cdd6e987cf99e9702388aca623f099c5caa1638845da635be5e689e883de29fd

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RiskierTrafficStops 3.4.0.zip
Size 591KB
Sample260629-q9gfmsgx5r
SHA256 cdd6e987cf99e9702388aca623f099c5caa1638845da635be5e689e883de29fd
MD5 84dcc74b29fc1e68a34af8437c82897e
SHA1 a38a3aa57af30a1737c0421356dd18d65d4bc3a4
SHA512 519e56e8278500f17eea7f403f393470b61c3bbd1fe3f450476f11a1be117e255bff801a7e07824ab2bf957a84c213b471071d7af220e35ecd610d7a8d802423
SSDEEP 12288:Bjt/7j0PrxrR9yLE0IRtaciACf0gpWTPjf9FmVQEFD3hUDF:dt/3AKLYOHfQ2VQC3hUDF
TLSH
T149D423B7A186FBC6C42F2775E70CEC6A2BDD5171D67259C22D24310CEEED600867829D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1696951869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_64050541\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_64050541\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	chrome.exe
5316	msedge.exe
4580	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272150763820119"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{38B976F1-AA2A-4D28-BA83-BDB37320365A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
600	chrome.exe
600	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5068	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe
Token: SeShutdownPrivilege	600	chrome.exe
Token: SeCreatePagefilePrivilege	600	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
5068	msedge.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
600	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 5644	600	chrome.exe	90
PID 600 wrote to memory of 2408	600	chrome.exe	91
PID 600 wrote to memory of 1448	600	chrome.exe	92
PID 600 wrote to memory of 1448	600	chrome.exe	92
PID 600 wrote to memory of 2400	600	chrome.exe	94
PID 600 wrote to memory of 2400	600	chrome.exe	94
PID 600 wrote to memory of 3328	600	chrome.exe	95
PID 600 wrote to memory of 3328	600	chrome.exe	95
PID 600 wrote to memory of 6012	600	chrome.exe	96
PID 600 wrote to memory of 6012	600	chrome.exe	96
PID 600 wrote to memory of 1852	600	chrome.exe	97
PID 600 wrote to memory of 1852	600	chrome.exe	97
PID 600 wrote to memory of 4412	600	chrome.exe	98
PID 600 wrote to memory of 4412	600	chrome.exe	98
PID 600 wrote to memory of 3304	600	chrome.exe	99
PID 600 wrote to memory of 3304	600	chrome.exe	99
PID 600 wrote to memory of 5396	600	chrome.exe	100
PID 600 wrote to memory of 5396	600	chrome.exe	100
PID 600 wrote to memory of 3724	600	chrome.exe	101
PID 600 wrote to memory of 560	600	chrome.exe	102
PID 600 wrote to memory of 560	600	chrome.exe	102
PID 600 wrote to memory of 4408	600	chrome.exe	103
PID 600 wrote to memory of 4408	600	chrome.exe	103
PID 600 wrote to memory of 4796	600	chrome.exe	108
PID 600 wrote to memory of 6020	600	chrome.exe	107
PID 600 wrote to memory of 4796	600	chrome.exe	108
PID 600 wrote to memory of 6020	600	chrome.exe	107
PID 600 wrote to memory of 3016	600	chrome.exe	109
PID 600 wrote to memory of 3016	600	chrome.exe	109
PID 600 wrote to memory of 3960	600	chrome.exe	110
PID 600 wrote to memory of 5204	600	chrome.exe	111
PID 600 wrote to memory of 2588	600	chrome.exe	112
PID 600 wrote to memory of 3960	600	chrome.exe	110
PID 600 wrote to memory of 5204	600	chrome.exe	111
PID 600 wrote to memory of 2588	600	chrome.exe	112
PID 600 wrote to memory of 2260	600	chrome.exe	114
PID 600 wrote to memory of 1204	600	chrome.exe	113
PID 600 wrote to memory of 1924	600	chrome.exe	115
PID 600 wrote to memory of 2260	600	chrome.exe	114
PID 600 wrote to memory of 1204	600	chrome.exe	113
PID 600 wrote to memory of 1924	600	chrome.exe	115
PID 600 wrote to memory of 2524	600	chrome.exe	116
PID 600 wrote to memory of 3204	600	chrome.exe	117
PID 600 wrote to memory of 2524	600	chrome.exe	116
PID 600 wrote to memory of 3204	600	chrome.exe	117
PID 600 wrote to memory of 1076	600	chrome.exe	119
PID 600 wrote to memory of 1076	600	chrome.exe	119
PID 600 wrote to memory of 5412	600	chrome.exe	120
PID 600 wrote to memory of 5412	600	chrome.exe	120
PID 600 wrote to memory of 992	600	chrome.exe	121
PID 600 wrote to memory of 5352	600	chrome.exe	122
PID 600 wrote to memory of 3536	600	chrome.exe	123
PID 600 wrote to memory of 2312	600	chrome.exe	124
PID 600 wrote to memory of 2312	600	chrome.exe	124
PID 600 wrote to memory of 5856	600	chrome.exe	125
PID 600 wrote to memory of 5856	600	chrome.exe	125
