afc883ddf8db47bd9d3de16a01b2f478b06c0f0d1fc369ab8560e87b312f574d

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.html
Size 22KB
Sample260702-ckzzsshv9l
SHA256 afc883ddf8db47bd9d3de16a01b2f478b06c0f0d1fc369ab8560e87b312f574d
MD5 c264a5db8d4df0cd397c41c4018e83ba
SHA1 d580119508b60e99551b96989f6b15b81e699929
SHA512 7c591d7ef20f3a48d1bafd5d5b6c9b14cafb0764565ff35a494a69dec28d27006bd4397fb64c634326329afbe1ac2299f2896c92af59a4409042d14473eb5fc9
SSDEEP 384:7U75l7nAg9oULmzCC39wK0MEQelNlgqHNWeY:Y75NzLmj9W7iqtW
TLSH
T151A20360B196D90E62520373478279ECA27EE74CC3333C2CF685644F9685D4DAF3BA99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	chrome.exe
3924	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274317504578331"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{488A4CF0-A00D-444A-94F5-78C86919C6BE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
880	chrome.exe
880	chrome.exe
516	msedge.exe
516	msedge.exe
880	chrome.exe
880	chrome.exe
3584	chrome.exe
3584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
4616	msedge.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
4616	msedge.exe
880	chrome.exe
880	chrome.exe
4616	msedge.exe
880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1988	4616	msedge.exe	87
PID 4616 wrote to memory of 3924	4616	msedge.exe	88
PID 4616 wrote to memory of 4132	4616	msedge.exe	89
PID 4616 wrote to memory of 4132	4616	msedge.exe	89
PID 4616 wrote to memory of 4132	4616	msedge.exe	89
PID 4616 wrote to memory of 1320	4616	msedge.exe	90
PID 4616 wrote to memory of 1320	4616	msedge.exe	90
PID 4616 wrote to memory of 5040	4616	msedge.exe	92
PID 4616 wrote to memory of 2384	4616	msedge.exe	91
PID 4616 wrote to memory of 5040	4616	msedge.exe	92
PID 4616 wrote to memory of 5040	4616	msedge.exe	92
PID 4616 wrote to memory of 2384	4616	msedge.exe	91
PID 4616 wrote to memory of 2384	4616	msedge.exe	91
PID 4616 wrote to memory of 3344	4616	msedge.exe	95
PID 4616 wrote to memory of 3344	4616	msedge.exe	95
PID 4616 wrote to memory of 1840	4616	msedge.exe	96
PID 4616 wrote to memory of 1840	4616	msedge.exe	96
PID 4616 wrote to memory of 5124	4616	msedge.exe	98
PID 4616 wrote to memory of 2988	4616	msedge.exe	102
PID 4616 wrote to memory of 2988	4616	msedge.exe	102
PID 4616 wrote to memory of 2988	4616	msedge.exe	102
PID 4616 wrote to memory of 3500	4616	msedge.exe	106
PID 4616 wrote to memory of 672	4616	msedge.exe	107
PID 4616 wrote to memory of 3480	4616	msedge.exe	108
PID 4616 wrote to memory of 3048	4616	msedge.exe	109
PID 4616 wrote to memory of 3048	4616	msedge.exe	109
PID 4616 wrote to memory of 4496	4616	msedge.exe	110
PID 4616 wrote to memory of 4496	4616	msedge.exe	110
PID 4616 wrote to memory of 4496	4616	msedge.exe	110
PID 4616 wrote to memory of 1484	4616	msedge.exe	113
PID 4616 wrote to memory of 1484	4616	msedge.exe	113
PID 4616 wrote to memory of 1484	4616	msedge.exe	113
PID 4616 wrote to memory of 4268	4616	msedge.exe	119
PID 4616 wrote to memory of 4268	4616	msedge.exe	119
PID 4616 wrote to memory of 4268	4616	msedge.exe	119
PID 4616 wrote to memory of 4992	4616	msedge.exe	120
PID 4616 wrote to memory of 4992	4616	msedge.exe	120
PID 4616 wrote to memory of 4992	4616	msedge.exe	120
PID 4616 wrote to memory of 5832	4616	msedge.exe	121
