hxxps://rendicion[.]contraloria[.]gov[.]co/stormWeb/#/login

Analysis

user interaction
yes
max time kernel
1049s
max time network
1024s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rendicion.contraloria.gov.co/stormWeb/#/login
Sample260701-1mtskaez6r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	msedge.exe
2208	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274160107368659"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{A2427C01-1BE1-4E98-A33E-F0799BC301B5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
1508	chrome.exe
1508	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2756	1668	msedge.exe	85
PID 1668 wrote to memory of 4644	1668	msedge.exe	86
PID 1668 wrote to memory of 4236	1668	msedge.exe	87
PID 1668 wrote to memory of 4644	1668	msedge.exe	86
PID 1668 wrote to memory of 4644	1668	msedge.exe	86
PID 1668 wrote to memory of 2560	1668	msedge.exe	88
PID 1668 wrote to memory of 2560	1668	msedge.exe	88
PID 1668 wrote to memory of 2496	1668	msedge.exe	90
PID 1668 wrote to memory of 2496	1668	msedge.exe	90
PID 1668 wrote to memory of 3728	1668	msedge.exe	91
PID 1668 wrote to memory of 2496	1668	msedge.exe	90
PID 1668 wrote to memory of 3728	1668	msedge.exe	91
PID 1668 wrote to memory of 3728	1668	msedge.exe	91
PID 1668 wrote to memory of 2016	1668	msedge.exe	92
PID 1668 wrote to memory of 2016	1668	msedge.exe	92
PID 1668 wrote to memory of 2016	1668	msedge.exe	92
PID 1668 wrote to memory of 4696	1668	msedge.exe	93
PID 1668 wrote to memory of 4696	1668	msedge.exe	93
PID 1668 wrote to memory of 4696	1668	msedge.exe	93
PID 1668 wrote to memory of 1776	1668	msedge.exe	97
PID 1668 wrote to memory of 1776	1668	msedge.exe	97
PID 1668 wrote to memory of 1776	1668	msedge.exe	97
PID 1668 wrote to memory of 2644	1668	msedge.exe	100
PID 1668 wrote to memory of 2644	1668	msedge.exe	100
PID 1668 wrote to memory of 2644	1668	msedge.exe	100
PID 1668 wrote to memory of 1996	1668	msedge.exe	101
PID 1668 wrote to memory of 3496	1668	msedge.exe	102
PID 1668 wrote to memory of 1996	1668	msedge.exe	101
PID 1668 wrote to memory of 3496	1668	msedge.exe	102
PID 1668 wrote to memory of 2196	1668	msedge.exe	104
PID 1668 wrote to memory of 4492	1668	msedge.exe	109
PID 1668 wrote to memory of 4492	1668	msedge.exe	109
PID 1668 wrote to memory of 4492	1668	msedge.exe	109
PID 1668 wrote to memory of 3372	1668	msedge.exe	113
PID 1668 wrote to memory of 4840	1668	msedge.exe	114
PID 1668 wrote to memory of 456	1668	msedge.exe	115
PID 1668 wrote to memory of 2772	1668	msedge.exe	116
PID 1668 wrote to memory of 2772	1668	msedge.exe	116
PID 1668 wrote to memory of 2772	1668	msedge.exe	116
PID 1668 wrote to memory of 4920	1668	msedge.exe	118
PID 1668 wrote to memory of 4920	1668	msedge.exe	118
PID 1668 wrote to memory of 1072	1668	msedge.exe	119
PID 1668 wrote to memory of 1072	1668	msedge.exe	119
PID 1668 wrote to memory of 1072	1668	msedge.exe	119
PID 1668 wrote to memory of 2104	1668	msedge.exe	120
PID 1668 wrote to memory of 780	1668	msedge.exe	121
PID 1668 wrote to memory of 780	1668	msedge.exe	121
PID 1668 wrote to memory of 4924	1668	msedge.exe	122
PID 1668 wrote to memory of 4924	1668	msedge.exe	122
PID 1668 wrote to memory of 700	1668	msedge.exe	123
PID 1668 wrote to memory of 700	1668	msedge.exe	123
PID 1668 wrote to memory of 1964	1668	msedge.exe	126
PID 1668 wrote to memory of 1964	1668	msedge.exe	126
PID 1668 wrote to memory of 2436	1668	msedge.exe	127
