hxxps://www[.]xeno[.]now/download

Resubmissions

03/07/2026, 22:48

260703-2rf8psc19l3

03/07/2026, 22:45

260703-2pstqac18j6

03/07/2026, 22:43

260703-2nn45sc16l8

03/07/2026, 22:36

260703-2jbcgsc13j8

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/download
Sample260703-2rf8psc19l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1800	msedge.exe
5620	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275925331646931"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B192E60A-DCD3-446A-9F7F-030588055397}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4776	1180	msedge.exe	86
PID 1180 wrote to memory of 1800	1180	msedge.exe	87
PID 1180 wrote to memory of 3704	1180	msedge.exe	88
PID 1180 wrote to memory of 3704	1180	msedge.exe	88
PID 1180 wrote to memory of 3704	1180	msedge.exe	88
PID 1180 wrote to memory of 2304	1180	msedge.exe	89
PID 1180 wrote to memory of 2304	1180	msedge.exe	89
PID 1180 wrote to memory of 4432	1180	msedge.exe	91
PID 1180 wrote to memory of 2196	1180	msedge.exe	92
PID 1180 wrote to memory of 4432	1180	msedge.exe	91
PID 1180 wrote to memory of 4432	1180	msedge.exe	91
PID 1180 wrote to memory of 2196	1180	msedge.exe	92
PID 1180 wrote to memory of 2196	1180	msedge.exe	92
PID 1180 wrote to memory of 4640	1180	msedge.exe	93
PID 1180 wrote to memory of 4640	1180	msedge.exe	93
PID 1180 wrote to memory of 4640	1180	msedge.exe	93
PID 1180 wrote to memory of 4664	1180	msedge.exe	94
PID 1180 wrote to memory of 4664	1180	msedge.exe	94
PID 1180 wrote to memory of 4664	1180	msedge.exe	94
PID 1180 wrote to memory of 2780	1180	msedge.exe	99
PID 1180 wrote to memory of 2780	1180	msedge.exe	99
PID 1180 wrote to memory of 1576	1180	msedge.exe	100
PID 1180 wrote to memory of 1576	1180	msedge.exe	100
PID 1180 wrote to memory of 876	1180	msedge.exe	102
PID 1180 wrote to memory of 1104	1180	msedge.exe	107
PID 1180 wrote to memory of 1104	1180	msedge.exe	107
PID 1180 wrote to memory of 1104	1180	msedge.exe	107
PID 1180 wrote to memory of 5160	1180	msedge.exe	112
PID 1180 wrote to memory of 5160	1180	msedge.exe	112
PID 1180 wrote to memory of 5160	1180	msedge.exe	112
PID 1180 wrote to memory of 5232	1180	msedge.exe	113
PID 1180 wrote to memory of 5232	1180	msedge.exe	113
PID 1180 wrote to memory of 5232	1180	msedge.exe	113
PID 1172 wrote to memory of 1564	1172	chrome.exe	122
PID 1172 wrote to memory of 5620	1172	chrome.exe	123
PID 1172 wrote to memory of 5624	1172	chrome.exe	124
PID 1172 wrote to memory of 5624	1172	chrome.exe	124
PID 1172 wrote to memory of 1120	1172	chrome.exe	125
PID 1172 wrote to memory of 1120	1172	chrome.exe	125
PID 1172 wrote to memory of 3956	1172	chrome.exe	128
PID 1172 wrote to memory of 3956	1172	chrome.exe	128
PID 1172 wrote to memory of 4520	1172	chrome.exe	127
PID 1172 wrote to memory of 4520	1172	chrome.exe	127
PID 1172 wrote to memory of 5692	1172	chrome.exe	129
PID 1172 wrote to memory of 5692	1172	chrome.exe	129
PID 1172 wrote to memory of 5160	1172	chrome.exe	130
PID 1172 wrote to memory of 5160	1172	chrome.exe	130
PID 1172 wrote to memory of 5844	1172	chrome.exe	131
PID 1172 wrote to memory of 5844	1172	chrome.exe	131
PID 1172 wrote to memory of 5796	1172	chrome.exe	132
PID 1172 wrote to memory of 5796	1172	chrome.exe	132
PID 1172 wrote to memory of 5900	1172	chrome.exe	133
PID 1172 wrote to memory of 5988	1172	chrome.exe	135
PID 1172 wrote to memory of 5988	1172	chrome.exe	135
