76fa9dda1accba6dd362b6c315634d5c4352de8a65d6bb0539545faba63d63f9

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDM_6.4x_Crack_v20.6.exe
Size 1022KB
Sample260629-stchvsgw61
SHA256 76fa9dda1accba6dd362b6c315634d5c4352de8a65d6bb0539545faba63d63f9
MD5 9181cad04037ef635383e6557b0d7283
SHA1 4ac312391d6ed8bc23e7a3c5a2673c1f3ee1c3cb
SHA512 fe1a0808849040d19e3db4de6670d1b0f85ed43cea53cc994a85ca411d326cbde29c57bebe03dc453d195d8d26efa4bbb147cb697676137f589f50d82d79cd51
SSDEEP 24576:qz3+jPHNqcaKL8lyRpg9ZK+GsKzwxsc4j5p+3j7fX:qT+DHNqcaKL8lyRl+GsDD4Na7
TLSH
T1F725DFDDADE700B3E9A9EF344C287119F878FBA68814F12507057792863523E6E9F706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 5896 created 5880	5896	IDM_6.4x_Crack_v20.6.exe	88
PID 5896 created 5876	5896	IDM_6.4x_Crack_v20.6.exe	89
PID 5896 created 2032	5896	IDM_6.4x_Crack_v20.6.exe	90
PID 5896 created 2512	5896	IDM_6.4x_Crack_v20.6.exe	91
PID 5896 created 4208	5896	IDM_6.4x_Crack_v20.6.exe	92
PID 5896 created 1408	5896	IDM_6.4x_Crack_v20.6.exe	94
PID 5896 created 2784	5896	IDM_6.4x_Crack_v20.6.exe	95
PID 5896 created 5880	5896	IDM_6.4x_Crack_v20.6.exe	88
PID 5896 created 5880	5896	IDM_6.4x_Crack_v20.6.exe	88
PID 5896 created 2512	5896	IDM_6.4x_Crack_v20.6.exe	91
PID 5896 created 2512	5896	IDM_6.4x_Crack_v20.6.exe	91
PID 5896 created 4736	5896	IDM_6.4x_Crack_v20.6.exe	110
PID 5896 created 4780	5896	IDM_6.4x_Crack_v20.6.exe	111
PID 5896 created 5724	5896	IDM_6.4x_Crack_v20.6.exe	113
PID 5896 created 6436	5896	IDM_6.4x_Crack_v20.6.exe	114
PID 5896 created 2516	5896	IDM_6.4x_Crack_v20.6.exe	115
PID 5896 created 6268	5896	IDM_6.4x_Crack_v20.6.exe	116
PID 5896 created 3460	5896	IDM_6.4x_Crack_v20.6.exe	117
PID 5896 created 4736	5896	IDM_6.4x_Crack_v20.6.exe	110
PID 5896 created 4736	5896	IDM_6.4x_Crack_v20.6.exe	110
PID 5896 created 6436	5896	IDM_6.4x_Crack_v20.6.exe	114
PID 5896 created 6436	5896	IDM_6.4x_Crack_v20.6.exe	114

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6436	msedge.exe
3284	chrome.exe
2512	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	IDM_6.4x_Crack_v20.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	IDM_6.4x_Crack_v20.6.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{992CA7EA-694E-44F7-A3EC-DEEBDE658944}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{6CC341D4-8E4D-44ED-BC7B-CD984259ADA4}	chrome.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5880	chrome.exe
5880	chrome.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5896	IDM_6.4x_Crack_v20.6.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
4736	msedge.exe
4736	msedge.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5896	IDM_6.4x_Crack_v20.6.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
4736	msedge.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 5880	5896	IDM_6.4x_Crack_v20.6.exe	88
PID 5880 wrote to memory of 5876	5880	chrome.exe	89
PID 5880 wrote to memory of 2032	5880	chrome.exe	90
PID 5880 wrote to memory of 2032	5880	chrome.exe	90
PID 5880 wrote to memory of 2512	5880	chrome.exe	91
PID 5880 wrote to memory of 4208	5880	chrome.exe	92
PID 5880 wrote to memory of 4208	5880	chrome.exe	92
PID 5880 wrote to memory of 2784	5880	chrome.exe	95
PID 5880 wrote to memory of 1408	5880	chrome.exe	94
PID 5880 wrote to memory of 2784	5880	chrome.exe	95
PID 5880 wrote to memory of 1408	5880	chrome.exe	94
PID 5880 wrote to memory of 4844	5880	chrome.exe	96
PID 5880 wrote to memory of 4844	5880	chrome.exe	96
PID 5880 wrote to memory of 6200	5880	chrome.exe	97
PID 5880 wrote to memory of 5176	5880	chrome.exe	98
PID 5880 wrote to memory of 5176	5880	chrome.exe	98
PID 5880 wrote to memory of 3160	5880	chrome.exe	99
PID 5880 wrote to memory of 3160	5880	chrome.exe	99
PID 5880 wrote to memory of 976	5880	chrome.exe	103