PID 1668 wrote to memory of 2436	1668	msedge.exe	127
PID 768 wrote to memory of 3212	768	chrome.exe	130
PID 768 wrote to memory of 1308	768	chrome.exe	131
PID 768 wrote to memory of 1308	768	chrome.exe	131
PID 768 wrote to memory of 2208	768	chrome.exe	132
PID 768 wrote to memory of 4452	768	chrome.exe	133
PID 768 wrote to memory of 4452	768	chrome.exe	133
PID 768 wrote to memory of 4664	768	chrome.exe	135
PID 768 wrote to memory of 216	768	chrome.exe	136
PID 768 wrote to memory of 4664	768	chrome.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rendicion.contraloria.gov.co/stormWeb/#/login
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffd007c188,0x7fffd007c194,0x7fffd007c1a0
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,12030084437535904824,7930928058168571473,262144 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,12691616151059859449,5402845364426022122,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,17371665873417355365,3385123814250713830,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,5374318586286225255,14264392742545333747,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11829459824593115522,9089755099345573767,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8432034321024437679,7983116532315076394,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,5250638792837585467,14905478460224983376,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,11356480447615274593,11182228955868779334,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3548,i,15591007845490740900,15185626628834483481,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1222496314629540647,14622524633502770538,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,16017098017116481922,5110080901960966519,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,14093580421017060518,11303225697835151713,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,14093580421017060518,11303225697835151713,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5064,i,11635047754915518505,3726339161358582710,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,16584602961196755034,1438661211741339064,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,1083494199279395894,12990324040278602836,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,3976949017750177334,10659396585766488327,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5264,i,16624450836448320560,9611845478490192203,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5180548204086152746,8795779003604400022,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6380,i,3219212843902548513,11258805539915088775,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,12429413262727384911,13295032807345671437,262144 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4160635670752560550,1412974860158922593,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,3469693912984542202,14065395283802897928,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,3828872285048256948,13235591653066563025,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,6551993070453101813,11641911998864936666,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,3170580576087957747,6722139046741735002,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5220,i,11785322884299998034,16739528604495476896,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10630343896789484614,567500008471464591,524288 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5444,i,4908359497300058166,17388024398592182860,2097152 --field-trial-handle=2288,i,224274594852344348,1569828836727352277,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffcdd8c728,0x7fffcdd8c734,0x7fffcdd8c740
