af1d67834e563a8046e8e084ef24299d6657936e51fbe65464a3a1559cc1e0ad70f46954931c7a863e7195e3e346469eed49a
TLSH
T13EF027BB3FE71811F8BBE2C4187164660205B845C998FC8F952BA69390B2204615EC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c27f886635d2925290ed989df40d71bccb1c9bb88ce6c718edccd5043a675618
MD5 2c261f03713d054acdba6a947029a7b9
SHA1 d19a7c3086ec2bb7d5e802942c382218d22a917d
SHA512 2c17a9e2720fc43b20b60e68fb2ed5838c025ab4ddb08322d35eebc7e2c48276a7b79933b9e7511ac8bfadff3a9dab518fad5872fe162c38871e775d793c7e9d
TLSH
T1FCA0021385B5105DD50443B8B04642C46213CD140E17A215C0E4DA55FC921815132048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ee33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ee33.TMP
Size 48B
SHA256 d307d4d1c2e8530827575567faab1f4efc0b533a1fe49e4ec7bdc916f6bb6ed7
MD5 b3938a14c59fa0d64b0f147c66d712ed
SHA1 e7ea42f1ec2259505d3faf611315569230c43208
SHA512 a1e76159849ab3e028ae2371565c2b3e62faa7d971b06137f55f1cb70e1e021949982384c7014ed536b6387de054f0fe263b78e79bb11ec628602a5114d5b9d9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f43f915acda81fcf53b040714b4ac045529840b0a441148334219eb970c1d60
MD5 83f972be0631b6d79b6eb2c86fe93a06
SHA1 d6b7f86fd09c2abe34c6c26ae3fa027f3b843933
SHA512 3d11da8cd0fa1e70d05692d2b015c5e090a270984ffa8084c11215487af2dce29e63d36be802efde7609818611df590c2f8dbc9a32a0e90a7ba8f4fce75ba6dc
SSDEEP 48:Ke1qJl/7nk37MPIMtkKhBpHkdF06s/F5y5qI/KjiYnyRIInKd2cFnvnunrn/n5no:KUOkKjCOaqUKjiSiIgKd2Mf67P5NJQz
TLSH
T17E91168571BE02A63C7E2858C3A197269E4172637259ED3B3B6C04B60E67E124DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4dbcbe0-ead6-48fd-ad0e-8ac7304ec563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c4dbcbe0-ead6-48fd-ad0e-8ac7304ec563.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bf74bafad445aa61e0960d81924d10f9718c86f2ddc6c69bbe6c333e33f8028b
MD5 fc5a1b7d88be7df78dcf8b23f26f8189
SHA1 745c19c330c34f638068a36a4adcc33821d97e23
SHA512 4989a850f0ba9ee261d849e2b3adc660e79e77925c6c7276071a3d77e6a8401be8fca74242e1743c3c643ca74e3a4685af6f17d7260463059646ba14f7e7ec06
SSDEEP 384:6YtNn/s3n9Sf8N8823EVpSW0uK/+jYoBt9PITGT0Iix9p:6Yj+9U/cL4/AJt9Pi+0Pvp
TLSH
T17A927C326C68BC2B4EA24095F44A361B0EB455A7D6C53F9986EC7F1C05DA2EC131AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2055bfd6c98f1b90dbd10d2eb49be3c5ead61d6aaf72207d3c3b99c504408558
MD5 6a35bfa37e47558bcd6f055f75290f71
SHA1 3b9a63a3e63cb460380acdf928eac55a46cc8893
SHA512 5da5f6d2327d29356a30ce2eea222cd1f846ccd0638281907d496074c8dbdec9ad79d212011468d251492533d844c1953999368bffdddb730bced720a00cdc33
SSDEEP 384:6FtNn/s3n9SO8N8xTP3EVeS00P2K/+jYoBt9PITGT0Iix9p:6Fj+9B1cYmh/AJt9Pi+0Pvp
TLSH
T153927D326C78BC2B4DA64095F406361F0E7455A7E6C93F9986EC6F1C05DA2EC231BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc871045af40c3b089a03e42680d4772103e5cc7c377287204a2b4260d78963e
MD5 9f5d8800e4616abb9ec846b0cfb2c20d
SHA1 7dcdf4d099c8fc98328c0833332528f870087eb6
SHA512 0440b5d4f697966be8193e3f021f7a8271e2a83b17e3603ae18b74431374daab7fbe0d4f73e5d81d0f0fad27581067df4f0e4e5d5841e8fae621cb9ea1112c76
SSDEEP 192:7GNB6fNNQmiUyvzHZPL/GPTkmVV7qNJWU6:7GNB61Lkz5PL/AUPWU6
TLSH
T1C9020C34ACB8787B8DE3AE45F58777175FA4212BEA952F84C6E81B1C40D729C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4c156a33a647bd76f7357d5d26c2da312c8097f2391e7a02b074eaf4bcceba15
MD5 2d2a9c4f288d1b39a6b0cabe7aa8a994
SHA1 dd86dc986ad294d22e1f9d1fd94bc9ce301ad6a2
SHA512 95d3a20731ae1365ab213415a3481775769b004d2c96cef438ec2f56bbd9d89f327dbdf05dee956189f1a0cc41102806623b94d1445d700453f6c52bd869e37e
SSDEEP 384:5FtNn/s3n9SO8N8xTP3EVeSV0P2K/+jYoBt9PITGT0Iix9p:5Fj+9B1cJmh/AJt9Pi+0Pvp
TLSH
T1A8928D326C68BC2B4DE64095F506361F0EB455A7E6C93F9986EC6F0C05DA2EC231BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42eae04760130a180c1688c280a4dbbcac5ea9f52350add7bf444631f8073e48
MD5 088e2e9960370c96803dac7c5c01d295
SHA1 2a4c65cfdf921947e91727e23fe3296177ecaa3a
SHA512 0f5bd96c2d621d00739dc8adc49d901eab176371b202104cfd44d82aadb0c07f0609ea09f5a99f9e9254e9480d87c04a5483c8603b273320ff9dabdfa7161ba5
SSDEEP 192:/GNt6fNcQmiUyFSZfL/GPTkmTF1PwogxV3ZaqVPU6:/GNt61sawfL/+jYoQL9PU6
TLSH
T168120831B8A8B83F4DA295A5F487361B5E645217EBC93F94C5EC3B1C05DB2DC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