PID 600 wrote to memory of 2992	600	chrome.exe	126
PID 600 wrote to memory of 2992	600	chrome.exe	126
PID 600 wrote to memory of 2448	600	chrome.exe	127
PID 600 wrote to memory of 2448	600	chrome.exe	127
PID 5068 wrote to memory of 5212	5068	msedge.exe	129
PID 5068 wrote to memory of 892	5068	msedge.exe	130
PID 5068 wrote to memory of 5316	5068	msedge.exe	131
PID 5068 wrote to memory of 892	5068	msedge.exe	130

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\RiskierTrafficStops 3.4.0.zip"
1⤵
PID:5544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb7b28c728,0x7ffb7b28c734,0x7ffb7b28c740
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,518707583755528904,17002259820147403301,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,8209221550714040515,15183580465653720564,262144 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5732378275633666813,13920509650197192362,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,3029589028818342746,2739162632058337486,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,6243619155340246370,12424796505034735588,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,15908088356270492266,12675455356734590783,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,18147634762363928189,8003897715522715910,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,14725977419249507175,7762522382271135647,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,17419541690315151252,9214507364009198084,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,2061341109277368411,16133084013861957443,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5416,i,12343292069348882011,13283911205301004019,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5480,i,13987234612909142133,14928339869108547685,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5744,i,15929969987146604827,10748816036718539737,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,6741096796950393951,11082596266508950686,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6016,i,11076283694125429246,5029489869526657295,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6280,i,10756888577619810373,3427561208040379962,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,6974946275542424404,4527264654896191308,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6248,i,5196905837221133363,3211291677613302685,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6228,i,14301856157916332338,10739595387398262734,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,8055531423591054355,18375033221804777293,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6052,i,6942767484991481410,14566373357474728879,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5012,i,16655958806291120527,309597496981356975,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6504,i,7996599729308721082,6042682691095193165,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6092,i,13327619119518079256,15174858355428713689,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5728,i,16863914010727542866,2564798947751131810,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,2682165572769144345,9432370515086101811,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,4581541631950588503,15392719920713034654,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,6545333650459514165,3292071019146856280,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5628,i,9206219663943985733,12995067380776655713,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,13137402005044934144,8988908652664124621,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6556,i,18067457919425323659,12891917404531703182,2097152 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3676,i,8067613503496378804,11133001412966388923,524288 --field-trial-handle=1784,i,3256267590415776834,15981642842771561036,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:2448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\NewWait.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb7adbc188,0x7ffb7adbc194,0x7ffb7adbc1a0