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1764936686311260174,6778750157096715386,262144 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,4407939416587294455,8850339154169101643,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1637079233990991909,10179543167896227237,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,794702468686414644,13476372708917448893,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,7916478383216774210,15960657049423059971,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,713778258569868298,3689627869818985820,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,5822326948546205293,15305326865416040937,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,14018784698515180995,17037610357980147801,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,12890531662280354425,5885104861764069312,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,13680109981814156240,3593319697138476892,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,18408523455079100358,9775050956443597235,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4872,i,3124775515591447185,12978835089619959563,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3296,i,10435431332946993833,1234483341965874064,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6012,i,5052751597969919112,16409645425273624657,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3848,i,16911290619649873791,9815614951896335033,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3268,i,7694725154760067491,16333286102409427760,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6028,i,13770935437308721148,17713501035640844426,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4852,i,757183263012266645,8888661990018105876,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,1615880563310619280,4987030095097256468,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,8417770702045223230,13442709879237404296,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,11868791681596989396,10267905889621064242,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5816,i,13926362123129982623,8452332763905966183,2097152 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5948,i,11547282575017919442,1397324606780995610,262144 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3160,i,1074705351144361872,5781714088917383965,524288 --field-trial-handle=1864,i,7551518540938343736,15309451330844663637,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:2436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24ee72b2836f563c8a601cb4e28ef2752a29fcc93fa6b724bb8056d97cb4302c
MD5 49af5e3da2167044850ebc9e8fe32d86
SHA1 44bd71c7b4ed18621a7d6d2bd52592b2716e665e
SHA512 09b57258029aed1d15e1c6cfcf29e68645a3c587840d9724640d065199ae9fb918bed67d7aa4f91b041ed7479c87e368037744256e799e2bac46ad24e6cf209f
TLSH
T12FE02BAACA219D2B08FD07282458074AF65423172B41455B7B3C820D8FBA6371996C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 cb37a7c5544acabb272fb4d29ad042039ab6377ad94cc736ef7d6417651d43cc
MD5 aa65e3dfb8f51b950a729f5d856db32a
SHA1 20c406bbabc947991cb6c0e0b40173cd2fefc597
SHA512 12f6a4a84ceaac7c4a5b3053b810b5e1b28add7d3147277bdcf6ea591cb646d6780a47c0b077a66c3727eee3ff8f7a04fcd839eb54682aa855749ff54f0aadab