168953dc-31d4-4d75-bd74-54a92a882947.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\168953dc-31d4-4d75-bd74-54a92a882947.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

notepadpp.msi.crdownload

Path C:\Users\Admin\Downloads\notepadpp.msi.crdownload
Size 30KB
SHA256 7986b34f3f62078fdf8bc5ed8a7495e942d0e6b9f6e1e44dd33a066eb0865a81
MD5 89bbc2dc87edbf317d954f329ad1a0a5
SHA1 2a43381d99c788457886210a93544c18bae9046b
SHA512 2f81dadc95b04db076ad7e7ad052941aaf58b520731657b6859458f5da1cd55390500ed06222e22468b77f97be2ae2d51e01b758dbb2dbbd44842554b54ee87a
SSDEEP 768:0kTUc0GEym3W7Z6qrGK48eWMbCCeMN/nq:QcsNTp8ob4
TLSH
T1E0D26D46BA419332C5431B324A4FD7E84F76AC588F5321013797B38D2E376E56ABB9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepadpp.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\notepadpp.msi:Zone.Identifier
Size 271B
SHA256 06bf6190949f382ae5c2aed215a0c09ae0e94d37f9f12282319b8d8377e9076b
MD5 0ad1d40aab2e6b892d31cefd47601a12
SHA1 f8742c22e50cda2e364ec5b431be8514a143f8c1
SHA512 83faa2326bc155e6c56809aa53397dbbfd4ccbd8f85437f7de716375a20d8b543dd179c42d95aa9f31446b3ed2798a4ce4517659adc1e779958d7a76d4aa73dc
TLSH
T175D0EB4706104444014090A4378CBEBBB11DDBEA0EC423C69E60134C8A881338AEBA4A
MD5 SHA1 SHA512 TLSH

Submit Download