PID 4616 wrote to memory of 5832	4616	msedge.exe	121
PID 4616 wrote to memory of 5832	4616	msedge.exe	121
PID 4616 wrote to memory of 2788	4616	msedge.exe	122
PID 4616 wrote to memory of 2788	4616	msedge.exe	122
PID 880 wrote to memory of 5240	880	chrome.exe	125
PID 880 wrote to memory of 5092	880	chrome.exe	126
PID 880 wrote to memory of 5092	880	chrome.exe	126
PID 880 wrote to memory of 2068	880	chrome.exe	127
PID 880 wrote to memory of 3140	880	chrome.exe	128
PID 880 wrote to memory of 3140	880	chrome.exe	128
PID 880 wrote to memory of 2916	880	chrome.exe	130
PID 880 wrote to memory of 864	880	chrome.exe	131
PID 880 wrote to memory of 2916	880	chrome.exe	130
PID 880 wrote to memory of 864	880	chrome.exe	131
PID 880 wrote to memory of 3576	880	chrome.exe	132
PID 880 wrote to memory of 3576	880	chrome.exe	132
PID 880 wrote to memory of 4516	880	chrome.exe	134
PID 880 wrote to memory of 4516	880	chrome.exe	134
PID 880 wrote to memory of 4292	880	chrome.exe	135
PID 880 wrote to memory of 4292	880	chrome.exe	135
PID 880 wrote to memory of 2640	880	chrome.exe	136
PID 880 wrote to memory of 2640	880	chrome.exe	136
PID 880 wrote to memory of 736	880	chrome.exe	137
PID 4616 wrote to memory of 5028	4616	msedge.exe	139
PID 4616 wrote to memory of 5028	4616	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\default.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffc1b77c188,0x7ffc1b77c194,0x7ffc1b77c1a0
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8771304068791946053,1025691134188091370,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16510861720641891050,8752751683366993782,262144 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,4783208308773700206,6402928686666067856,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2022367568451149273,13606580812852379429,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7202869546627256956,5511393081437256039,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13447353150868717316,18216888035813177289,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,13592998897191579426,1997592309040758709,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3314725202712799424,1407449361165307872,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3314725202712799424,1407449361165307872,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6136,i,6536605980400916610,10030731064620567582,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,10129475645011661746,10697831509654046899,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,10957315155592642681,5723093572923733014,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,5880902701077243485,1466696931568419153,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,4362117339001556467,3241396145403306411,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4952,i,8635230585960257512,3627234437303058428,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4948,i,12135046927782096117,9246497357326265000,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3700,i,5371019289376941264,18019086992561976612,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6348,i,14675004494805259305,9535374884597554767,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5048,i,712905964936422258,4864514417347523474,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,2245095918368197397,11696731603395119373,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6664,i,11962156587732192575,16758732428523109216,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5308,i,10988780298963482932,8815156863638267069,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,8116699055413575137,18401388382975975679,262144 