SSDEEP 192:D0uOtiqwJJ5JSraIXeEdS8SZtoaPhvqmfPiNP5IIImNHRY+jhq:D0uOtiqwJJ5JSraIXeEdS8SZtoaJSmfB
TLSH
T1E4D1AEF7C3E4C52D891056F49B15AF1ECE291928031C3C76C9D8AE1B93E2872E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 65d9da3632dce2b568461e277790bc30361466289362d50a7073e5f093732530
MD5 1dd9a91f054e74b7360326655d889e98
SHA1 4b535ea5b3d1e6d0fa6c4a98d0baf8efb8fc475a
SHA512 809fa6e0f0e7cad3acbf0acb8728aef07d96018125b7bec6c9de06e952d5b71fbe98f369bb18634f9e21f0c121bb6d8598de7944dcf75e898ab5ad21325577c7
SSDEEP 192:DatFGkJwmzJ+JPaIXed+S8VmtoaPhvuYfP/NP5IIIzl1gC:DatFGkJ3zJ+JPaIXed+S8VmtoaJWYfH8
TLSH
T1A9E190F7C3D8952D881156F5AB156F1ECE291A28432C3C27C8D8BF1B93E2872D25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8dbc234416f3278511a3e4c7098d3eb4cf7cf8630cfcb23e3ff5a972c33894ff
MD5 aa578d9686bf259b15f3096dc85fa367
SHA1 8fe391a888e23cf320e248a4ce24f4f8c730efde
SHA512 214e93e7be9a10ff04bc6677b939515540e36f5ab6d48d8db8e5037101ae691260837b7afb26efcf3317a3356008fc232c6099b7b010d4d2e0431f421c714a80
SSDEEP 192:D0uOtiqwJJ5JrraIXeEdS8SZtoaPhvqmfPiNP5IIImiHRYK:D0uOtiqwJJ5JrraIXeEdS8SZtoaJSmfB
TLSH
T1BBD19CF7C3E4C62D891056F49B15AF1ECE291A28031C3C76C9D8BE1B93E2872E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e0f3708ed34bdc1b6e43172696fa4fa2865800ed923df03674602285e53790c6
MD5 6e0be57ac784bd840b161f40e5ea1b87
SHA1 91caaf8857d0bc032a801385f8fcf0275c5c7363
SHA512 e021a26285416d5efbfd7f2bd488827493cf09131719b29961c1552203681c556a8928d5da5db16965c545e286e033f856d1e021fb75629f8d458848592d670e
SSDEEP 192:DatFGkJwmzJ+RaIXed+S8VmtdLaPhvuYfP/NP5IIIzE:DatFGkJ3zJ+RaIXed+S8VmtdLaJWYfHj
TLSH
T1A8D1A0F7C3D8952D881156F9AB156F1ECE2A1A18432C3C27C8D8BF1B93E2871E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 3ca190a0bd33251b09731f768fe8ee9431a14cbfbd00b393ebfcfe920b9e2a37
MD5 f95b64d45ede570c8afbfc752ad72f2f
SHA1 0905d452ccaad7f051cf48a0a888fda67d5dc1ca
SHA512 96bc8ade6f337da93d9b4d39353bd368ca6ba677ea2923201c4d54a159b64cb091a1e038c4403ccb7bd3c13e03d0934fb67f3159b930e720295a0a10053ddcb8
TLSH
T10BF05077DA797153307D456F1D04BC05A4BBA83186416CE4DE6A822EE0951E30B16423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 12ec8678041051628e4cf670280b408cb18d0932e5d05ef065831acdae51448e
MD5 e74f27fbae7a5254f3c0e830b32b51c4
SHA1 2cffaeaf991c70253bf08352835f509356dbd87e
SHA512 f89f4de51f4402323e8e5dc06ce0a17cff38680e62f9f7e60b7820fb5bd84b7ccb20b26e4e8fcae20719230f92ea2bf693a2843a2b726d50c2ee6fc14b90179c
SSDEEP 192:JRAcBzHsSjACfwv72ympAPRp2MUlPRA95Hsb+WNnWU4Nb2Wt2VWkwzIVyIsnAUg8:JRAmzHsQfsQUXb7wVe222VWo8
TLSH
T1AF52E92FA92029775CDBD229FD527717D7F5106266841E84FAFC8A2C05E79CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 84bdc92d212880c52c1abaa7ce8172a9835c6394f413b26f45eea1794b9145a7
MD5 c4348b93d439947257bc2a6c35d86b38
SHA1 0e19857b005790b9ea22180c3510a219689dde36
SHA512 b4383bad47123c8648fcc8aa50290aa5fec704776588956e59685d7d87967994ce01e99510be31e9f75e93e7ad00cb7085f4a55dc9d74d2c33aa03a9b90198ef
SSDEEP 192:JRAcBzHsSjACfBv72ympuPRp4MUlPRA95Hsb+WNnWU4VrYkgt2VWkwz5VyIsnAUp:JRAmzHsQfRQ2Xt7wVKYh2VWre
TLSH
T17552E96FA91029779CDBD229F9527713E7F1106266901E84FAFC8B2C05EB9CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c04241ef1fe5e88409aca7c46ef1182a08a3fc1e750af9a7e1c726d8ef322224
MD5 ba84740f38273d65003c0066c310ef11
SHA1 7dadea85eca73a5d1d48b773cee49aa1458f93bd