PID 5880 wrote to memory of 976	5880	chrome.exe	103
PID 5880 wrote to memory of 3408	5880	chrome.exe	104
PID 5880 wrote to memory of 3816	5880	chrome.exe	105
PID 5880 wrote to memory of 3408	5880	chrome.exe	104
PID 5880 wrote to memory of 3816	5880	chrome.exe	105
PID 5880 wrote to memory of 4452	5880	chrome.exe	106
PID 5880 wrote to memory of 4452	5880	chrome.exe	106
PID 5880 wrote to memory of 2084	5880	chrome.exe	107
PID 5880 wrote to memory of 992	5880	chrome.exe	108
PID 5880 wrote to memory of 2084	5880	chrome.exe	107
PID 5880 wrote to memory of 992	5880	chrome.exe	108
PID 5880 wrote to memory of 1436	5880	chrome.exe	109
PID 5880 wrote to memory of 1436	5880	chrome.exe	109
PID 5896 wrote to memory of 4736	5896	IDM_6.4x_Crack_v20.6.exe	110
PID 4736 wrote to memory of 4780	4736	msedge.exe	111
PID 4736 wrote to memory of 5724	4736	msedge.exe	113
PID 4736 wrote to memory of 6436	4736	msedge.exe	114
PID 4736 wrote to memory of 5724	4736	msedge.exe	113
PID 4736 wrote to memory of 5724	4736	msedge.exe	113
PID 4736 wrote to memory of 2516	4736	msedge.exe	115
PID 4736 wrote to memory of 2516	4736	msedge.exe	115
PID 4736 wrote to memory of 6268	4736	msedge.exe	116
PID 4736 wrote to memory of 3460	4736	msedge.exe	117
PID 4736 wrote to memory of 6268	4736	msedge.exe	116
PID 4736 wrote to memory of 6268	4736	msedge.exe	116
PID 4736 wrote to memory of 3460	4736	msedge.exe	117
PID 4736 wrote to memory of 3460	4736	msedge.exe	117
PID 4736 wrote to memory of 4908	4736	msedge.exe	118
PID 4736 wrote to memory of 4908	4736	msedge.exe	118
PID 4736 wrote to memory of 2744	4736	msedge.exe	119
PID 4736 wrote to memory of 2744	4736	msedge.exe	119
PID 4736 wrote to memory of 2956	4736	msedge.exe	121
PID 5400 wrote to memory of 2436	5400	chrome.exe	125
PID 5400 wrote to memory of 5036	5400	chrome.exe	126
PID 5400 wrote to memory of 3284	5400	chrome.exe	127
PID 5400 wrote to memory of 5036	5400	chrome.exe	126
PID 5400 wrote to memory of 5536	5400	chrome.exe	129
PID 5400 wrote to memory of 5536	5400	chrome.exe	129
PID 5400 wrote to memory of 6200	5400	chrome.exe	130
PID 5400 wrote to memory of 2448	5400	chrome.exe	131
PID 5400 wrote to memory of 6200	5400	chrome.exe	130
PID 5400 wrote to memory of 2448	5400	chrome.exe	131
PID 5400 wrote to memory of 6796	5400	chrome.exe	132
PID 5400 wrote to memory of 6796	5400	chrome.exe	132
PID 5400 wrote to memory of 4220	5400	chrome.exe	133

C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe
"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff7775c728,0x7fff7775c734,0x7fff7775c740
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,12431940298519216271,6158247030640942053,262144 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,6438777246219447536,10068403391490708249,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,16183293200513703372,543655266582431540,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,14931671853772265686,9461299764497634629,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,12486906189595577153,1016972875837665980,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,8489285655691502922,10410668386208241184,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,16250134565767004379,641113644713235524,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:6200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5140,i,15918037666537754582,4757848496555114430,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5160,i,9024780861259941305,12705528743867381049,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,4005605462180145390,17926533747785959296,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5148,i,2395079077842097043,13257833578299766071,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5136,i,5201689156174659574,14201841106369786589,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,9046470936265573171,14926839497094903713,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,18053627236682549169,4879723311716776057,524288 