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,8010129574060984168,31740297749146042,524288 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6652,i,8599490557710454520,16580550712384624807,2097152 --field-trial-handle=2232,i,2854841136541415663,7204215959154215982,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbfa0ec728,0x7ffbfa0ec734,0x7ffbfa0ec740
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,13335123250939345032,8892593819444324893,262144 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,4740223631770828704,2466432137658826411,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,12114062993836653935,17374329235290731003,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,12308906152305588707,1986713085050455903,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,8680591710657152262,14031141021370802301,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,17592560528263600609,13030960915266982917,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,9583220319138602186,14933986282116536815,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,9387304456393349527,2419112288395333579,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,16869953234701701405,12919107551107776727,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,17359583153594013359,8644077794557272845,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5924,i,10602613104495632601,17210381383702214614,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4888,i,1414535492039520182,2844448328728119427,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3396,i,16445052569377158303,13816435781204913725,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,13442497287768779200,16794756860562851849,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,7103524104567337257,3837436405404605483,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,13874089933644161488,17995405085744100760,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4732,i,14552284958814324000,10233289508119703874,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3360,i,15660191950976939187,12203511458792995573,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4932,i,4722698290994881661,7781680139873473045,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4892,i,9823979243908489363,92060031941363314,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4436,i,10998545522469279138,8257690632794943454,262144 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3088,i,15393431106405350174,12575685945218946586,2097152 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,8416020091229734581,9475595369455994756,524288 --field-trial-handle=1928,i,143937823544998202,11103188631320062057,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6ef3feea291e1d158708f24c5fac5b8960124492622bfe7cea8c4d0e1325c3f7
MD5 f6d9dba4a1e215efa3265927ef266a27
SHA1 8fe58eb00bd0f4dc9252e3b5683d68e1c85593da