PID 1172 wrote to memory of 6088	1172	chrome.exe	136
PID 1172 wrote to memory of 6088	1172	chrome.exe	136
PID 1172 wrote to memory of 1868	1172	chrome.exe	138
PID 1172 wrote to memory of 1868	1172	chrome.exe	138
PID 1172 wrote to memory of 5196	1172	chrome.exe	139
PID 1172 wrote to memory of 5196	1172	chrome.exe	139
PID 1172 wrote to memory of 5788	1172	chrome.exe	140
PID 1172 wrote to memory of 5816	1172	chrome.exe	141
PID 1172 wrote to memory of 5832	1172	chrome.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,4862225543636116483,18298116858433722546,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16535903103998161119,7489018766698714369,262144 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,11571868872806596691,12449083089962177053,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1469786092272666020,15591912664138105558,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,8521981560069410951,13226543105965980998,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,17923479312193336918,11462084694521281859,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,3639988925037033106,3064342526107671170,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,788476538647108767,8727994081695338156,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,7422625181323074522,2813078762975177915,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,414824642142726570,16961401039369378007,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,414824642142726570,16961401039369378007,524288 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6064,i,14638126572693033676,2378022167735927131,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6376,i,16021486118838534469,11002345395393699350,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6568,i,7504341288960355275,6709163461910176888,2097152 --field-trial-handle=2308,i,9792870316337087088,1933196738282906987,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb75f6c728,0x7ffb75f6c734,0x7ffb75f6c740
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,17762129038299412425,2763374054213703382,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,10012503632239384139,18070003464023033494,262144 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,11590674432577763429,11668712014227228248,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,278109659991273526,7914692218627292043,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,3622657759751215827,3925234440805744851,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,5487236632388373086,16302153506665580817,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,8109945264870467785,4257606110207472337,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4196,i,16317692278622477705,1217621099247589677,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,3779599571857176215,14085353981989396024,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,1798698080169011553,11305480711883802779,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,8215596369861014371,9661058078437454632,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4868,i,2747924179175100388,7508755397493294120,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3424,i,8073708224988240328,14113206008411666244,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4708,i,14199070202982296612,7707185526070999459,2097152 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,603218913593190238,14266814131688394295,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,16001099844124991023,6518522321551936317,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,18310011236092263877,5716076155510264716,524288 --field-trial-handle=2060,i,9438221126381166529,12873660207522363265,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 600abdec603ea87bee8cef978c92a8c745be775b368f46ec4d3fcee19957a906