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5176,i,16105643941229456595,7437164895627259393,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5364,i,4910816531218473748,14367402098953418118,2097152 --field-trial-handle=1908,i,13222630240991352939,80177785389209539,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff5858c188,0x7fff5858c194,0x7fff5858c1a0
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1980,i,14253853841121895189,16731201855742359176,262144 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,10447430728546292595,13200335968502099547,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9995728661896897313,13432758289806453587,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,12661968948540999788,4700377146671022900,2097152 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6822856217944655240,14502757588824525035,2097152 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,810461240221856744,3281767493822488808,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,15585141698151693486,10217943063145706922,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,2197035689994937516,12404945135633914281,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:14
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,2197035689994937516,12404945135633914281,524288 --field-trial-handle=2436,i,16286091755416155771,7088336373363253916,262144 --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:14
    3⤵
    PID:2956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff7775c728,0x7fff7775c734,0x7fff7775c740
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,5957627368159786318,7169917443878211775,262144 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,3273094602708857101,9026601766166916282,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,9728065266804074842,12892893371829049708,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,18217011905009163948,6721115961572111246,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3336,i,13898625457428195104,11322292695018485563,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,14263123157308112137,16765730482999367431,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4872,i,17115821112478087601,5399081385691554726,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,8867071188729373819,8405736605965540114,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,2510559668580365548,4165218496747628868,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,11931791250575921554,9229935328130869494,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5276,i,5120334034196879915,839616115794545767,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:6532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5740,i,1296451848474645325,9010294728207644140,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,14233699297341186922,1074427004517906171,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,2754800990881111456,11821848766884162202,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,2796407193633377164,10857868945504298594,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4744,i,8684607390342996270,14476048398286730475,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6068,i,5743225874774869443,14917197364760203467,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:9