SHA512 c63c87af3d08b4918b774bcb78d013de65bc7aeb89fe32b9a2b2cdffffeb06df1ca66216846b0a2a6bd193cfb5e6e49de315186b076761e4ccd1b51ff4d5e3db
SSDEEP 192:JRoHsSjAC5Zv72ympAPRp2Vl395Hsb+WNnWU0Pt2VWkwzIVyIsnAUgtaJ:JRoHsQ55QUX27wV0F2VWo8
TLSH
T1F342B82FAA10697B9CDBD219FD527713D7F5106265842E84FAFC8A2C15E79CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 05a6133279cbd1b2a94897f3ec992244751935585f93ed65d1466ed8efe36c0a
MD5 c6c0b47eaa78803b3d9a5c6832423de2
SHA1 bba94735de959ffebb85db260b148868d0117395
SHA512 5d59dd140168ba6e0ba8a467e21ec11f491cc24598c70bb43f54105f4387210566058dc35d736aed5db90c43603cb87b17f28dee3d9324d35c090ffa40ec3d92
SSDEEP 192:JRAcBzHsdjACfBv72ympuPRp4MUlPRA95Hsb+WNnWU4VrYkgt2VWkwz5VyIsnAUp:JRAmzHsRfRQ2Xt7wVKYh2VWre
TLSH
T17152E96FA91029779CDBD229F9527717E7F1106266901E84FAFC8B2C05EB9CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d4ad0e6debd874ab18b929b85f06983b2841073a9793f3f95c9c63f4bcc96e3e
MD5 b22d848ed9e94eceb5866cbdfcae68c8
SHA1 2c780c6c5ebc8003695e21135490b0d4eca387f4
SHA512 62eb2594d6c5f1211c9494b32312e4b285da41975bf14dc945b5cb8b39a04910896638269d5cc4dd1f463a06d65eb1f57ca6b46355583dd4f4d415d4e74e9c43
SSDEEP 192:JRAcBzHsSjACfov72ympAPRp2MUlPRA95Hsb+WNnWU44+eLt2VWkwzFVyIsnAUge:JRAmzHsQf0QUXb7wVieB2VWfe
TLSH
T1D352D92FB91029779CDBD219F9527717E7F1106266841E84FAFC8A2C15EB9CC321B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 085606e4af76ec104f77dcaca6f893f4f71a1a4fbedaf67323cd7c6090efbd9f
MD5 516454397c24a9b76716444dc0d7b57b
SHA1 10817a2abb6f1bd488daef1178080800e8039fb1
SHA512 af6bf93c70f8a82cc3a6343eb2246d27a95c620895a011d65d4d48806f1bfa3c4c579f5ee7065d4ec01ee9ddc9ad2f270f56a4830196834404dc72732f2f8a19
TLSH
T188B0125084056111C45202F422475888B2185F20AA0E170143F06922CC351A58014061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dff90.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5dff90.TMP
Size 96B
SHA256 31d92e4cc13249f813211d2338b7269c7dde997e6ef1e25450e193b95468a3f5
MD5 5d192ebd8d1aeb633c6e1fc6010ca036
SHA1 a77f09ab43a65621636dcfa3e3686f8875664be8
SHA512 6d464315735388cf97ea201cd7bb41ccedf2d8f9bea112617c4661aa0e562ed8917a2bb3b96e0a51a4caeaf5a7dff275669dab00152f30127573354c70f226b0
TLSH
T152B02200C0032232C00A03B0208C82CCB230CF20C2030332A3E20A2BEC202B0822A030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 35afa626439c5e93ff76964b6867c90516618b1d02d9408465fbd53239110e2d
MD5 7abfa6d00f846fd917f7b76783cd88dc
SHA1 0fe4a4c4234b5583017a0f4b527f0f6a4c02345c
SHA512 ba5f2cfc252d1d69376b65cdbf4cf82dbe6aa72b83aa6273f2bfc02b46cd38139f7e81c55337a5293c1023bac2702122feaedc52b863bbb89c0d1a6c3bf61ed8
SSDEEP 3072:lv1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5dqfd7NtZL8cHQRZEQ6Sps4:l9mg1kQfATCFbzQACjoqZ/ZLW3Ex4
TLSH
T19A34127B8FD10E3B1B428A7075430EE5B3F64A6AD9305744A37E27FB69C3C862782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 dba9f5a900f8bf035c7af6c16954c3f0444cf9974e574ec972648e4a7f80928a
MD5 996347126950eaf12d1af3d7cfe3ac75
SHA1 53f07ed23b61a13210e841c0d0324d3a190ba81d
SHA512 2ba8a9a9f0737df15076a2713e1cf2802d5da42d3b703bec25c0c9c19b2228112e28bc3fb91e0085b0f8027bbfc7e21152c601fb133cd5235418471ab0d5ffb1
SSDEEP 3072:2v1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5dqfd7NtZL8cHQRZEQ6Sps4:29mg1kQfATCFbzQACjoqZ/ZLW3Ex4
TLSH
T16134127B8FD10E3B1B428A7075430EE5A3F64A6AD9315744A36E27FB6DC3C822782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 b97571e71578d7486c9014c0c775d229c0e0ca05951e46a68fe4ae9270eabd93
MD5 73fc19227195a7b0a5272e096a5c9633
SHA1 bfa5deca810569eebfb76683c1f46fbfb6f1158a