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,16685979803247314879,10606611451613133089,262144 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,18266240790896097853,6603823988486397455,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,18033426746790380288,16988900692171265550,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6161548397141144314,12837473003699365055,2097152 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16942424175498115619,7918027002702203905,2097152 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2969761948032390446,205392692187495894,2097152 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,11757248187826105444,16108077176364908190,2097152 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11225295490457999770,4996479704895641030,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,18195844018852319227,15492332478970888718,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,200409393253420007,8294142499356709812,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1765584565095027372,12265586495730488369,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1765584565095027372,12265586495730488369,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,1377893431703675145,18087221342541729947,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,15518674453031395701,9076075741625494993,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:6492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,12219108242911897036,10023943861035927919,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,11703991955727851243,11258867563096217487,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,11554852612317221022,5387887816028259965,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,15288884836749964636,14315053999470891463,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13858230232882925278,10288922684294870855,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,42954547057208005,6579744864843580539,524288 --field-trial-handle=2384,i,16288631607851580949,17956205038475900475,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:6240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffb7b28c728,0x7ffb7b28c734,0x7ffb7b28c740
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1732,i,12491244807375499447,7674399623623622804,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=1996 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,6374942241393138918,7725585290765761963,262144 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,6079018906037460643,8322344366045894227,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,926867359130595005,4545087323963686871,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,8509286213917951336,14220842489204673025,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,1176585473615778050,12314573794073963607,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,6554648568194344097,11072491326724729035,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5000,i,184160895735179395,12317768121928780115,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4728,i,3515986438138470472,10742025937076829997,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:6640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4972,i,987137779796248341,13298025799008709494,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,956016182126565,6082081843687465976,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4820,i,4458508994910620161,4420690888805307718,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,13729209745273368283,6589409488180466645,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4820,i,7119031599701835832,4522809334548092996,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,12212399201104976189,8080099912494369781,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,7438464436933152695,100521719562697804,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,2968635597522394190,11785928555331105059,524288 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:6792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6284,i,11652512130150715175,8158226692896499820,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6396,i,787600654487496735,4808659562488955580,2097152 --field-trial-handle=1968,i,17690422302905127419,4562059372810910485,262144 --variations-seed-version=20260629-010038.047000-production --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 08f8d38f031c2e0abdbb00a10b15f9c82a9e872e0b9c9e9e8573054ffbf61dfb
MD5 a98c2a5efb516ac3e36a21a7de9b9766
SHA1 d27f0d0fe201c96c602d3c10340a7fdacfe3b50d