SHA512 54e812feea2f46c1d1137f4b4711ad74e8a120d1b046ca473c45baa1feba3d33e2e65dd8f9862964f2b61944bc0c4a034808aafb9213b911e0b41631cb2ed6bc
TLSH
T10CE022AAC962DC3B28FD075CA050078AEA5513173B41859F3B3D8A088FB923F478785C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 128KB
SHA256 47158a860d9ba6da0580094ee49f0b56a5e14aae1d73e294f46b6d4bcd124183
MD5 57f32905894d3b2d3a6671a9235c176f
SHA1 542bbe43ca244ffbeb3709cc7daef1363cd34dd5
SHA512 66ca30755f7bd9c59a081f0d2710770e438f61ddad46531e44f1ae381f545315717e5b2b7c9a637554936990a65522197698e02ef4b4ad20b141e20a97847cbc
SSDEEP 3072:zWU+Pzv5Rjk8eqjLmSnG3J6ENXYUm9iVH6BIDMiLvh/leL9:zFuvjk8e2mSnGZhyJ9iVFD9lleL9
TLSH
T1F1D3124C7B6BA9C82FA7C7B3B4105CBD5E00990FB2659B8E1F428543A452D563C492FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 c88a0f86859aa8fa6387c0e38725109fd6b5bc13c80e768ab963a84f99934ab4
MD5 08b8251f86cc9509d856465ed093743e
SHA1 108b9d07cd67e80eede2527898d992d19715597b
SHA512 2a281070671cef9a61ddfbfd7fe7f476dd70fbb6e1f75555f951527e290cfbbe5451b02a2e6d6338a9aa6ced81e67e32c28431b5760926361a4ce3034dd70f40
TLSH
T1ACD012240174078CCB45833000B72D04B2388A68206327BECED2A434BA91ABAA2C7A2F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0dd5d5279de65599ce2fc8d0c53c076a8ac5a46eb4c0f691d83de281da8a0fa
MD5 76d7ef31167de0b6aa8f2489111a7ebb
SHA1 8158900ea86a2f487b42f989d75f857f99b53527
SHA512 1886e50a972f9a39e5672f4c776ea46da4494ab9479e05993efa077904858667baf8c3ae4f27484f2614c92f29a0d31478c17b2106dd9b6ba0923beaac990e4d
TLSH
T14E4159F7D7D886BE890196F8B6152E2FCE2D0E54532C3C5AC8D4AE0F57E2972D24058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 773fb9b109300055e4e0f1d771890c203df853100549579ee443d183b9e6179c
MD5 fcd0c09941550aa8bdebba2915902c72
SHA1 e9080c779e6d3258378032a9c2c72328ecf3c13a
SHA512 e9d6f3e79c8aa04f66846fc96ad8205167c9dcb0bc0f122b5e12f2075bdf5d33615395dd9c8304adcde9c0ed76a9c280e0f42a7c4e871814a6205fc098786590
TLSH
T1C481BCB3D3E9866DC50153F0EA246E1FCE6E0A14536C3C6AC9E8AF4F53E2472D25164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 add90e043eec8c426d4307dc8961e2a85ab3d5e0ad84153cc3ad3817cacc5f04
MD5 27a4d28fe1dae19480642f55ebe627bc
SHA1 25ff481a7bcb2311f66bc9b6ae642369ac0bfe69
SHA512 a95349a187f5819f633d9751bf5c513e347bb3fdf0c286568d38ddbc5a548cad3b8a4eee97823076e1b966c04c6025c256e499cc51707ae1c3ea6c1eed34f212
SSDEEP 48:YALlqCqHFqFbWPhaRafo7XLs2gmzs14syfsQosgKsMDs8UWg4q1zsSoWzswM1+sW:DliQB+UaaXSyhQ2dUx4qZosM16H
TLSH
T19881BBB3D3E9866DC50153F0EA246E1FCF690A24536C3C5AC9E8AE4B93E2471D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 94f4007fe53de9401f41540f43f0d5589c1a840b1d712f3a5e5a683e83b86ee3
MD5 7c9819fdad9444286a3fcf90b76a4582
SHA1 35ef20d3f9c2e33b90a261018f8d2d8562092bfa
SHA512 00988ab31c2e728a320005595236e5e4c52638c964d968f9fc6878c95ba57d23ed914376cae1a2cdf4a091da231c9af9327ad50cfa27411a9d9609360f358ad7
SSDEEP 192:TReDSHlaHAv71hpAPRp2A1i92Hsb+WNnXNgEEq2tickwvVCVyIsnAUgraJ:TReDGkcBhUXgQw9ge2scwe
TLSH
T16D52C46FA914697B6CDBD22AFD623B57D7F1102122E21E84E6FCCA1C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 419eb58f80eb2b40ea3e2e9074525173d90b031d8db41f50fe04a8dd66690e0f
MD5 398cea615eb31182ee91e7fb4ec7b89a
SHA1 859f6b7055c4d231931e0bedea27ec8634dd85a2
SHA512 f202b13fbd90e2c65680c31d2380281818c0b80b13ab444711b825898018af7b55c8106e95a59023b934ede430afc0e6abf4e0ae4271fa0a901667185018272f