SHA512 2abd47625b182736f59f4e588bf42db8d0da843bb74745f45c832b1e4ea11ba90a3cfc1f7b24a1f1a41414f87b3327d9c92a5b55a51d7e2a9d7f088b86549c75
SSDEEP 3072:EQ1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5dqfd7NtZL8cHQRZEQ6Sps4:E2mg1kQfATCFbzQACjoqZ/ZLW3Ex4
TLSH
T16E34227B8FD10E371F428E7065431EA5A7F65B7EC9305708A32E27FB69C7C426A42858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4f3cb3959f9d5e3479271c0be70a18aa5bf21e2979954570e4521cd8aa9f0a60
MD5 691cf5d6bfad6aab03552547ffa5bd5f
SHA1 01ed0af91ee0f898cc5379d0cd180d7f7b4166aa
SHA512 c850b57a94acf9f0522badaf70e1ea16b9d916dc833b689871ad420651ea1f9abe5937558850cd75202e30f7ef3a04700656fffcd1c76e2408b5c22819783767
SSDEEP 1536:TvQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Oqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B2C30237DBC21F339D96CB60B9530FD697B644A99034D301EA6D77BF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 6ad850d1b14f0876b83b46f4122010d0004f986408c19e5307babbcfa230ee7e
MD5 ba1037e7333341ec888b2c9e3a0a8111
SHA1 259e95cabc37f9992bdd2409182f070c70cdecbd
SHA512 b395fec7d11b77698c7810237f266e3e5d9fd5495615ac8ce23889091a7e3d0ff7c440f9b4e3ed121ecaa2d81d0ac72f44b4fb1ef745f548cb2452ab7d7fcf9a
SSDEEP 3072:oQ1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5dqfd7NtZL8cHQRZEQ6Sps4:o2mg1kQfATCFbzQACjoqZ/ZLW3Ex4
TLSH
T10134223B8FD10E371F428E7061431EA5A7F65B7EC9305708A32E27FB69C7C426A42858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 cc8c44126b41a46e4a089cc94ebcda5c2e7fec1bf4f6253a38f901eac6525e0a
MD5 9957461549224c8fc749f90e711b1adf
SHA1 293cc04dbdd362f2b133693ba51cacbd7dacc5a7
SHA512 5e67ad39b2c831ef51c3ca598fe7f92d7ac3ecf816449fdbb57d9025e3bc428932d0dea1a86790cd5d685f97f034abcc02146eff80c262718181d06347c2f28b
SSDEEP 192:tjcjuOACMMMMMMMMMMMMMMMMMMMMMMMMMMMwh:tjcjuOACMMMMMMMMMMMMMMMMMMMMMMMM
TLSH
T153E16F0683D5CBAB9B5510CE4AB4529C00B13B0BEBECD948274CCDE9314E49EAAF56F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 aaf2adf29fdf0b13b978a9e5972d294fbd6e1fc417a56a42154b7d53925de970
MD5 304145a318c7ce9e5e39ec2e7111c973
SHA1 61f3d5140fdaa8c11e3f5fe40d2a054450e6359f
SHA512 316f3071f8fbc7b473283508e299421034cdcb19094fbb601c9bfd92e138105314061dd7d9961d5f9dee91cc6e3a614f7bc49b264bd0afae1e9e1546005c9fce
SSDEEP 192:pjzyXCCpppEEELLOObbggg111qqqnnnsssMKLO:pjzyXCCpppEEELLOObbggg111qqqnnnr
TLSH
T1F3E15B4A8394CB9B9B1914CA4AB4579C04B0370FEBECD608178DCDE9344E49FE9F5AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 683823a0f33bd0fb10f43680e1ada8910bbcaf6e476b5fe2cabeb39e7d214bd5
MD5 0dce507e6dfdfdd22e57ad84a5ae8f76
SHA1 767a516f994aa0cd5c15daecc430c874d4c5a145
SHA512 a9459cc77537cba62499d3e31a3f00738e561570d98c8b81e74c87cce120126751b8db6c6496b6c8c2ac0efe46f96ec9219aaa0964921103c50e4b0e0ab2f014
TLSH
T1DA71F92D040E49A3E31C2732E0E309CAB274CD944FD74EA35034993D578EB56CBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d78.TMP
Size 3KB
SHA256 a710906d6bddd3f2668baf640e08fe8a1c2305b1f1905b227ac162685fdd06a0
MD5 9f2991ddfc404c9e5ce7154ce2ff36af
SHA1 932e2fd1622fd12d1da888c838775859666b1396
SHA512 15bd3ec6a88cf920188dbe132c019d12e9d61bb5e38b08c3e7346a1bbb38cc0081aaf89b5d3b6841185f367cc78b7d9db429f831a93e65e14438b3c94b93d2a1
TLSH
T15571E82D080E49A3E31D2732E0E3098AB274CD994FD74EA35038993C568EB56CBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 55913a42d05e4f49cb735a662e791ad253e41b423967fb861739980de3c82e2d
MD5 e5ac54e02dc10b256126782ef83b5b44
SHA1 3104b2bce91f21f6e1813683b34858d70dcf39c7