MD5 e9845357c8ec50435e5abd2f963e00ad
SHA1 25aad39861e9ee88767c66414bf565025e266ad5
SHA512 aa9a9464f2514ad5a97a97b6932988d5d73c41a0676ff6640142dd991e49ce75000e740a0d7b3c465fe3ff9d46549495a246ceb26202306a3e924af71f0a1e70
TLSH
T115E02BAAC8219C671DF91B2820204746E780131A3F90CC4F3B3DC24D8FB5A3A85A6C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 93KB
SHA256 4ebec4b3bd67c71db1fc31912a114576fa02c6b57418bd9f8a206eba970dfb63
MD5 522a500ed78264c6438b42fc71130079
SHA1 cea1425b4f676193013347ce5a6a3c19d070ccc5
SHA512 93afcc9f1f9596bbbaecb59a1e56855ca592aecbad7fbd3f8b6878c1cc87bdeda0c7a5fab5e9d19a14325803c9c90193e56b9836f1698060b580ce8c0486832a
SSDEEP 1536:S1tn/7lmaZHDbzalp6yyZezMRCkDm13k3mESSC9ujqLTj4VXaTMkIHChRieuxg5/:qJjlmaZHXYcyEME/Dmh+mNAjqLTj0a4K
TLSH
T1E193122D94174A48E2402D3D554E2BB9D0ACCED3FB4A310EE4F677C09CA4AA07DA0F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0486f01b0e5b1262ca7c42bf7073f3b5ba3828fb3f4e713eaa2430fecd6439a
MD5 e7d0b2747816703d5c2a1e2c00835375
SHA1 7a19eee18aa15e206792c5528a8b5f01bdcb6340
SHA512 2211146790f7f1f6a9d7c24431fa84c507977211ce75fb73c5c951be9a203b0c2d73ff46098f78ffc32dc14479e3c42f8ef3d25fda0a90ceac7a2f131737e58b
TLSH
T18E510CA8CAA450F6EB1C2678D0EDDC80353BA88551F3DE42409668BE17DF7F5D2740D0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5c7a9327de1e4c4de8c619231b89cc9c921ccc40b642355307f34eb01ed024f1
MD5 82ee8c064b43d032ae72c203a280d599
SHA1 8d5593a67d950634ab05e0de553bb79537dad2f1
SHA512 462110fba342c1a06fbf269ee59fba7eda3cb0d517d9b3e31c2ccd9c6c21fab163e4ce5a7239aabb17722399bfb297629317211f2fd5e35fa34e2c629d29efb7
SSDEEP 192:DZgBvx0YOwmGReq61oBaI/ipG2HAGOcXuFGVuRcFGMamhmc1tlAqGcugllvVPu1K:DZgBvx0YOwmGReq61oBaI/ipG2HAGOcL
TLSH
T16D427DF3C3E48A2DDC2162F4A7156D1BCE690928532C3D6AC8D5AF4B53E2572E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c32bda73f13bf8e27749b6a09ab615a4757ca7ca344db20c845bcc59661b8c76
MD5 5e2fee916e405af848aee846deab4813
SHA1 646f5d61692a9a9b4a7fd7f8961d4ec85a5f809d
SHA512 664a7466df054402ae21893ce377178e047e213e8ad1bf03d08da6c9af1ff90224f79a2d97fb177c1e450c395a87d47529058323e7d0d9bb84d80d10972ca62f
SSDEEP 192:iRm9gGGyQmVO5v7cpAPRp2qhUV89BHsb+WNnlbb/V2KFnRj2qZ5a03aVyIsnAUg8:iRm9kjZwUXlNrwNp2iRj2EaSa8
TLSH
T1B352F92FB92069BB5DDAC22AF9257B57D3F5102125D42DC4E6FC8E1C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 31ef3a439a889806809631dd07f24d968754b39507b9929af9761d1277613abd
MD5 128624d5ac24a549fe3d9f5c569af983
SHA1 c8d85a688f8650122a73bf3bb24258a17894d0ca
SHA512 ed67568674d2f0f04be6f8a3ccfbfc98074caeb6d31455138240ceea6fc9af3b1165b0292bee47ba487c911ca3e9c1b9460a23db2a4973b345e4faea1d8256c6
SSDEEP 192:iRm9gGGyQmV31v7cpaPRpgquVU+i9c9BHsb+WNFolbbb5MqmR2uAFnRj2qZ5a0X/:iRm9kCFw2Xv8rwspW2HRj2EaMae
TLSH
T1D162FA2BA92029BF9ED6C326F911776BD3F5102125D02DC4E6FC8E5C16E76CC221B45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4d9dc729242ead7ef48c31992f6945186baf6a764669af9c6abdaec02f406bee