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5928,i,10684672131299152964,10822185602770274073,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4876,i,954092908812965315,15214431902135873901,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5912,i,7592906599941106872,13443402614088843537,2097152 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,15317725323764640993,5982918776343935163,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12
  2⤵
  PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,6535246433007390717,5216980877418834395,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,17843008888030644041,14487940123644100327,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,8258405939249514273,13768656121483725237,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:6308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,869965653131892565,5096711066206263173,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,13180835234306078895,11921097177340511326,524288 --field-trial-handle=1916,i,18326019256604114762,1048116590159201726,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:4916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 9a91970b7f13a5ce6dd0abb35392efb38ecd226df75eacabd8f20bac08953a76
MD5 47d105a34a124648f3b9d74575ab437a
SHA1 6cab6303ebf70e9cbb55928c7872a1955174eb8e
SHA512 7d4bfecffb389b8c7d310e56a32cb74ebfff924c9ced5a29737d30896d798ddb2d6bad5c2253784a7d31061977f60cc6b41526ef46c347257b4c4849dd793075
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 afa9f75bb4469ccb88ce8b8a07cb247836bc6f1ab4428fc22721c9c0760221d7
MD5 f6e5868fe19668a8b3dce0126ac1b134
SHA1 c3e428e577947ae77d0973036ac3be538176f57b
SHA512 bf061c6287fcee0bb06a2fa835752bca6325a8af5c6bca4aa4bae09229ba2223d53a15af4331510a97b076be50bf0689c907069424ac588a29c8599c61b2301f
SSDEEP 6:/FoxxJnYGkM1Izk5Xeh3wtjRmeDZ/E69/RPV9U:dgJnWNI5XeeYiZz9ZvU
TLSH
T1C713172CA9470E06CFC30078885F1B74EF71CB65AAEA962F693276152980B060E474B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 923d8f6f732ab8f66f1152df6c181400801068965e724a857bcb43d2b22e1c74
MD5 1a1caaf29a3bf7fe7b36068e16572f6b
SHA1 c7aa01d9aadea3491f08c16e2595b2bdde104114
SHA512 f736b97a1b1102fe4afb11a00ca34d2454959c76e1ceb7614bd158838166bbed40c660774c78d6049f18c67333e50af919f40a2141419d25fe54812bfc6dc003
SSDEEP 48:XFXYGX6eM1Xghw3IDvIMmXWNUdVEPLVBKWwtlMSC7W:XGm6eugh6IDQjWAVOLHKWolMSC
TLSH
T16444BAF71D05EDC6EB19CFB41C02933C8E7283321D99EE75F26C88A215919D731146B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b6d681a3b7a90bfd7535ee0faf1693a2fe090051de425da42f1ad6f40799c64f
MD5 86b21944b3fd0e8882ebe8d297d9255a
SHA1 20422b9cb0b8662b3fe5df3b47540ca0ed198c34
SHA512 b025bd61480b3c46f97d9aa0b1b41c93ea2f87ab37ccd94584f9690282f8e47c1151ec23ddaad9b6aea7b886e05ce7bcb74c825437986aa401359f1d46ca5fdb
SSDEEP 768:2fDPLSgcRUv+M4xUfDPLSgcRUv+w4Vl494q4LUfDPLSgcRUv+24:8VGAPR
TLSH
T1DF164CA30F64A942DA85EFB0BBCDDD1C7C742396EC929892F12252BD49E4FC41BC115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 24e10e5ad900e4b739ab1a2ab0199478789425a6af14bbb01e0e46847ef25014
MD5 cea1dc78cf84c5c0a8a8395ddcd1db9a
SHA1 b2f12a4dc9e79b08c3bb87e7cb64c6a82c702b05
SHA512 f5a4e56679937c26a18407f7be8dba0fd515990a8f0473bc1f1d84b175950b46ac837819c0fcbfbbe9ac7432ac96077cbe65cab28d7c24381baf60f655137dd7
TLSH
T1A1E0868E64CADAAD509985ABC27D630C8AE1350AA7CD3896BB05E463718560462D2255
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 110KB
SHA256 96aa12f1c1e84eeb787ace9f03b5da841aa2daa3ac150377aae0835e540da290
MD5 fe7e7bdeb24a3bf1f66c52d2fa84132c
SHA1 bd14eb8730a1625459808df0e0c5329a5761c501
SHA512 19ba408154c9146c7bce3856bdf5d9f7daf6c07f4c9250f59cbfee8775f2c76c97e0493486dbf98d04c5f050a38a13ad13e708d934bcade82e775a8b6bca814a
SSDEEP 1536:7sw8Z49/qoypmckmWmeM+gcrja+G8+HaJVkAbdOhWm9u0+h0wmgF:7sw8Z49cehVkAbqWm9u0+uwmgF
TLSH