SSDEEP 192:TReDSHlaH/v71hpAPRp2Aa92Hsb+WNnXNgEEq2WickwvmVyIsnAUgtaJ:TReDGkXBhUXCQw9ge25cW8
TLSH
T1BF52C42FA914A97B6CDBD22AFD613B57D7F5102122A21E84E6FCCA1C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0247b5d71115850e7d3eac6e4bcdd31ca721646302389feb33d4c384582ed738
MD5 eecc35e4806e097a2116b3fdbf1f3b30
SHA1 ffccb86dbb5467425c1d31a983dd8eb050c013d0
SHA512 699cd417de7181b919ae69c667ef2a66e98474c1d092892fdef3b5fa91862c9b942a280924312e530f9b1ed41b551259b9388d07d92e503a70daba1679f21583
SSDEEP 192:TReDSHlaHKv71hpAPRp2Aa92Hsb+WNnXNgEEq2tickwvVCVyIsnAUgraJ:TReDGkGBhUXCQw9ge2scwe
TLSH
T1DD52D56FA914697B6CDBD22AFD623B57D7F1102122E21E84E6FCCA1C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8a8ef91f2bff5551e915526694b724357d92485f8b2f1bb855251e8061bc97a4
MD5 9744f14f512de8af400d51d2643dff05
SHA1 177c99dc4d2db6485835e5b2c2ac3e56c93cfbfa
SHA512 35bf8c94d510e7af3726176918845593edc0d212593e8c1700af1385825b17dd88d7d60023619f026eb45eceef90ea934d0af09881dd0502fba42a4c7fbd6589
SSDEEP 192:TReDSHlav/v71hpAPRp2g92Hsb+WNnXN0/ickwvmVyIsnAUgtaJ:TReDGkXBhUXDQw90qcW8
TLSH
T1E842B46FAD14657B6CDBD22AFD613B43D7F5102122A61E84E6FCCA1C15E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7e85b40b07f49cd23c9b5142815f167626458e72ec7d67991914cf877e48d725
MD5 a7fd8e3a444c97c53b2f06401c0d2387
SHA1 a7a7ce52b370b25ca6007bf4b1dfb9b1287eaf1b
SHA512 4a90b61f263343267d4c73d465735ddbec5f6c7c37659133827d0941b84121c61c729bd56177fc55f131bba48f5de61f124be4d1c5612e2c12972bf67dce1b89
SSDEEP 192:TReDSHlaH7v71hp9PRppA1i92Hsb+WNnXNgEEq2eGickwvpCVyIsnAUgraJ:TReDGkDBhvXLQw9ge2epcke
TLSH
T19352D56FB9146977ACDBD22AFD617B57D3F1102122A21E84E6FCCA1C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 eb3d438fcd5e4941d05fda99aa5fe3dcb4da79fe08c1e56c653f0dd76a49cc47
MD5 06a63c6b814a91ab598682cf642f7791
SHA1 6889320da548446915c99e16d5f383b6ccd037b4
SHA512 6821ae77f02e1a32c54d9545b8fb4208907b6b6690dac0f24b0fdb3d0964a7a09a91fab4067e5c0cbfdf4d1ee0b2d5a1e67c45a61033bc6c9cd891ef2f9c9d83
TLSH
T133B0124084016211C04202F411469498B214DF12970A2706C3F0AD238C355628029051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59574e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59574e.TMP
Size 96B
SHA256 614465452141438a9073af522348a938b6dd22b08a9ebc5b6e0d34e874936a5a
MD5 67db85e788debb9ee3d158161ca9be36
SHA1 852cb71381ec10f8afb7e972dc44e59e51eb90bb
SHA512 b9f9531519e4d3b48a4b6d429c1777e438d795074f1c71342d2ffc6fab8f3b1429078db420258dacbba290403648b8baf198a4dccf8556507fa5a90fc1275b45
TLSH
T140B02202C0022302C00203B02882A0E83228CF20C3032302A2E00E2EFC2832008B2023
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 29e9a0b0e26e5db9c9ad392afbae2aa41e31820caace51550eff0a5905b616e1
MD5 845655d4a6c4b554254a0ad60fbd2cbe
SHA1 ef83c6283e5dd65a8f855feb373c5c66bdaa4708
SHA512 edb50d861bf49d75200b789439f0f2ce3a47e258dd056baedef9c8dc0aa87beb6098273cdc1e6dcc394412214ed82474a608313cddc648961cbef4b448916eed
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Am7Rkm1tYpBeh2BAo3
TLSH
T1F7C312275D75E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437EA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 949dbf9cb8ee70eef6748c52233f83e21c4b71facd5e84b6751ac48ef360e5ba
MD5 cf38ec75d147f600aa54f4db69ebaf3a