MD5 598a122dd1c58563b7648dd335dba1a7
SHA1 875a6a0325cad5e36a4caaa30f2cd3ef94e1bfe3
SHA512 19f31c57da74759f6601a9d2d9e2bc55fbaab303a43437b46249c480b1426652f81f747d382e9e759a9fa76f5a2e948c6b4ebcaad66c88984cb243991e7a1018
SSDEEP 192:iRm99GGyQmV3Cv7cpaPRpgquVU+i9c9BHsb+WNFolbbb5MqmR2uAFnRj2qZ5a0X/:iRm9NCOw2Xv8rwspW2HRj2EaMae
TLSH
T17062F92BA92029BF9ED6C32AF911776BD3F5102125D02DC4E6FC8E5C16E76CC220B45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 077ac34f082fb3468a18dd24b3926db13bb83b96f119b37c0918114bf5ab4551
MD5 51312e826a3fa7990cdc32dc1c270125
SHA1 1596ccac82e00d513c04998b9b02daa277343ace
SHA512 dc078dfab278ff30d9f49f5b3058065bee51b958426f7795111ae8c1b7704df7006c3aa882ee694e793b543668875965064ccb5068a4ee7daae5a78e9d0bdca1
SSDEEP 192:iRm9gGGyQmV35v7cpAPRp2quVU+i9c9BHsb+WNFolbbb5MqmR2uRFnRj2qZ5a03B:iRm9kCZwUXl8rwspW2uRj2EaSa8
TLSH
T16652F92BA92029BF9ED6C226F921776BD3F1102125D02DC4E6FC8E5C16E76CC321B45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\b663b598-c368-4aff-aeeb-73a59f488acf\index-dir\the-real-index
Size 120B
SHA256 95f07ead5f7c3e3373e1c81cfa37ee47fa9bdac02b713aa3e091ffd086de6883
MD5 5b3a3d0b0f3629db69fa4c11640f9f10
SHA1 fa1a59404aa91870238c9ebefae87f37504fe259
SHA512 5536bed743843c9f1f421d13eebc355e76d13c820349197afe1d63e645b42d0d81290a3d694834282848e98da8ade42dbc514c91118a09f5050e25a5a96149ba
TLSH
T11CB0120398400527C91407B0D13B82C32B590D9D23634363A2DA678869A22D84101880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a37a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\b663b598-c368-4aff-aeeb-73a59f488acf\index-dir\the-real-index~RFe59a37a.TMP
Size 48B
SHA256 d4c709bffe64424bd3711fe4d51b97f7d57bbddf861b43ebf33e768b54283b17
MD5 e1f6eaa2469bc55e9635f90e3852c06b
SHA1 16c42c5361d658620dd7d45fa2c832ea5321f0e1
SHA512 075cbe53b9de8511feda93158814ba59f3e1dd31f84ea996712cfda5f04257479a3208a336ef3594bb7ec34f361091e81644fa07aa7306633dbc63983ae90081
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\index.txt
Size 168B
SHA256 dbccab33a0d8acac914888c0166b92f14c946decdc8bbfc178dbb93cff980d6a
MD5 49fa43178b0ffd873bb03d0c1815ac51
SHA1 b447decaecd97a5c0f7d8f67c759b542a2860df0
SHA512 98762888332d92d264322642dd7a96f8b770c0226aa09abbab847c3e9ba2084994083ee465f5ac54464ae15fe8a291d55091c418d4b9984adabe00fd6c6f7fdd
TLSH
T14DC08CDA004023085E5167A12C31621DFA3EE9C8E8B35E8CC0A211855046872190BFBA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a3a9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\index.txt~RFe59a3a9.TMP
Size 173B
SHA256 1582876b28056db26d4eb11636d9e4c5f85c7261e12bff9377b3e40c40e6974b
MD5 cbe12ebc8a6ad9e28094389a06f920f4
SHA1 035299b5df3b87a89a12e7113632714a75ec3a49
SHA512 f85fe2175f619849789e0165a94cfd7e26869cf2a706077dee012f02d892436fdaf5c5d1a3d3ca793da1ac92131720f2c98dc9ccbb6cfbb5dac637d9b7a1e207
TLSH
T1B7C08CDB005023005F5527E26C31620CEA3EEDC8A8B35E8CC0A6318510768325A0AFBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 d56c216af0af351f72f13d2a31c985ade231b9e1f9fa9d54ed097da33cfbb358
MD5 a75405573d1f6d24436d3c848a94cba1
SHA1 ab6f5a80d30f4853ceafec870e4ea76dd0eda43b
SHA512 db1eed0cbdd5b7dd09514ada78aefe03cbd4c37f7b8e23da6eb046b581d346dda8f2ee738df1270f92b261ca03d0d78f564758a0d03d9e24333e661093cb71c3
TLSH
T1AEC01211C0057552C04E03B83076D4A97254DF32CA1E1B4942E0BA57DC392618125151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 de2e23b0e54afcf6aa1cd7e870fe3c2c7cf5767c75730a5b57b4b653269e646b