SHA512 25a7902dc4f97f2e9beb705bfa2b32c94a98b4e0aeb18ce18879f14c5d10448fdfca7376231bf49acc22e305327a6b5d3a8333bf79156848063e8312c33a345e
MD5 SHA1 SHA512

Submit Download

85dd9658-dd67-4fa7-9519-c8bc197cc896.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\85dd9658-dd67-4fa7-9519-c8bc197cc896.tmp
Size 414B
SHA256 304f7d6829cf8adf78afc64742cf16ccbde913c40bca99cd2b8a66446f55ebd3
MD5 7a39b4dab5dfd8177dc8e4de2a4bbed5
SHA1 46658b9e503d2b06682ef69979b51ebb652131ab
SHA512 fecc266c563a0b5167835c95dc4342bfe58b7a4506fd3b17a7f7c0d5c8b2d41f83a5c6fa5cbc88e5443050b72de83ac25d8bdddaa922dc740aba284186163b33
TLSH
T1D8E02BA6CD24ED2B09FD576824550A82E64103775B40884F3A3CD60C8FB1A3A5185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 2391c121b453a401d885e1e00e19b759fae66c9b4d9e8cab7130d03935c6651a
MD5 f670f53fe50f633a5b6f014f777108c3
SHA1 b8c030642714151b919ca32d4a1779b43feb9ea7
SHA512 1d337458e7fe3ae416f94b0719fbebe54d728ae0bdaee6392f9bd8101eaea80976a3b0d80a7d37030a870265b00ce1289d93365be32e1474306a3d582f39aaa4
TLSH
T1C8D022E402F81D00E3A4C1B608120850172CE40CB620333DCCD9AD14244377F7A32CB2
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 d47312d5de2d184ea7b9bb5090f2b21a1f834769f0ab102e704f235cf3fb302b
MD5 f83989672398c8a26688e77018f8dd2d
SHA1 8608b186f186b57f0007420661ccee23cea19878
SHA512 e4797c4ac39e9fdb3ef5c0b35b4140c022dac4855e2ca4a23fa8fe448c1db495102197bfde5e17c95919f1661da9674304766ad5d3cbe7205ef18806b9ecca06
SSDEEP 48:neBmw6P1U1kmBrZD5Lc01pJQepPoR8/ZadHetipfpkAAXsqY2jEUEXhmGv12mT8p:neBCP7GdlIrepQRIadHetiUAEYOPA1Q
TLSH
T165B2E5CF2A347863DF590CBA213A6578DE7BC22C2F698CA978200C211CF8A4644295EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 5a534a443c3fd6223733baa2f1c59451b26b2a5aade91ceb3fe1084c20558722
MD5 8ae252db19caf12f2b544cb4b25d7162
SHA1 a53202a19d3cd7e1f3065d0436acfe2390d926ff
SHA512 3ac52b2a758f8d927dee163c200fee38346ae4e44e3005e6e58611bb512815d26fd732f522409dfd471f77c8b506c4dd62180655cf08e923a0327765c0177a49
SSDEEP 96:ZHQy54/uejzH+bF+UIYysX0fxQp97vrEHt/DfLcLq2piRk/E0TUln:ZHQy54/tH+bF+UI3iWGVvrWNkqp3kQn
TLSH
T175F32E5F2F243212CDBD923A68E644A35D7CF07F8B1366C95C6108B4CEE2652B46C5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7034808f88a0c75c177d3b8752e2b7645cf7ff82f302660260765a2eefcf6bff
MD5 a8dea447ae9e03da398ba3f696b003a0
SHA1 488beedc08c3cd7ee290dd53aca17ce9c0c6bd4f
SHA512 f832354064c9b0276d958d237d75af7314999cf6cf1342247a08d51405e971a74a350d53421980611a4625546fcca207daa9f0a37e702260acbb1c4a5e9de14e
SSDEEP 48:YALlhFfqg+qFRqFYh+ahFMhgwhg8saXLsrfoKsT/RscZ6pshrsUtsRcsNBs4qzsU:Dn6wDhUhtO2/BZ6SpiJDxDXsv/Y1XE
TLSH
T1FBB18DB7C7D8862D881156F5AB156E2ECE2A0A18431D3C26C8D8AF4B93E2872D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 09c6ff9b364d9b2d1659ea1dcf77af9560b00b2dcc5f384a81599024f20d10d9
MD5 99f2ccad72cd9f3b232f18f9261cab8b
SHA1 72eefc56eb94faa635d54b1a2160523ac200c916
SHA512 c90014ef3aa48c8b88a0afe062c1389db7ee769fa5687a3f464aad9668c724f5591d6db304f100399431311bfdfac9bbcca97f29ce187d8a5b0233845851bdd9
SSDEEP 48:YALlhFIqgBqF0qFlh+ZhFfhgbhgJsaXLsrfoKsT/RscZ6pshrsUtsRcsNBs4qzs6:DwtdqCHaaO2/BZ6SpiJDxDcuYcVK
TLSH
T171B17DB7C3D8863D881156F5AB116E2ECE290A28431D3C26C9D8AF4B93E2872D31575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f0da8bb1a0d587a0ac39768112fa28fae9a066bc169bead5e358fdc17e5be9d2
MD5 4d4dcb988cb0bf1326ca9afefce6d4d3
SHA1 f15dbbb38c036756c87ef545324c432f3a716d8e
SHA512 2b36537eff291413c54006e9f1ebf7b3a416d23ccc68cd520c1c5458e6c7c989dbc769243ba4227b0b1b8a118e135377a8fc3caf1acdfba1006adb130ad363ab
TLSH
T1E3F050A7926D7867006956FB2D04FC0D7576683003436CF1EEEF426DA0D61B31B16067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ec77a05ccd72e1cf3c81874bb5c43be4e8a616c53694f8b7c106a8038e0f3430
MD5 bcd70fb6202cad40dff25c11c3d0526d
SHA1 97dc0809962e24543fb008102f8041d14336dcd5
SHA512 1ca95afa504ff9926996a8b96e6b3791818597264e3f282982fa0da01473fbf770597dbc4ce3468610a94c4f439f2cd75382b33d38b9e063a5d95895d908670b
SSDEEP 192:1R2Xe4Ov7rAPRp2A9JHsb+WNnLY0W02Me5w8+VyIsnAUge:1R2X3q6X/Hwc0z2rp2e
TLSH
T1C132E82EA914753B5CDBD25AF9267757D7F6102271842E84EAFC8A3C02E79CC2317027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ab2e072c006217ee57d954dd45a73f765c3d148434714a291121e87ae45ddea3
MD5 3fb4e74c4997529cee79700a23a4d75d
SHA1 474bacb76ccc996dfefece013571ec4a940fcf31