T13AB3D91E12E435D7C24C8171586249974BFD2E0E249D60DFE4C17E1CA6BBE866338FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 9a9eae687e04e9e36f1ea7d813de501ecf0b93b10c939cdfc80abdc16d365dd8
MD5 f3019bd6dd987b7b8586c47d90752ab3
SHA1 253df19d4ec7d4660e7c3fc9b3b42ddfb1e9e1ec
SHA512 f5486c94e0440bdabe1d974130b078e5c7608b831d69451025888a03856c5d16a8cd5c9ed6e5c1509f6ccbaa6cf6b656415fc2fc589e9f822b019c76968e7ad3
TLSH
T109E0206CA5CDD65F109484EB5534770EDAD6650CD7CDAC959F05D41170CA80C98A8250
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 36bb3d56b9fc2ceed15ec04329eed9e042a84202a12442cf7cd53d4bb3931022
MD5 e3c97faeebc8180594994493263749b8
SHA1 54bb7bc2bec2ce7df5388896c03a76ad624bd6ae
SHA512 ae56d5d387fcc07d56889bbe80cde3bfc508616de6230a94203f9dab78495e1f15d3f0c9e182c13b739221d359cf89efcf6be0d824b9e4cfb4f3c42fddd369a9
TLSH
T1F1E048E569CED26D12498057526D734CC7B0340ED7CE6955AB09A443E18D51C62D2392
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f695aabcb8c7a40ac7fe152388ea3a093b5272be50e1e6a3b18320c6d099be50
MD5 21ae8ca4d732e2e97cafb6e05c5a148c
SHA1 092727975591c76d10c9eb5f2e28ede6df5d7ae9
SHA512 93e8126f7d23e2eac6cb50a9bae9783700e0388712972daab9b83726e18f75e30780ed2cf61d8497203b1a09a7daef26d7389861b26a7192f7f24c5034fcf7b6
SSDEEP 192:4REu0Vgktlv7m2APRp2h91Hsb+WNn0LQWFVyIsnAUge:4Rr0VZtVS3Xy/wIQye
TLSH
T12A22A52EA914753B9DCBD21AF9257767D7FA112231D42E80EAFC8A2C26D75CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6be553de4117b42d8589f07f2cf2c953191968477d3f206429d07854eb22c2c2
MD5 ae947caec1796dd8bc281bbb3f5724ef
SHA1 1f96cfcd2345581e96e39b36393a85d8bc8547fb
SHA512 56ba5a1531c3670b4ee2f94303368871867b9da8328317ee2def90e48e5e70054c62facb61c5ae9003ea87369e9b33e789e0898f2d9e2801c56140f9d69c14cd
SSDEEP 192:4REu0Vg/Jtlv7y2APRp2htk89T491Hsb+WNn0LOMB12uFVyIsnAUge:4Rr0VItVe3XH/wI12ae
TLSH
T11832B72FA910653B4EDBD219F921B75BD7FA112621E01E84EBFC8A2C26D79CC3117027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 8111121505a7d47b6509daeb0db3d1c3921760286bf0560d3672588165d3b5a8
MD5 ea20a66654437fbcfd40bdea97492c55
SHA1 3ea4543d8a0c1910b1352fc35e8b5f42690ee67d
SHA512 d67344209d743e2170921a505edde6dce26a080eaab8010d3497423cd884bb315c3737b8530110fb52fa7a9771dce5a69fe7b12d13a9ef7a84a7f31de6b77364
SSDEEP 384:jBjva7KxkXqKf/pUZNCgVLH2Hfgsl5QXODve+ErU34fHGq/rkyO0bPOH:jBva7KxkXqKf/pUZNCgVLH2HfgsXaO7j
TLSH
T17452F867648D9A7F0FC8D68CD8166F8FECB602576668092457FB9C0803A57DB120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82e4335f-c176-41d9-b879-1c6333f7d591\index-dir\the-real-index
Size 2KB
SHA256 661f035c724c775f037ec1c9d9642d34223d7a2e43bb58c9444e8ae11bead740
MD5 1864a50a222daba9128a5b000df7fabe
SHA1 fc873e2b09278ad66231243f84c8339fc5664938
SHA512 9acb70991d09d0eaf4c3d5528f728eb5de4691b23142d4cfb9c0018eeb4fe966cdf5d0b511f718bed8e44ca1f72de3f4ee33f7204c3b1988356365e7b76cce15
TLSH
T16841444CCC8067EEDCB591BE195455F697B51C38FC4CC3A255A4B1B63403A5817476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab18e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82e4335f-c176-41d9-b879-1c6333f7d591\index-dir\the-real-index~RFe5ab18e.TMP
Size 48B
SHA256 af69b63640382248d4d6367b3bfba9389c96331ad3c8e6f58b29962eaabecb09
MD5 1ad97b1915265e249cc73bbf3e97f359
SHA1 d44f635a45e6b8cd7234b6730fd58a96a83924c1
SHA512 430f1b698d895e49cf1ef38e0f0b582f73a1f3fd88e1ef4c2db6909f41b297acae766837b6ec2b58c20d8dbba6db3ddfe6fc8e0c4a9da87d298b7343d4e7d5ec
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fa2c2d55-13ac-45e4-835f-ee7dca34b03b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 b62365d015510c42019759264c100dc86cde8aaf6395f22a8fd1003ee24ff688
MD5 35f88ba43584496721b8fc2e59d70695
SHA1 d0bfb7997731c686aaaef740c6586b1a6426d562
SHA512 c5643d14982cd4fa2dfb312a7d8cf39621c5c07f6e2a4a496b82f115c033a4f02a150a741e4d706893b4594bf9479c46e48bb51ad2c5366edc5d879127c3b6b8