MD5 48a34eed5d8d06206c5067cdd3583764
SHA1 1d0f9291573558662e118ef7725b98d8810cc4a3
SHA512 907c0492f701cfb6fbd6427316b3a219c5fc1ee5fa4ab9141f8c94ed012bbe7131890cd8528a5114b9663c3a5f225480fb37cd4470a70a821c61f811fe63ddf6
TLSH
T132B0120081019111C0430BF423432498B128AF18D60A270383E0692FCC392B280240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e38.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593e38.TMP
Size 96B
SHA256 f8d4c6a5b8c21ad0adc3c2b94f5099cd847cf798a34e2810a3ff2a5fecf19f68
MD5 dc911868cca6b2edc8c3f0e0fc3edc58
SHA1 724b473009b155182cbbfabbe7bc56baf0497a8a
SHA512 309315780c734687a1f1c00777b99a0953cdd11fb923193931c10eee0bec2c7b5f93566fea4f1961bd748ec5e33756239170cf8ef60be881d62d901e04cd4eb9
TLSH
T120B02280C3023222C00203F2288283F83020EF22CE03223282E00E2BCCA0BB000280A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 bfa03321a0db1c97b5ce15c22701767fc189043d2c8db8a7474e823fb9711cd5
MD5 48d63174d6325187fb2848f5ad4593de
SHA1 c9feaff56e68f23fd28862d37f168845f42daa02
SHA512 7aa1d57fd837863083d96c20bfb647da8e0ab357f800a76f706c14797306198b147181199f911bd7128fe6145ad65adc5e5eeb1cf18bfa4e81a0c186f2d6b162
SSDEEP 6144:Amg1kQfATCFbzQACjHFmUi21rSm8uUVNSlzYh:MneA2fi21b8j8zE
TLSH
T1C13423099EF159FA6F09105032C62E74AAD84F52CA924E8443334BE25EDF6C71B8B935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 3e9638a18044025655d50fdc516cbc53f35f6f02e3da15721945ff5600798003
MD5 48e80ad7c6d4a99ca817b78e4d31303c
SHA1 f49bf84e1f0d036393aa509d9a8e51ee31a5f4cc
SHA512 168638238926024ed9b97f3589ae90143d04c29233d8665457b501e3cc9e8795acae45c1570659f3b31e0b89d4cc3e8466c7cee62efb31b3f232755097621f60
SSDEEP 6144:k7mg1kQfATCFbzQACjHFmUi21rSm8uUVNSlzYh:0neA2fi21b8j8zE
TLSH
T1D73423299EF158F66F06109032C62F64AED94F57CF528E4443335BA25DDF6871B8BD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 f7eac3721c8854301f62691b18870190f27160959522f38804e64a68f9181a47
MD5 3b7785f239befd9a8a5ddda3b6cd11b5
SHA1 ecddf5e0f6546ca0b4e1a54ba787b1c084e8a893
SHA512 2f5069c420828f1cd4bccd9fc7a39904b850b0a7ab57c96cddbc2469f7e899be7350c78eaa9d2766e6fc04818c112120637bebd7442e3bec94675639363abf17
SSDEEP 6144:Jmg1kQfATCFbzQACjHFmUi21rSm8uUVNSlzYh:5neA2fi21b8j8zE
TLSH
T1153423099EF159FA6F05105032C62E74AAD84F52CA924E8443334BE25EDF6C71B8BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 971d48b2038a6384c161c90d4d3992dc03224cafa48aa1b14c7fe3df9a812ffc
MD5 608d42d6bea8999dffbadd936565cd44
SHA1 ef28f5ab1b0b44d841ef898ce9aec9ba8d8f8996
SHA512 7dd234af18ebd547d6cc8bb407c54fc7248cdb24a3f290158e4168d43541caac8e8cad699bc079c58fdd4a2bc41fd6d8d886ffdfa7f442885dc4bdbd22e00aa8
SSDEEP 3072:StFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:4FmUi21rSm8uUVNSlzY/
TLSH
T13AC313007AE3E8F2EE5930447BEE2A145D6C0D818291C6415673AD419DEF3C75FAAF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 634baeaba9904a4c2fa54ff09d1e444d461f9ce68a9505ed1036a9299077e12c
MD5 0d5343f576e4bdde00b32cbb23cf42e9
SHA1 c4e37d351375e32e5e69e28cc3594c5608c3bb3d
SHA512 e5a04cf1890fe2654ffab3b9d2f000b49d5cdb780c82868e00201b8e6cc5add9df46c89cbe0c3505542a023b1be312d247c297d21cf1cb2c79879f2a2f9bb512
TLSH
T1C871615A03C240FEE7302378E5E00E013571CFAA26CBBD9952A499FE7E057A34D2D565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d07a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d07a.TMP
Size 3KB
SHA256 b266e4d8894cd83b76df6a7053367c9297f41643e4969c169ea26c4798c55fb1
MD5 79aece3ccb3bd52f3a744437c8697e66