SHA512 7bc8e4eae0eded731727873cf2b50a6a2d31086ea781a45e71699912dfeab52abadd811bb842aacdf755e4560929d36a2c301cf3870191dd02421c96687d8993
TLSH
T13F21BEF3C3E0856ECA1156F0AA14BE2BCE1D0601432C7C158AE0EF1BA3E3475E40295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efe3db188d563e1011d1d80caa1e76afb93e9a867a37ea5434080fc0594b74eb
MD5 73f9a13b4e58b5db8d3fb5fcff25e0d4
SHA1 bc116530aa53a823b8c520424114d6ba9888690c
SHA512 094bba1979797bc27bd24e3f1596aad3721f047b6cd0b333212419502dddd7dfd908f4c424deed823cdea4fa4c332511cddf02683349f03f57e39cfcc518e51b
TLSH
T11921A0F383E1856EDD1156F09A28BE2BCE1D0502432C7C6986E4EF17D3E3075E006A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d4bbf4efd8a4c1bf414d493ed34e4bf9fa7f02443277330b636620a6d5fd461
MD5 0a6cce8d7c38bad902e7c3516dc5eae5
SHA1 9978ceb37298c96d868282a64ccb9a5b499098b0
SHA512 50f094a9d7516e65ffa39e9f2129599c78f9f1727204aeb9fa40a121aeb0b936e31961bee70aa9e73d1918794c5f7745a5a8306ba2f8c234d74c3eecdba84fe3
SSDEEP 192:sxZuR+yM/jK1Ml8MkG/fxsaNnB/Idp/l/HW6+WNGYHjRvzIgrJ:sxZuwMG/fxsavwhHbGU9
TLSH
T1FB42F8126A386977CCDBD209FA457F53D6F90472E2900E48A9FCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8aba12bfb74938b40ef0f202278a72faed0648433bce684e7ce327c0b72fb08f
MD5 f8da8e39d41ad35842c02c2de3cf1a89
SHA1 0462e272fa97f79efa4b4cea58005c908bd837e0
SHA512 dddd3a44d8dedcb741a5ffba4a9bb58be9bbf03fb868e6c3ab06df0a9c5022afe5ada91f9b7912cfd6effe41062c97e0f00705ea61826d67161fe93d169f303d
SSDEEP 192:sxZuR+yM/jK1Ml8UQkkG/fxsaNnK/Idphl/HW6+WNGYHuspzIg5wJ:sxZuwq/G/fxsa0wjHbGIW
TLSH
T11452E7166A345977CCDBD209FA517F53E6F90472E2900E48A9FCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 89511724b8d0cf695fe0fb1a435d2a2a0588b1dd55adcb8902b4f3a53c4803e2
MD5 5a5f65710f777b5b144eed8202b6bd10
SHA1 c54c6f2d82e25547d10516bc8d76176f2d4decb6
SHA512 6a6fa56f3783bda2cd4cf62fc7e15b622aaa078a961b82c95ae99b270bdedfd1eea29c586878324408b9a7596bcbfa6ca5d4e09543aa2d6cc32b5712c88b8f2f
SSDEEP 192:sxZuR+yMqZjK1Ml8UQkkG/fxsaNnK/Idphl/HW6+WNGYHuspjIg5wJ:sxZuFq/G/fxsa0wjHbGMW
TLSH
T19752E7166A385977CCDBD209BA557F53E6F90472E2900E44A9FCCA1C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b8b424857e502e62b5ae8e71dc6f99d11def43c2f3578c4180edb7d28eec1ddc
MD5 b8acdb9008fdd33d41be08136da26899
SHA1 7411d574aff95bd93ac5171fc13d1b766c347a95
SHA512 1e21887543a13c9bba11907557bd1f1bd7dc8941e8776e63796bdf71dc9159cd292ecac24db835da26e77f7c853661b5932f2893e65b24bf2712f69f1c2d140b
SSDEEP 768:9AUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RiroVi0q8:9AUZYTMWvg0Pou1ja7eLZmR5/f
TLSH
T1DBD20B2B284CCB7E4F844E5DEC2A6F867DD801CB5A584D5447EA884C03CB3EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 230219abf11e07242fb2e990e54fc21b0e9ab277dfec328b1a3e89de6342524d
MD5 d32bee110dc3c35e14570f924904ede5
SHA1 086ba55bace9f73ece7bc87830608c2c54f83107
SHA512 6ab4e5ca2323e33cc5d26332042b487ea721b4fc8148e8859f26ef427d8ca9f74312a3401054185e014c84e47db1d9592a73e1edf1c3b3a7c68a99a0bce0f70b
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEgYQh0gSr:EurfyVlrQh0gSr
TLSH
T181D1E10272BB02033D3D2918A39987764F85F6A33418A42B7FA840B55E67E345DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caad3e7d-9b41-4a0c-899a-4218abc43de2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\caad3e7d-9b41-4a0c-899a-4218abc43de2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 dd4faebc6c6c220931b6165c3e17065601db66dcad78adbc897a0fa3d010faab
MD5 dc51f3dcff4c91e51979159c5781e9cc