SHA1 da8fcf3a175597614f8acb83d67f15f0f3f7dff8
SHA512 3da0ae3545db05bfb689065f3331c230347bb25406d04d5fb233f091cfc0f25d08b39403a888be23b09afe169239c5d7741c85ec8fff7f9fc0d34c6f709161ea
SSDEEP 6144:Lmg1kQfATCFbzQACjgm7Rkm1tYpBeh2BAos:fneAm9oBGcAos
TLSH
T1B834231F4EB05D7A1B251A66608A0F3E3AF28F7BCE225ED4C1D90B4437DAEC91746830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 3776bbe760ef9eb604e17e113aa3eb7a67a12d3fcd7c90544d3dc2ea433e7479
MD5 4bcf02eebdd5ddd4e287f817632f15a2
SHA1 498c6b2581f1bc2c1adbdbdc3d9b6ee67ca8d56b
SHA512 1143d29ec98fedb04dcaeb16974b4153aefa8cf6cbf56ac51ddd926ec627b3d2c98a644cc23768d1a2c2fd2192f7e709d4beca11e0952c50e263d8ff7356c458
SSDEEP 6144:R0mg1kQfATCFbzQACjgm7Rkm1tYpBeh2BAos:yneAm9oBGcAos
TLSH
T13034232F4DB05D7A1B651A5A608A1E2E2EF19F7BCE215E98C1DD1B4037DED890B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 486c6cf88884e2aecce78b890ebbf6c959c9a8df5a594c35fa92bdeb293ee2d8
MD5 4c2e4166b397d499de99d49858ff5968
SHA1 98333528ed3d9afd0274bffe1ae300ddb2bfd49d
SHA512 8beed416b71f242fdc4fc8ac13647d6a6e23af5f1a88ce0aab90686f4c7e293f059a6deb35ebe2f014cdaec7e059be78a8b6e3754f2ab1f6589eefa381a0b907
SSDEEP 6144:h0mg1kQfATCFbzQACjgm7Rkm1tYpBeh2BAos:CneAm9oBGcAos
TLSH
T12D34232F4DB05D7A1B651A6A608A1E2E2EF19F7BCE215E98C1DD1B4037DED890B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0a2eb3b685af5384faf198cc0ad0206b4ce624279fc694b1d6fb0aff9f9250ac
MD5 06c9ad7baa58568c32e48c70548bb629
SHA1 c44cd6803f9947cfd7fec3212193b1f70b8dbf72
SHA512 d2e97b687c17a9aca34efbdb5dd7622499c52c90ae3c8c6babc44c959c7c67173ff0fd89c735864277a063a25f38cdc05fab9611dac38fa454535175b5613bd6
SSDEEP 6144:ymg1kQfATCFbzQACjgm7Rkm1tYpBeh2BAos:ineAm9oBGcAos
TLSH
T1B134231F4EB45D7A1B251A66608A0F3E2AF28F7BCE225ED5C1D90B4437DAEC91746830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 313a7345f4c1a1cd137b1bac3d5349cdf17d5ae60fd185c06483a253c84a84a3
MD5 0cb503356ab18321b45e55b3d2026dff
SHA1 8c2faf643828b0cb929847fd129f84517d31eede
SHA512 91a0a06062708048385822350382560fa85ab081b136806a9a9eb0b803818c2b914f090f3a9d9a68ca9b26482e24244a229bbf065442110df837027a161b6ceb
TLSH
T158E02B76C826EC2709FD07A8A00D8B4AE71013172780894F7B3CD20C8FB163A56D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a39192287ee02c3bbbe4030fec85e06986c40b47af7924da731ac9c134364b6
MD5 198aada96e146957581bdfc254ec6220
SHA1 be4f356c1e6812f6b78e1d9775e217fdc313a742
SHA512 66bf770c1fc2103b7b6d93d8f3111b12599d06bfef9e0d0f112f76841cf8c26b503f6662a9d0f8449bc99a6c748addf38ead892c09e464498b206388f7d3e5b0
TLSH
T1B381B6380B960CA2E7934F3146D231E5F63982FAFCDF4E971F10A8355409794887D92B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ec01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec01.TMP
Size 3KB
SHA256 3680bb1336ae33340b21ec6ced6baf6bc5267ea76864b13610f2b682d16ee2c2
MD5 99ba43eb03249954c246ce8d416ac371
SHA1 8526e921c7d97803e3e952188d13242aee327d77
SHA512 af22bbd2f803a804d416a9c8642430d25a1af750635ccb2ced1d87ca173f1c29d9e701467c79e3a5a36e96a21ac0908490ad17d89895cd487d406c3ce80aa56c
TLSH
T10681A4380B960CA2E7534F3146D231E5F63982FAFCEF4D871F20A8356409795887C92B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15dbad7b-bfa2-4aab-a493-119b674d6d99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15dbad7b-bfa2-4aab-a493-119b674d6d99.tmp
Size 1KB