SHA512 c793cd86ae4f8b3d90b406401dee71f3f8b6f398c2657a7fe40117e86d96600ef67dc2a25408f03e9a8171d513eeca999ee7b17f94ae1d18dd4c289891b7eed2
SSDEEP 192:fR2XeJsv7UAPRp2l+o9JHsb+WNQ7GE4Mre5qHvJ02Me5wc5VyIsnAUgraJ:fR2X24JXsHwILe2K2rhfe
TLSH
T15052B61FA914397B5CEBD21AF911775AD3F61022B5C42E84EAFC8A3C16E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f3b358c1b239d22ec21739c095fdd1752ccefd48683e3cbe04a399adebe1118d
MD5 c60c9b7355eb641d81e8b19360423d77
SHA1 0a03b3929c9a66212490ebb7620b9520cd3a8c7a
SHA512 6b6fb78ab64d58df7e48fecdb1a3ab0b6133bb1e284a7dad0380e05af252c25dbfe76cd2958e7f319546fcc309c998d5a3b2e03e42e9ef389100f838760f7d8f
SSDEEP 192:fR2XeJzv7UkPRp2l+o9JHsb+WNQ7GE4MreljqHve02Me5wo5VyIsnAUgraJ:fR2X2L5XsHwILelgj2rDfe
TLSH
T14252B75FA914397B5CEBD25AF9117B56D3F61022B5802E44EAFC8A2C16E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 74d6cb0988db87edda24ada54f076985af96774c37b13084991cc19c0bff484f
MD5 56cc3e7b0f243d9aa0243b45308b1262
SHA1 ae1d21b78bd226952e17dd78ac509a3ead5466c8
SHA512 d5a910a57c80bc22b9e6576bb17da083c89528207ea1974b4de5ac66ecf7db43ee1f6c556b4818b4df61b172e831548a932799e5d7bf8f681f57ce9fd7e75dcb
SSDEEP 192:1R2Xe7Ov7rAPRp2l+o9JHsb+WNnLY4292B02Me5w8+VyIsnAUge:1R2Xwq6XsHwc72K2rp2e
TLSH
T1E942D92FA914753B5CDBD25AF925771BE3F61021B5842E84EAFC8A3C16E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 977b12eba58f32c3e9dade004260a4851eb3c3cb96f5d3e21ccad924c4bf0689
MD5 021e454606819ac601efc1380d5cf8dd
SHA1 48a12f56659f123f9174d1253ebb66f5e61c0690
SHA512 1b4f3d85fad55da840115c35ec9eaa6344f9059e301dc8f09d606204872fa7ebd140a5b75ac7d3aab3aece32f87b1f0e62e2facdb6c7bfaf80fbcd8b53825913
SSDEEP 192:+R2Xe7Ov7UAPRp2l+o9JHsb+WNQ7cbBMreq02Me5wc2PyIsnAUgE:+R2XwqJXsHwx2ef2rh4E
TLSH
T13442B82FA914357B5CDBD25AF911775BE7F61022B5802E84EAFC8A3C12E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f002881de8a23bae5bc3bb3e7ea3c965fda4e14e05a61844a105ea7f8350bda8
MD5 9be27949976cc88fe04225b4f7b5f464
SHA1 78f955d42461acf38a0e040852891ac0c97e3015
SHA512 6f18ea9a858dd78a913c6e90c99e6185986f822403c0eae4fc209963b6abec46d085ce700f186faff74d5c1b658b1aa8dffb47ac1c25239c6d9ea448cbe170e9
SSDEEP 384:H9j7+7KxkXqKf/pUZNCgVLH2HfgslGUXOD76+ErU3d2HGwUg0Xc79R:Hd7+7KxkXqKf/pUZNCgVLH2HfgsMGO/0
TLSH
T1EE52F927648C993B0FD8D58CDC176F4FADB5025776680D2496FB5C0803A9BCE124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 0d77489c11b92555b5b6ef3c9f79ca22be64bc01f93bb6a9c2865a58ef680278
MD5 4c337ed8f8565fb30931053e1c518d56
SHA1 4049a02b6bdb15b75644c93f85c78048e9362ec7
SHA512 602dc626ab4daecf293ea7fc47f05856221d44ba415a36ab0f393191e7aaca40c7458e33da426a0d8e901954acbedf17e10e71d3dd503d1651e34e16cec4d002
SSDEEP 384:H9j7+7KxkXqKf/pUZNCgVLH2HfgslGUXOD76+ErU3d2HG7Ug0X8o:Hd7+7KxkXqKf/pUZNCgVLH2HfgsMGO/y
TLSH
T116520927688C9A7B0FD8D58CDC176F4FADB5015776680D2497FA9C0803A9BCA124B1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 dcd21f335df19fc1850b93108c4576fa3750f4c3d42a4bd76f178bdcc9cc3afd
MD5 66aa68192c8f5f20d1fc07cab97f12fd
SHA1 001d65d94432ad4369041fc3415b07a311f3e1ed
SHA512 545b2a033cb854c933dc326e312fa56d21e6747b555e3101168b972d58e39500acdea9333e34b987649e9ccbd62df51dbe771bc8231eed4d2fe7386053d672cb
TLSH
T19EE0869867CED3FD115581230279B30CC7F87809D6CF380A1F42E98151D5E0C71E1654
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13427215111260118

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13427215111260118
Size 2KB
SHA256 358b3823251ea8dd94034e9acb862d76997b4f9897c74103011c6464a3126eed
MD5 846e6079a24e316290c6968f3efef493
SHA1 357ad042f4d1a40814998c43363bd1fd8262a641
SHA512 90da40d558e4d7c04d2107a2ca02faa92cdf3202ef4029ff255baf011da197cb62be6db09d4b4e4131147488e56e19ab7197291f478e625c46d32d224fef1de1
TLSH
T10F51CF169AE4053FD13F813894FB12F27F757A5139D68D0F90A156040873B626FB8EEA
MD5 SHA1 SHA512 TLSH

Submit Download

e3a93e4eb1d2c4b7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\e3a93e4eb1d2c4b7_0
Size 194KB
SHA256 349d193d5b6ab63b3808bd11501f638573e1dcd70241e06122b2afb04dba1442
MD5 3b9d4a7c6cf71e33264304d8656e9ef8
SHA1 38c03762f43e0634736575809bb1a86fd6340b1e
SHA512 94921a9d606b022b54e52a5f480a3c00a2689adfc0db44801c46456c101489f5751e2fb5ecc0ffecd3b36d028ed07cc663af736624b8ed4df24b8649b7459944
SSDEEP 3072:+egF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:+egF1cc9zByRIZa8HlI93h
TLSH
T122146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AAE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c74c6f2975ac9ae661c3c41fffba10ed00524da740f44f6c1b841a4fa6239346