SHA1 2c46a64c2bad1d0e6dd885f8b3944782a3668a43
SHA512 37036ab8cecdeb8e59b51b21954b749b019091929b89a5eb3d74b933bcd1c0976a2859e88d85251522e711f21977c10bc3bc7bca916130a3c20cef4fc0a17387
SSDEEP 384:piF1tNn/s3n9SKzsNI8TUNTUlIlOyjAEevtzlzX5od+d8y0VuXR/OueQsUk5:AF1j+91RwgMdO7+R/ORUk5
TLSH
T135A26B3354549E2BADE29A85F54A3203DEF441B7CA813F94E6ECAF0C019B1EC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 746ed63814dfebb1b1d4b0c00c1524468e069ce693ebe80f261e90a3d6b3501d
MD5 fa6db9adb2ae38e32e66925eb933d23d
SHA1 d08bfeb80726863d06c70f5f159a94de41195e15
SHA512 89cdf98508dd8a529cda648b9bbab08930ae25c235028c7b7bb17b2d229f3e57f5ab3fce830ba0bc8c267605d512b423a2e1d479375bf9e80b3f1a4539b32232
SSDEEP 384:piFdtNn/s3n9SKxsNc8TUNTUlIRCrjAEev7zlzX5od+d8y0VuXReOueQsUk5:AFdj+97VwgPdO7+ReORUk5
TLSH
T16AA25C3394549D3BADE79A85F54A3207DEF441A7CA812F94E6ECAF0D01DB1EC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50f40e22e9e303b570aca2c1631ed36781887cdb0d1c388e8424372fdea60da0
MD5 a60552c44a5403a845d97abb68a53209
SHA1 341467d17a79606b9cd18fa1d8274e80bf6da8ff
SHA512 eca9f1386764ef51f21dfda820e8823e42a54b1761ba7c87d22d08576dab970ff8190a19492325a3851243d221f4448e0ead0abad7b33b0e12338a2d8c728599
SSDEEP 192:yONR61VWQmiUyhOhXgGX5Obd+j1jzory0aoX/aB31IU6:yONR6WOqXgGX5od+d8y0VC3IU6
TLSH
T17E02D935A9686CBB8EE2BE4AB48737139FD51067EA552F84D6FC1B1C009769C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 edfa6b63718b985bb49592dedee30120e54c5ddf910a704f57fd63eff262b187
MD5 042c475fbc86f32f82ceb53f9dd66679
SHA1 a9808b9c9a5815f5b2fd731649c4012e333391e0
SHA512 ef7ee82ebbbdcb01ee6b3eb9b920fba6c9291d6e099f115565222566f23cf369ff2e0c493f3a9a6c595d3d801c019eee539dbb4bd9a1fc7a6018f08588270aa3
SSDEEP 192:VONZ61MWQmiUyh9hXXGX5Obd+j1jzory0aouX6EZjJbq9U6:VONZ6dOPXXGX5od+d8y0VuXRbOU6
TLSH
T1C4120936A428AC675EE3F585B48B32139EA55167DB897F80D2EC1B1C01EF5AC131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 75c4dcb5fe21b0fb6561b350f26dbca5df5a5176e7452add7671a4364c20b35d
MD5 e3d15312884693ad50247987d9696df6
SHA1 2601e342afb474ace6666ae765e726763bb9c8f8
SHA512 415bf86ac1c47890504a0a58a39b8c654a0847ed3662481f96e412c0419011861841688f4dc38ba49c1927736f50b71d5ad2c1259beb95f1b74da4c4b0808382
SSDEEP 384:KtNn/s3n9SfsNYbyjAEevtzlzX5od+d8y0VuXRrOueQsUk5:Kj+9UldO7+RrORUk5
TLSH
T15E927B36A0256D265CE3E585B54B32079EE841A7DB812F8496ECAF1D02DA2AC131AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8838320-4a10-4c28-a126-772690b78a6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e8838320-4a10-4c28-a126-772690b78a6e.tmp
Size 19KB
SHA256 baac6c20f3784e09836c00af174dcb3d352f4864b747bc86160009b865e6dfcc
MD5 3ed5496de35e1a26e72a309f1f4618b0
SHA1 de63726332143a94e69f28631e629a5e0ca8c879
SHA512 524038fb14c724dc0ede06e360d32bbc02953ad93c11988b378a827e7d9a841e448e2660333c827bc20a45f024e2bba7cab7304040d60849efd412cd145a73d4
SSDEEP 384:ltNn/s3n9SfsNYOyjAEevtzlzX5od+d8y0VuXRrOueQsUk5:lj+9UqdO7+RrORUk5
TLSH
T1C8927B3660256D265CE3E585B54B3307AEE850A7DB812F8496ECAF1D02DF2AC131AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 110a8b30bcb90a1c7a7bc6168c60e5576d9fd68c8be5073fe9c0a2ff9a283b63
MD5 c1c1f4d6f8f2cd09a2ab0c82162f3e55
SHA1 d3664f8b94324c500e16d32e02203f34c0646b4b
SHA512 8f9c9b65965153a934f9ce8aca805785cd8010f2c0d3d694c4a918c7ebf6adb488995436d6c884779ae90fe4a6f66049dbc1a7a1ca0f96aa49c19d77db31836b
TLSH
T1F4414A58B6E91108B3B36E5AABF6A86E487F7D372E46D55E00110D4F0673B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download