SHA256 6da5a7bf90caf84884c3341d16f8196c611a7d5f77e2e8b2a3e29a4cb782e7cb
MD5 571a0b766f630bdf7236a2d14c8bed32
SHA1 0f7d2fba054e9aebe452997836f4bc4cc189273f
SHA512 b48968534c00ad9bf6a3b325ac4c96837e95b8d5350265572e8af1afa1bc14619d28c33e3f2175423e23bb9a6c056453098f8dc57e6d07e87c3704d596e004fd
TLSH
T1C431C0F383E8856E8A1095F0B618AE2FDE2D0514432C3D9AC9E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a33867ca03bf18cbe6534cef7fa29ff9c5fa99d41de440da19f2d9758c716640
MD5 7265b5831501be9a6cbf6d57b175e8ef
SHA1 6460f333ab9cef70acc5a0089f6a0cfe79b6c5d2
SHA512 67e7225deaed654dbe82f7d35aa16b3c086c0f3af0b45c041a4625fa4f91684c0877a306f523bd5646d2d08c940945f9ff8c2296eef466f671be82903f77061d
TLSH
T10571C0F787E9866EC91256F0EA287E1BCF1D0514837C3C5AC5E4AF5B93E2071D141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6dc72e3337cb8c8efe96ccca3dec7ac10f3db6a9e39927aef42deb4110da03d2
MD5 477782fb7872791754ad08d2f5f67f8c
SHA1 bfd69d27ff227d74e8687e73c5e5d1cb4ffe03f7
SHA512 d1abd68369e8fc8731e89d16ed49ecc5d94e81b95eac15b07f2a42ea18a51b35a2f57c9de65abd22a1efbb6784e77678d500dfc64a4f254f3f249edbe9b7948f
TLSH
T1F6D0A963220070B6A5ADAA89816FE88FC33B00208962ADD460909FA8252A4AA191B346
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e24b792919906ff54a9d64680288ea71ae425b9b86e5edfb5d0d6c7c587153a8
MD5 2895fe27dae91d2f81e0f7a06fb01ffb
SHA1 1d504beccca4ecabd31a14974d93768176093c72
SHA512 c60f176470f535fef83b6810ffa6f4ab231f46101e250f2884bf3df7f83a7eafcee8ed0f8ed0db781fef52c71d748ac7f0c306c536dc1abbef372ee0ea653ad0
SSDEEP 192:sxZn7R2yMqZjK1Ml8Mku/f4YssC2ThaZdczodpHyHW6+WNGYvIuEB1YUIgjaJ:sxZ7jMu/f3ssC2daz/SHbGvfjW
TLSH
T10462F9066A3899778DD7D219F6457F53D6F91133A2905E44AAFCCA0C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 95d92dec393bf8ec64265f32b83a35a332a64c1318ce276c2344fe6e795b77e8
MD5 c0b8773b12b36b67288fb97f5f70b427
SHA1 e5633aa35b40e3da279cd3743019d0c661b6b741
SHA512 0288be2f7c52c624dce3b1e742473f91fad7dcbb2d3e12cd85cef78979900910be2f6abccdc16a8e216e5ad8b8b3102314f0b173e907ef6e28b4dfd0b634590d
SSDEEP 192:sxZn7R2yMqZjK1Ml8UQaku/f4YsP2TcZd8zodpH6PVHW6+WNtEqZDGBiz/YvIvJN:sxZ7jqpu/f3sP2ozf2Hbtrd/KfJW
TLSH
T1FE72E8166A388D7B8DDBD219F545BB53D2F9106392915E44AAFCCE0C01E7BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 3685d91b889029883a9edbac2ed0ed549d5ac62ee4b208a04c5c2ad2be2a6b40
MD5 2d25c5fff4be3ab2bcf0485abbd0d4ae
SHA1 ea21669c9f0c37c323815098aa8a53ec6a7cbc74
SHA512 4e1634fff4a01c4e94506c947e3083d7a75afe472662183b3c54c8acd3f668b7a687768516e7fbe5c86e41a38496422926c2ba9f04c616c083cf33d482465ce5
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9bPvSfItpfd9cJmtR74g/envOR9Sg:0LppY93PBZJPtN53bXCE
TLSH
T138B2581A713A0211397E3988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e2852b1d40ceb5962afd9ff015d43a5917f9457723c708cc560b0a70aaf782d1
MD5 47b3304739a606fad83715a144b4ef02
SHA1 110bc1c5549b69ebf607c49f7c842cfc9693577b
SHA512 871aaa6632ea48e3054bc69d105221b689a917270bfd0d5d7955320fbfbc31d6686c474df8fbe0ce4741ef809db382c6dbfb4e129fc6259c61d5c8581cb86d35
SSDEEP 768:pLFccp138wg0kFvXGp1UhMXME1VKl8BvTPaK:d13BA1iXfKl0WK
TLSH
T11DD24B36EC68CE7BADE74BC9A75A3943DEE44163C68C5AE4D6DC1E0C009B19C530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2f7a03fc65f5bf8db42f153879fffb39e95fed8b04e8fca84982a75a9fd147b7
MD5 628565f144b11c0c80fc995d6dba3d8c