TLSH
T15BD023DB5D7285966A30F6547038655DC4054D04D8C6CCB469C4F3C321BC507C408579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 9215f4133f287bafea079b26ba1d87dfc7d7fa3aefd7fb38a32262587d382fe8
MD5 17d9f9ccefeab1b1e587219bf5c98798
SHA1 35b5e1e56b43633df59cd1768cb4917f2e59efd3
SHA512 71948ab6186f0817cdc2c697be55a96f8d7dbcd06542b86c4f07c37a4f0cb237f29333df4cb5897315f3a653413b9aa67ba248f4548581567d5c8b3a6c0c1ba5
TLSH
T142D02B66986114999E739A92283224CF8A6FAC448881CCA43485B00515753075805E3F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 1088c9c1303e56449273ca21d9a23c0e80240e3b12dfbbf74de58f986f71456a
MD5 5cd61463ba9067ec386cc1faba69af50
SHA1 0105c4d24e7df23ab7d9573101b9ecfaadc19f11
SHA512 c4ecf35ca015969f4f3b2523573ed9caa33c31eb8aeee2f45238b0777368521f96508dac521f1b61ed29194354154e4ddddbc502f5d1ad2ae38466ad917839ef
TLSH
T1E4D022EB493288562230EA80603612AEC80B5C08D881CC98A9C5F1832078313D70EA3E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 a084af56bfc540c8732346694d38c5072a9feaa19210052c843040433d48de9b
MD5 ada5ae4a2cb892f9d8ebbe4cdedb4460
SHA1 a27c19ffdb5b524901c8764d9eddb839d6ad6d86
SHA512 6c76d530133800696f29b4cc4ba3d330e483ec426504c4eb4a0bace5640bb7abb62f85a3b5fbb2562b3b0847c86d33a3cf6385c870e82ea1e78eb83a505d8c59
TLSH
T146C09BE70D1185D65670DAD83035775DD50F4D48D8D1CCE47584D14362755134405A7E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 b7f174dd071a8bfa8eb8ffcf5dc791fd3b2c305b81e3e8a3a6e7fd85b807d6b3
MD5 8784faa3bd5ffbf1ae6c53bf3b7d8f15
SHA1 bc973f88db6c11a34fa661034ce8427ed9d9289c
SHA512 dc62f627c62a03a6e138c7f14088fa93de359db5790ceb57572cb63f0bf8bbd8c7f05e1c785d9ed1d7362a42d4cc6bb0e5dedda6dc6a05c7cc2a707ced5d3816
TLSH
T101C09BE70911859A5570DAD45035675DD50F4D48D8D1CCE47184D14220356134505A7E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a9dd7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a9dd7.TMP
Size 137B
SHA256 5ed44c449558510d6026bd7e3f74e34f1387449bf19b35bcf9fba0ba68ecb418
MD5 948ccce4aedb0afed4d83c15c0476b4b
SHA1 30e7b2b996743d3663e2c25b52ed2e45ab8d1dcd
SHA512 15b028998e92addbb52707898ec4ba6b58f22cd20df3860c075004aecfd599452c1a966daac9fae6df806c614da563c6d15089ffc4ee8aa15cd27f2bdebefb6b
TLSH
T17EC09BE7092185D6577195D45035679DD91F4C48DCC1CCE46189F14230355178405A7E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 95aba1be451fe5c6c856314ad74b3a87da753498eef81a1e8f6a129f72ab0873
MD5 edf5a1730167fcfce46037d6d4136c63
SHA1 1c4764ee08ac5cf30f9ef82f35a53c3c34b02c7c
SHA512 6402bab64714f38a180119e5cfd4d9d89d3160f3e6d8160aa6e0d9943bdfbdacf2c47cef084e9ffb46814bd4be733549e0600a5dcaacd37441d151a0f1ebc18e
TLSH
T147E026E625CBE2BD105D80830239A34C97F5F41AD3CD38467F00EA4252C9A0874D3241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 62c492bd025b1af46773a0c18bdcb8ed332b2305c4c111f0a28df2c1d2d2172b
MD5 fafaf25d4ccb39a4bdb35388378409c8
SHA1 5e9de2a78e9fa5bd2f5382852b3e964431085cf7
SHA512 8601b7e0468d213f8965a41dc5c2ffde1cbf8f37f85293abdf821cc00756405d1308ffa5988bbed421aab26a9a60a1ee352d42b2d56577814fe2633fcf246dd0
TLSH
T1FFE026E92CCAC37D41588167023C730C86F07409E3DD296ABB02E042E388A0862C2791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 055199d6a596d42d2b98471bf9fcf8f1a8c65ae33f8f4cc0e8905186a7d0a155
MD5 34ed5f240efb0f4c26b7de2ea6ba86c3
SHA1 47c435c8e1ffecdb21a5de0de5046450a5b8e6e2
SHA512 d00d454c93d18529c743c59fdf3a4249ffd78f758ac57af666c210470aae5e97184b4c7bded73e5760b0799ce12c521498e169a9284a0f67a6de74e91b87ceba
TLSH
T1CEE0D86565CAC76E504A509B623AF30C85F1BC05DBDE55657F04F441A289604B1C3341
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ea1c10697136057fac239bfd31fb309b65b616957fccab40c5594377c4b82455
MD5 e483b861bf923f452d96faada1c725f9
SHA1 007922f89b1308e7509bb04419df223df97c3ead