MD5 29fc218f13ed17436897b023399e7c0e
SHA1 a56f0a8339f5c38387c484a64864927edee273bf
SHA512 9982149620a09d71bf72e6e0f11874752c108872017fca9e876d643c3ee972101f4862803d1102a4fc04d94987766c8f06ff7ffb28f631e2e12b9e76c6179e60
TLSH
T16EA0025005C00834D82851B690CE23413780ECD430189F8374DB45589CD308C618E522
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2077e23dc4a0d999e5bc5386b7d4f3fe4f2b7eac3fecb71d874594e1ffd7867a
MD5 7c7f5db169f7e647d0cdf55bfec613c8
SHA1 3feeae5ede1787e1b326f0b324e37e8e266fd80d
SHA512 cae77c4f596be32c2f90d05ea12734cee0753b8892fa6e933291d250e154e04bacc09be080a2e1800dd39d483b5c37b0d9c24fb43c78186040b8ca4c0fe68bfb
TLSH
T184B01244FB309409E48C0D7116814B041700F00140428073DCA4EE305C06768FDF5BE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 069eee550d9c6105168f7e12fb537be1e467f2becbb432c7d07e4ab471823846
MD5 46d4cdf2c6665234e041322ddd9b8b56
SHA1 69cab4c735af7d1b9837564ad7cdb9ed0d09b5a0
SHA512 c90fd867e50e2dffcb182582b6d169168b87fc9f3d243bc534698a7897fe1968a9b836bbd41f0e537807d7037b17da29d1cb470641b55297e3fc761c5ad15d4f
TLSH
T123E0D82937CEC7AE1185901FA325F30CC6E67809D6DF34195B09F0C2529A90471C1350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e6054f0349b9a37f5ee7651e97e6c9b059d66135c6a424991e6af9e05700fa95
MD5 19ea578ca02f6874dd15447dc68069a6
SHA1 c78642be596c316c9c10e5ec2967d2b7391c3208
SHA512 b989c466c7eb6759238c7b15c83b6712abc9446cbc0fb81f74990f85d2fee5f0f4812e7c5af844de7ac26d650ccd98aa657f795e21ae0e8ab08e13c99e93d783
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d37d05488c70a29904deb01f41987a6da6904a9993cfdfb92dc68a14e5ee9fe9
MD5 7e1d3d48891452cc9e5b372cf94e4724
SHA1 fb861594e2d0da3fdd012a1bf23fbd38e05f5fa6
SHA512 dc5a4f3be297c481e9c8c75eeb22f9a957ebd0cfd42ed82e3dd4df6a809417aef09515c2e5c94e866d854a0c867e02456e909035e145dcec809c0918e2ee5701
TLSH
T1DFA0021A41C518D5CD7046F07172055223518D2426695717A5914D54C9AB6C15232130
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe597d35.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe597d35.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 41c408eabd987ef87f7428fc8161051ae930875766c416dcfa686d01449dde3a
MD5 ab70e69623d76884f3a711ee44cdad2d
SHA1 d66ad3133504a160095b63bc73ba97f7d9368fa8
SHA512 28f3a30c087b4b0dcec6e1f0995a2248b13e9c1bcefc144e2628c7ee577b231169ade1358bd78b3852ec4a6ebd0bd3d9228e708671953b0d51f7e731ef758a46
TLSH
T11DE086B467CED7FD1555D05383B6B30DC6F4BC08D7CB354E5705F4916181A0462E56A8
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Size 20KB
SHA256 452e8ecf53b12a8f3ef558c9f3a249282aa90fa4884f577a7b21285b7ef276ac
MD5 f1913dabf77f6d0693ee1f6f5471d3b1
SHA1 0f4c356e62e9bbed37cb7656fd56addbe0a94e4b
SHA512 c012cc1bb6c06e30dcb4658b893389c2b9e0de51c5bd53bb9452b942981c50f577f638caae3ef74f159986c7cde05e7b87d7eeddf6e39143ad0045c34bc08ff5
SSDEEP 12:TL17CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSx16JccogK76nccogL:TLVCZwE8I6Uwcco5fBxAJL
TLSH
T1A0929CCF2F246833E4B08B3EE2DB41DC8E76D52CDB85EE9590581C21AED0940559F0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 db4df580b869e5b4402781247a310a9679a7638da1f5bb4e81ff59635ab12cf2
MD5 b13c9f89ec1c062e44b4ada4af8f678a
SHA1 0e127a40a1f745436f1c3c05b7a63009fd95c925
SHA512 3f56adf6fc88388aa04a900c3b77d29f4d12ce31130e7669e4c6f1f40967d528fdbf5c0b372e59be38db96785c82f612489b1f9d862f97bd8fe326f2d8df520c
SSDEEP 3072:rI/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipJ:rUGKklOovgmz/HCMJ
TLSH
T13BC3027C55993CF75473E48AF0171E5A0EEAF4EE86858C78ABCC539503934988E87E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 d2803193534e6e383f6847d2a92846251a5d4da62b44e92868816c32b4641d7d
MD5 ddd35ac040a9c6db0947d471b4bd30e0
SHA1 f45f4fb3b61b106ee71cc9eaf07e033af9c1d7d5
SHA512 57534a3688a5a48898ec6a92f22fc931497139dcf7c8db9974849f00b0aeb178c2aebf90eab035ca04230a2b657b77cf6d0e077a4cdc7eb62987dc29375b5705
SSDEEP 3072:KI/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipJ:KUGKklOovgmz/HCMJ
TLSH
T1A7C3027855993CFB5873E88AF0166E5A0ED9F4EF87459C38ABCC138102974989D87E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 57ff8641f9b8e48b920505c287d83f1d60e632c2484128ecf54f8e0c9ed0b76d
MD5 6f9dd1c1b82bd60578f4a2f762462120
SHA1 9d451e22de35c8f86ce44ca6b4dd148d2e2a89c6
SHA512 4953158959527be3d4ffeef6c6084a72a33bc372bd9cd88beb345eee7d188fd9c15579ab041b105b7c289af5d4c98422b4f8c5c22a6868cd7406c212ac27229e