SHA1 4b153c859081b8431ee370113c3fc6076b5f84e5
SHA512 dfe90865d6aa08bcdd42fee26feb10193a5e41d40f420d4517187c6bd33b5cacd680e66483937beb5298b5afc7e2289f367375ad334c1212c93c6cef84c1ced5
SSDEEP 768:aFpj+9e8wgokRvXGp1UhMXM71VKl8BvTPaY:f9eV41iX2Kl0WY
TLSH
T1A9D24B36DC58CE6BADE78FC9B70A3A47DEE4426386885AD4D6DC5E0C00D719C530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ad26477f9a2946dba8964ef519a585791313ab6dd0b0ef4f363847fac5357618
MD5 c91c5ef85e16c70a13becdb26331755a
SHA1 09c8f4b1121b51b96d415f8888f5db7df9715c3e
SHA512 50d075e2b7d11d568007274a5b01f1b9dfa4a2a64b9c17a8aa70b8588b630044c6c38bc42b0dedc0341c65923c3e3c766ac7394a5eff055f1534520d1338211b
SSDEEP 768:ZF1j+988wg0kRvXGp1UhMXMc1VKl8BvTPaY:I98B41iXBKl0WY
TLSH
T18FD24B36DC68CE6BADE74FC9B70A3A47DEE4426386885AE4D6DC5E0C00D719C530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d7a0d038226bd16121e57941faa5632cc44ff4f4756367ee9f47580dcaed40fa
MD5 adb1577ae7542f68e5eeab6e7f99d998
SHA1 41f2f0d705cf29e1f4ef46cbd2b70db8a7ec5801
SHA512 abd18a19a8549a00536892dbb6c54f65faef83eca38d5c0d61f74b35bceb24e95867311098246840e886571071c954676a854e794ef5a4271b388b41801a273a
SSDEEP 384:npriF9CcmyWCs3sNTQ8TUNTUlIm2QckCr9lpUKpvtfxGp1Uan1bIpye4KV8p00LQ:pGFccps3BwgbkUvUkXGp1Uwb3I8p00LQ
TLSH
T13BB26C36EC68CABBECE74F99B74B7A03DEE0116786D859E4DAD85D0C009719C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 05719885537a6ecc28c4b5dc26034b0d89e13eb64eebd09dde55f366479d62a9
MD5 d9ffc95518713828513a9fc05fb12daa
SHA1 3e2289c9da378f9d9c8facc9747e1dfa748e610e
SHA512 c1f95894161cef2cb47e2e2f774909f6535e71781eaac10d98234557be7cf669ca47f73a03304e627b88f234ecd28c5ddec81cfa7488f9fb64bedc59e3ab7292
SSDEEP 768:pSFccps3MwgbkUzUcXGp1UhMXMV1VI8p00LQ:0s3O9n1iXYI8p00LQ
TLSH
T176C24B36EC68C97BFCE34B98A74B3943DEE45167C68C9AE4DADC1D0C009B19C530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e4d17d48c746c8538e8e2fc6eafc81fe5e1c60f711ce22ce3217371105169e90
MD5 616eac1508bd9cff697395f7c920feef
SHA1 27ec3f37868e1d939e8c080b1ae8b8b37223a587
SHA512 df45ccf1f39e581e8b9d3fd56eda6b10b18aed8ede61f9f50f8972356d1a31b956952fbdfefb72f58634e289708886be8516ecdc3e92e6756994fd6548364a9b
SSDEEP 768:aF1j+9e8wg0kRvXGp1UhMXM71VKl8BvTPaY:Z9eB41iX2Kl0WY
TLSH
T19BD24B36DC68CE6BADE74FC9B70A3A47DEE4426386885AE4D6DC5E0C00D719C530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e04c982b88368c6dc4ded6c6d894f8f92c93daf445b5a622572081ddf987448f
MD5 9ab14bf4a69eae871f98f9eb2203ee78
SHA1 130e8b3cee00716d09219956e33035dfc240b1eb
SHA512 8a9a0c56dd1d041c730343a250db27298e793a153502ca8c246b748f8f4a61d38d8b37f87190f28b86784c8ee9e9c75454d892c0cc068e7a005ef7a47121d639
SSDEEP 768:pLF1j+9Q38wg0kfvXGp1UhMXMc1VKl8BvTPaY:Y9Q3BK1iXBKl0WY
TLSH
T1DED24B36DC68CE6BADE74FC9B70A3A47DEE4426386885AE4D6DC5E0C00D719C530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca412da58f45412822a040545e9d1d32290720c454ef45459f8a4fe237148a56
MD5 9d3137987c94e98110c40952e84e32a9
SHA1 a1b58cb2df66b45e1fbe53cc8669ef29cb05706e
SHA512 a590983a0ea8abd87d2c7bf2680443d15de26a29a36ced6cab5b1d16dd2ea1b8b701b7cce181ff8f294b4bf2456f8d2edae1474930c09448e5ccd67223aa0958
TLSH
T10041295DBAF91148B3B76E1AABF7986D447E78732F06D05D00110D4F0B22A44C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5124-211-0x000002A3D5EE0000-0x000002A3D6EE0000-memory.dmp

Download