SHA512 1ae339ffadb50bd43d3a225d70ed7dd701348f4632da7106556d312c894e6e922b4c068bc98f69a7a81f0b6951ea6bd3a5b374303fe26077a961b56f2d8270bf
TLSH
T1B7A0021885C358B1DD5347746065164133B54DD5D9939317D5A915C99C9B2D84541244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 56c35fb3c31d702e4b0ceed1999408325c3104d2c7d740534965d1be44c96913
MD5 8537d8a183d7519ecbc5abd939234cbf
SHA1 f2319b3655ea24df5d38bb67e11defeef62ee842
SHA512 5b6cf224adb1740545379f44e549767fb6ba5266606dc0a13c6d08809112923f2b7c455c80f14b725ef4026c1df893fe5c64f54f0da31618b19c6e8888cf2a22
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 c651a8beed08d2df90de6e4c5a01cdb3002d24b9abea6697ed962e99b25f2881
MD5 766161028cdd3b77a920df8f393d16c7
SHA1 542729eb3a52dd4b2dd69939a7045c917463bfea
SHA512 afc24b4f39a7c14a4a445fefbed6411e742633a170833d973cd091224cf051aa69712d650c4b4ecb4aa9c3cae71975ff438eaeda1ea0d9511f4c220505781e33
TLSH
T18751CDF3BD015435FD6798FA11EA396CDE6BA30E0899D2D5D3CA1E31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 024869de809a0feb6bba2ac21625d5e7a573e8841b456d1b0f929cdfdd8bca39
MD5 68e3a2f5a14373d625722f162b41ff0b
SHA1 a80d18c14540e00982602c9a97efcd5006d263cb
SHA512 c9b5c0d51195062ad38f44cd54bc27d0c9a4f3c682a6d4283972003bb9b7bc17dcbf6b880413bb1f4656abadd2ec437c23fbae00a1512dfe992c941193d400e6
TLSH
T1BFE04FF565CED7FD104880D38378A30DC6F0780997CF369AA7046486A5C560861E3691
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5400_1762181542\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5400_1762181542\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5400_1762181542\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 bab9e5e5b8c64807d379e8df222750be7d2b1960545b75e436f00dcadb02ae40
MD5 9c79e7bc88f461cbd4de35abe9e30ee8
SHA1 b9302c9f6cf9f29a5801584db3a0e75f19c740ab
SHA512 665afb83242300b4d97570a43efdb5fb2a2d1f886da0a6e9140c58c5bda7bc35b4b939d9e85a7eb61af32201dd3027939ec195e46627311af3a11d5b09adce73
SSDEEP 3:mlFNllv/etXlUvz/u+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQcydir:mqlUvz7LWc/mLEJOgLEJLryEr
TLSH
T1F70222AEA0A0805AC43000BCCFCFA4A4BAAA0EACBF86230131D8009C3CBC1028020F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 21KB
SHA256 403f0046b2a7e1728fa5112cba08e5f72a2a08b28d51c431fd255b81838891a5
MD5 df0a833e7819ae8f5ae3e18615c04f44
SHA1 b0ca31a5cba8566d20fb9152265a26ed37c0594e
SHA512 704fa3a755a1a72fd58fa7637d6558b7e18c82737a9e9a36d990a57c6ccda8670648d662d138116481ecb3ec08f4e9626284fb6cad86f0d17360424809fc3d6e
SSDEEP 384:99TTsdG/iXi4PsdG8XH1VsdGYeQOIIINbNMIMwBj3Q7sdG0M:pi4qeQ9M
TLSH
T15AA2E68EA3B09BF2DCCFA7FB78918D6E17769FCE5056100560A35FAE6437E064881385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 ba092f5928085b89b33009dcfe0b7bb2a4a4fd06abe6b63ce74e22450194abc9
MD5 51873d2299ba907723ae1267081a9f5b
SHA1 fcf97196169691a603f91d6d8bf6cc650d6c648d
SHA512 96da38b6a1662c118eea97aecddd7a6bee58bc6d124eb07c0f6ff143adbbcded630193eee8047d51d740ab02e85208eb4b527b7f02525650dd1fa359994b7dfa
TLSH
T1C4E0268AB8CAE6EF6099808F013D630C96E1390AEBDD14CABF02D047A28820461C2241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 fa5fc837b6d3e6c92dc35e1780529e1dc2994aa360c83b78b88bcc3f9b5321c8
MD5 77ca533e98d2c1769bf2a9c023ca6362
SHA1 d49c7bfc36b75db97311258a201d7658f56bad08
SHA512 3c042c7f9c3170d28f8ad5de7ac0f13cdd9a2681b8488a256e0892beff58dd642c2147dc66b03e16ffa427a58cf8eb1e26199985f033e3eaa93f6665badabde0
TLSH
T14F21F556F330C20AC25A467A256E9B151738D4519FBCFC0F00B660683EB2B641E4B2D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 87d26e959df5feaa30875c2b3c0077874f2d22c6845dad7db0c6cd714f4f96b4
MD5 cab3cc55a12688f3e7f0bcc390043fe8
SHA1 7623d98d6722457d5d37d3f97d5eb89e02992f5f
SHA512 e78a9a41c1ccc2565637565216f1879d9c3b7b6fb841db177340aec91bc67f33a6b7483b965733104b39b4d6f7a634b4fca630eb8633587b9dec389801587a6f