SSDEEP 96:VC0d+nxXdhtrXxtkWDfMt9qAGfRDotok5gfD4B6EdGyvKvM/sVbEScv4a:VC0YZtLxtkW2wDUDQMrw9M/wbO
TLSH
T12EA10A325429AC7714BAA589B9832A438FBC71A7F9129F48ECDC5B0C21E74E91342533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 b0c3549f0fc0814eb6478c839ab87a37a4f19fc8db1dfd1b5bc2e08f11aed07e
MD5 e3705e563cb4c9cabc5a24bf5b1c9820
SHA1 430da602471d2e9fcab1562426afc688efde7cdd
SHA512 79f22c9a2b933c5eeda119418045206c34e124ba28d11ad4036efeb6cbc6143e54510b66ab220da9033297e17e87aee82f782ac44761cb5e4ee897e90bf87cdf
SSDEEP 3072:0I/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipN:0UGKklOovgmz/HCMN
TLSH
T12CC3027865D93CFB5473E48AF0171E5A0E9AF4EE86958C78ABCC139103934589E87E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 a6e450f5f3e84048499f94432ecaa53b149fd968a28ad199e8b935eee215c44e
MD5 f3dbf19e27f08f5135f79882e20fc507
SHA1 eeff657e9e2ea2335fb9b671af6b7779be860ac5
SHA512 7aec7537441e900fe28343ef367e6ff84c38938ba6e03b219ecb184c75fe9ead72bd8746124c5a7cfcae78a55a5c6164c17828852be2d93028a7a08ad9c42f54
SSDEEP 3072:VI/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipJ:VUGKklOovgmz/HCMJ
TLSH
T1B4C3127C55993CF75473E48AF0171E5A0EEAF4EE86858C78ABCC139103934988E87E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 9b2c31067fca2df5522395117f6e14ec0a7fe24883a1419554e5a962374da042
MD5 3721cf69e608a6520389b9211c473ff7
SHA1 645439cef1466b040d76b09c1c7d979c79ee30ed
SHA512 9ea71a915c3536707d670c33c5d3da3c06debf83760a7128b6f460317dbdbf6cc11f31f1a082ee9ca4077e7eed6f39bb1ff8a359101cfc699c42f90c1dd21ee5
SSDEEP 3072:FI/VGA9kCgOFkDP3HzNrBvgeL4c2e/HCipN:FUGKklOovgmz/HCMN
TLSH
T12BC3027C65D93CFB5473E48AF0171E5A0E9AF4EE86958C78ABCC139103934589E87E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 cec348a22d4f275b8e71d3f1aa459d500535d28d603b9042a873670b9981f3ad
MD5 62693ee052900499c6efe9dbb2f2335e
SHA1 906ae6bb411ed6eb549e59ffad23563d2d4302f2
SHA512 24d32211a98478ffb6e9871a4e55508ffefc2e9784e85c8fa8082ca47d5ed5bfbca56d9095aa020f585d6724855e5e2438bcc4241d624a2ae8f2c6d5f07357a4
SSDEEP 3:MsEllllkEthXllkl2zEkl0ek/:/M/xT02zn0ek/
TLSH
T1BE440404FFC40405C51454345011C3500374D5143D3357433D5504135CC55441C00450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 ef9318e5adff7f9694bb643b50734e371ff5f88623c5fa471192f625a0a6b52f
MD5 4e964f0f2d98f0f0e50e636697f7691d
SHA1 2f0aebf8400673df8f508806cfa237919dc3ee9f
SHA512 ff6431bbf09954abe7fc4037e2dbf61cd9d6e7554576a7024381b26bd771bbe52c28e114c65d0488252d30ad748f7352d6df930ce21121cd767f81a86e28245f
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JB:TkkhCU2QB2zbBxxSx1Of
TLSH
T124237A8F1A5821D9D5D5483FFED28C627C7D0F988A1FA9E605D00C7A4CD24AEA53E0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be05b8d7f0bed3c8d0e89a1a49e4bae1f45619d94149f9abd8291f558897f2f2
MD5 e02c579c3ab95f9c3a77f9c2199a30f0
SHA1 f96c7c58830f56a993117d75a3b0f9e30bfc93a7
SHA512 264a83561849b0e2a1c42c3e478b7d5a3b3fa31f901f29440fc853108e9046e73ba21a692d0dbdef7d9fd76e9b6aac64489fb603c47ab551280df09d26d7e2a4
TLSH
T140D080613B05A516D54B19729C19E7117237844224E3D9097171D11EDABD3C4F3C51E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86bd3a0f7328ff17cf8f5c348bd8ac04b7d41c52ef238ad0b048b09e5a964859
MD5 c6e3af776b1f4463a76e29cca079d5e5
SHA1 19b7f1bc72393d7717302ee15e0e4afa431cea45
SHA512 b15ef012a17356e47acc81e1922c433a19e6e554795a46fdf0ae05df1e9abbc87a47b05bc831bac2c6c32faad3f39c7a7cb21ae65ceb4f96f3deb3ea0d83e9c6
TLSH
T1D7D080613B05A616D54B19729C18E7117237844234E3D9097171D10EDABD3C4F3C51F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7cc4449640351cb26fdc791d98bc56335cd80a2511de266dd98ea03aa29d5aad
MD5 3e393d68863f85089578534da373edb4
SHA1 fcc68f14cff79d0c19600c523da9ffc34e9a0344
SHA512 c908ede5bcd1fc2f0c7b41e331d5689205ed6081650a9c0c9f922c8bae24ad2d67aaaeb2d35f68547e6c54484b88b8e911e711232d839684cf44988a42a41804
TLSH
T1AF413C72523A0C25DB18497950F926C873B0B81D010B3FE2D460D0788EF3B80F57A1BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f30564b453a021645e64a796f10839d51f946d1602c2a13f6c99be0e922af8ff
MD5 b1fe8fdbb81585fe916b4bf51453ba5a
SHA1 86d9dc14059ed0ab3fbbb7e4c2f3f3ac7b8e32fa
SHA512 c135997e1529a00459fe91ba343fbec03c6dc4fe39c733adfb6ecc6f62f6cec00537865cda0a5facb02d05a2ac049e554b8e57a7d9439b9cff52f65350ce7bb6
TLSH
T17841ACF3C6E8866E890196F4BB186E2BDE2D0914432C3D5AC9E4AF1B93E3471D24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9b8fe6a090966c6cff2bdb1eec80da3b09b51001c2e7567eeb5b269f6fc3cb69
MD5 00307fc3ba1cb9ab8e7d203597d202e6
SHA1 c79d589690217dd4d9e9e515790222f2aa10ccc5
SHA512 a62af8894fe7d68caa4ebb9b9eff01e15bef77c3ca550f1bc0794f4a3c8553d57201726ffe57464c6f5620d06358079a7023a42e140079bba494446791659538
SSDEEP 192:sxR1R6yM/jK1Ml8wcu/fLsm9vPOZ9CTIszoA8p4g/g6+WNIYAWzwWgYpG0EIgtJ:sxR1wCu/fLsm93o95dd/5IGwWgYQ3
TLSH
T1DD52DA16A638593B8CDBD21DFA557F53D6F81533A1905E48AAFCCA0C05E7AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1f1711d3853d0a37c9747a19d9ec5db10d01a8e6366e9bfc276a5208418d1f8a
MD5 c29f4abf530d860254a02f4538f5a9ed
SHA1 3bac90d303ddf7f559a3215ffae80b05ccd27a60
SHA512 67c535b820f4970b928190e48565f17db6c7aba487daae416150f138e0fef3ff5a23030a07e2305033025fc915ecf9c5170a9de19d45e7af68a26c5ef83fb5ec
SSDEEP 192:sxRaR6yM/jK1Ml8wcu/fLsG9vPOZ9CTIszoA8p4g/g6+WNIYAWzwWgYpG0EIgDFJ:sxRawCu/fLsG93o95dd/5IGwWgYQD
TLSH
T17F62DA16A634593B8CDBD21DFA557F53D6F81533E1901E48AAFC8A1C05E7AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3e0fa68d7ee1f4b335c1e5d4227cc1f8a31ddb9de4c2410195f08a685f24613f
MD5 9dc012a23db91cf2b7526717f84ef5f8
SHA1 038ecc589b77d37a0bbb9cc77e061f611a62705f
SHA512 e03e7dce974f60a3370bc051e5df72082e56e4b990c3b8233ed645354dff9e11a37d4bf075e810864f2fb331146c9a4bdbb522aad87f18a9bfafe70507f52a14
SSDEEP 768:l1AvbY7pLuL7j+WgI+f2z8F1+UoAYDCx9Tuqh0VfUC9xbog/OVShQ7zVOro9stR:l1AvbEE7j+WgI+f2zu1japhQ/VFStR
TLSH
T159E2FC3B680CCB7E4F844A9CEC29BE9F6DA801CF96988D5447EA440C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3c7ac7b16d9ddedaa46af0049321eac2134de1056e87b599a1b185dc78c2e710
MD5 543288bd9c4ea1628e9b01e78dfb2179
SHA1 fa478667dde62d74cd4c192889db375ac2c2659b
SHA512 753c21ae4e92eb02f3ff6be53379b80cdc16ed3c32fe628fcce853a44f3331a4509cad64ed415386ea554343658733e499e9b814c4ba9f7186e4a4b41090c8ed
SSDEEP 48:KNWTyWsUkmu0JNI3WmKsj0Ym4O2JBo23yeHcxFHBhxulesI3NxKs40nx4PhJGNg8:KgZyKqkS6IIKJiWYgKZCWR
TLSH
T102912144347A260438BE6D49B5A8C55EA741306731A7A53F3BAC10EB1E6BE004FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a79a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a79a6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 792ef8d7ce0a891f3124ca57c4e8dfdea63bc2001cdc67c81b7ffc7ad818162f
MD5 2176027aafab5cdaec6003a762bb96a9
SHA1 0fa04800e7c17023c2ac0a4d09f94ea8ea0ef5ee
SHA512 80f5a6718ed4fd786ef398c903d0d9e8c1e3cdc106e6256a9a6f398bc40d4d521897f567dd2b6436bcd510e9fffba26f8330a740c37104ee622e30845ede2a4d
SSDEEP 768:qj+9c31vX9jHM7r5BwT7VWs+DoLSpG0/TIo5dzn12bfJgS:J9c3hN4uVmoTiTXByJgS
TLSH
T13CF29E71A8A89D735CD7C7C5764B66876FE50263C5C82F98C9DD9B0D0A8338D270B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b8fbbdfc57ebf38066dd63cf1d5cfff94dbc059e484fea333c5dda2567f03dc7
MD5 18cb043ae5326a1e966f8b107b8c1e35
SHA1 fa76526e402f1a8df0390bac60f2454dce8d230e
SHA512 e88b92350fca248c8f3f861ce5d552ec86117e0d6d57deed44c47ef63ed05f1344ce192c2ecd13c024a9ee3f4fa6e78fda239c56ee9c29ee0d5b8ede2b515509
SSDEEP 768:mFjj+9Z3FwgjvXwXHM7Q5BwT7VWs+DoLSpG0/TIo5dzn12bfJgS:P9Z3/S4RVmoTiTXByJgS
TLSH
T166038E36E8A4DE776CE7C7C6770AB6479EE10263C5C86AD8D9D95E0801C32DD270BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3bafcc7f6eacb70b93e6e4a7d5d78353546c27f3504fb956f47670d99ca77f8e
MD5 6fd7db37c659f251a2ecd5489de65971
SHA1 27ee706d633978eabee846c1558ef5361097e0cf
SHA512 8d1ec8549061e44c0db77c13f34b05c4e0619e9784b7926a7dba71b7da4949042950a50c9742c07345e853027a7dd30860924942e0d83596ade482ca17e5fbcf
SSDEEP 768:ojaeqD4MlshiLdMmp3DyFjrZ5BwT7VWs+DoLSpG0/TIoF0+ApXGFTX:oqcjhIdMC39VmoTiTa+KXi
TLSH
T1C403BF76A8A89DB39CA6C7C5764BA5432F744353C6C83FD8C9DD6A0D02972CD630382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba1d18aa40dc43ebf47cebcc168b574c1f8ff263443901905e5d0d8aeda73a0f
MD5 c2be4949526b32b67176fa760cf88733
SHA1 5e9b28c80031074f98f583c0602eb67e9c3b52d6
SHA512 1bf32f63ba6b98e0c3c4734a1ba0183fbaca3f83941de2f5334f9b4057649bba320926c977defd33b57cfdaa71a4aa3e6ff8be1ab2a69b8a4a708c330f090c06
SSDEEP 768:3j+9c3uvX9jHM7r5BwT7VWs+DoLSpG0/TIo5dzn12bfJgS:69c3cN4uVmoTiTXByJgS
TLSH
T183F29E71A8A89D735CD7C7C5764B66876FE50263C5C82F98C9DD9F0D0A8338D270B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_576751671\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir600_1213860783\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download