TLSH
T1F7E020CEB4CDC6DF405E405B027CA38C86E23815EBDD1D45BF10D847918430471D7181
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8dd62498e9378d4d4f09a67653194920763e5b89d0de6d6eef361d43ed655040
MD5 9e7ef4e870c5e45765cc03da970ca9f1
SHA1 69e03ebccb3275d0ebfd74aa1209b9c7e2f44abf
SHA512 8f8b5b9d1e913a3fa1936d783b5ca35b3ecb7b2a8e2dca3d352170bcc837bd24a2cf17298bdb89a36677da0d4865fa8129528d619479a6847edce858335fd729
SSDEEP 96:VenC6vd+KKiEfYGEgI8WfX+VgSl8h4otop5eDDTTB6oGyvQ2Fu1I0dCTTdZIc0jx:UnCwe0GEg0XRiU2opU8umGKTdZZUT
TLSH
T149C1D872E86D99375AA2E156F0032E57CFB862EB55509F64DDE80F0821D74EC2347533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ee64f5de71179054c50cd30a1861c453c5abb981ae12707d881a279f01ecb449
MD5 5b12edb15acb9684252de14d1cdc3e8a
SHA1 a758e1a86ff52260f4a421da6750a35ee3278a3b
SHA512 1f402644bcdfe2a6ed37098295edaa1b493918b65250ee5376a041b2d9381a31ac22f50c9465630ccc882064a1e590c3feb57ea83e284fc131b6f2dd2ea64186
SSDEEP 96:VejC6vd+KKiEfYGEgI8WfX+VuCRDotok5e7DTTB6oGyvQ2Ic2cbHfUv4a:UjCwe0GEg0XQDUDwpU5c2cbe
TLSH
T1AEA1F536A869493755B2D486B1036F23CFBC72ABA5919F94EDDC1F0C60A74EC1386532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e7b1a5b3cda8625885f0a54225707f7b3bf8b1499afa1446dde52f8cce689d7b
MD5 bd4763b9b62f9656063284fa1c96f134
SHA1 1a8ae7f046d7988747f118653b13388f8fccbc01
SHA512 e77c4529bf93484804c4d53e087098149aee42bb89a1bada5f8bc3044b1f624546d81912f055381145f001fc6c8a68da0e6a5a2dcf4ba5f9ed8da98846261482
SSDEEP 96:VejC6vd+KKiEfYGEgI8WfX+VuCRDotok5e7DTTB6oGyvQ2vcZcbHfUW4a:UjCwe0GEg0XQDUDwpUWcZcbB
TLSH
T140A1F532A869493755B2D586B0036F23CFBC72ABA5919F94EDDC1F0C70A74EC0346532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eba7ee2bc48df17501b47cd0d020138a27def3eab9c3f3c8c72b336f306e5a9f
MD5 284463de2b63e2bad360792bbe914d95
SHA1 221289a73dfaa9f75e89db7f55b3f7391464c770
SHA512 bccfdd2c7506292a60703fdfb79262ab9805386bbfeab4f7aa5321b078ae1e682b10a4e1642f0fa14fe17ef38fcc219f9f58ef484f823a3f1554a6aca8395e27
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/Y:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBi
TLSH
T11CB2795171BA2700383E250EA2BD941F5A46306230DEA97B7BA931E56F67F000FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a76643b83f6bd0c49b91e5f0828ee526d96c3d7821771413144b54c801d07075
MD5 764e8ff29114c0adb7c8b35c5c2c3a12
SHA1 68371fdd8ab5c501446d036f82e068cbbd5205fe
SHA512 b1b1a7d0523685363dfd2ec4114642a36554d4572e6b3b47a26c50d6a95ca019f839c9806984b77d128247f4ac33dc8d8a63bcab5303e32a94d3cd3cbcd5d8ef
SSDEEP 384:nhiF1tNn/s3n9Sv8Nt8TUNTUlIR/0zvUoPOfoFGNgk2vpdkmn15wbAjEJXp8L+1N:IF1j+9Swwgp8GqXvvkmn12bfJXZ
TLSH
T1C5C24A36DCA4CA7BEDE68FC9B7097606EEE40167819C5AD8DAD84D8C01D32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2e2cda1

Path C:\Users\Admin\AppData\Local\Temp\1fc3edc6\a2e2cda1
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85564957-ccfd-41a6-8633-564bf1db9ba9.tmp

Path C:\Users\Admin\AppData\Local\Temp\85564957-ccfd-41a6-8633-564bf1db9ba9.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5400_535753319\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5400_535753319\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5896-10-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-6-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-0-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-7-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-9-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-5-0x00000289EFC70000-0x00000289EFC71000-memory.dmp

Download

memory/5896-1-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-2-0x00007FF7DF120000-0x00007FF7DF480000-memory.dmp

Download

memory/5896-3-0x00007FF7DF3D5000-0x00007FF7DF47F000-memory.dmp

Download