SHA1 9ffc199a65a944fab1ff19eb943907e055e4c6c1
SHA512 9787c9319ea004e934f89eb8bb630a609b779b832462bd008ce0c1aa05c62072a6cc5826ae5cf2066d4b9ab24a939d76622725e8121ddb1e8aebe32fb0056431
TLSH
T180615F5A03C244FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7D06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d7ac6f8765cd684bdf4d213df2f528d6c4ee121316d132208d514d1893442c1d
MD5 97f78d9499f7fb2b906cd16521da6e80
SHA1 368591e22e5612fb1744e41199e87ab83020de56
SHA512 29992d90eaa9c8a2303c3b13ddc9a547fd154f53b3d8d87c5909bbca6327ce245b1d90a8c061f8a44f1ada3b32890178c84995f71167843ef94bb68bf3f42d90
SSDEEP 192:Dn1AqP0PePJJPEP9POPbPmePbPi1RId65RJw7PfIP/GP6PjP2Pj0PrPYP2gPlPMZ:Dn1AqP0PeP3PEP9POPbPXPbPi1RId65V
TLSH
T117024AB3D3E4876D9D1152F8AA147F1ECE1E1924432C3C39CAD5AF0BA7E2871E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e1b6b542e2e912cc05d60028671b56fb3b3eeac67e38424f57f764a7668f01d
MD5 86c773b115e5ccf74cd0ab4292b56cec
SHA1 dc8dd9f2bbac36a76bc8ffc517a938f6d95a656a
SHA512 7364284bb83ea2f99b31afbd61a9058c940f9f53ddfa99672a73abff4ca55013d5179f9b85d0f5c23fa2a5c25f275134cdec930682d7359d10eb7134ebfb7f11
SSDEEP 192:sxZmRMyM/jK1Ml8MkA/fDsg6OG+Idp9n8HW6+WNxvl/YwrA7DIgrJ:sxZmKMA/fDsgvGvCHb3/S9
TLSH
T1A742E9126A34997BCCDBD209FA55BB53D6F5447292940E84ADFCCA0C05E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9468db1cf6a1cf4f2067b8a6fd24397eba18c30f0709bdfda266d2cd28b1b8a6
MD5 4b99356628da739c01aee1156a04b2c0
SHA1 ea78c99efbfb71af901831dca14b1a57589214f4
SHA512 4980aeee16ff83627a1d95167fa8fa84515dd9872926d2d96236ee5ba0530ba4329b3a7d47b4a952518a45d7aa6f20f4ca3973ba1f8354a182029a1876f6ca11
SSDEEP 192:sxZmRMyM/jK1Ml8uckA/fDsPWpVS6OGWIdp9n8HW6+WNn4yrLKyN5/svl/YI1Pic:sxZmKjA/fDsPWvSvGXCHbnZP7m/sq
TLSH
T15E62EA12A63499BBCDDBD208FA55BB67D6F9146292900E449DFCCA0C01E7BED2203C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ede7eb44b111bc09461d7e67b5b13a491949b5fa6bf0cb54dd3670492d339497
MD5 e96b7a5afd87b2937c0bfcd6f703b008
SHA1 58251cfe4ce3fdb6e22298ca28e1fd688b291769
SHA512 5e0f0efe0d2f0fd7e79b2ad47fa909c2f9bb83a888deaf8c7f57ed596b638ba4909000107b6e8efff6e594751bac8c7901f9fd2b45ac68c4ff51f2d0f986d8cd
SSDEEP 768:S74jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dRrohSchaz:S74jeXmWvmKLEu1jacPLZQdq3e
TLSH
T18AD2093B284CCF7E4F844E5CED26AE976ED801CB6A584D4447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f7abfdd00e4934ceb67a3366ac461c96a1d79bb53ba184e857582edd50bca37b
MD5 fdca99b4f0d8bca1c4f497c507921635
SHA1 bb8721793b09c8b97e03a0b6a42dc62fe2626ce3
SHA512 4dd18718f1884bc68c3ea71d976f4365efe9559c708e04e258591b38aff0204ff2c5164f913318424e32d5c7cc493db6000305d5871b2c6cd93adad3d4d07461
SSDEEP 96:K8mQKjiWe9eKmwC2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHv4dZvta:uLFl2r6WwYYZo9m22Lgkte2VUGfHv4dG
TLSH
T17991140170B756012C7E2A0D9555862ADDC2F2933928796B7BEC04721E2BE51CEFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1a97c7fa3aff920cd22e2df7498c1dec1b010e16cd87e898b0230f98035c9b1a
MD5 f3fcaa9351ffb597ec9d15bac1ece1f3
SHA1 8fa501c2e171fb13bc3daa018e15d6c35432d592
SHA512 425fecd4b7579bf2994fe1955649fb235d89c904492ecbf125f19b257e2582330cdc47b9a29c8b4e115513fb3a7ddb437c3aa5622179130468adf9c5e0b20c94
SSDEEP 384:h7tNn/s3n9SfsNbysrfcA2432f+g8GYZX4+2fFFKOObjI9G6w7Ook:Jj+9UM3mU4l3K29Mbk
TLSH
T1E5928D32A8289CB78DD29655F04B36278FF8552B97C52F84E6EC6F0C05CB6AC530A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a4e3a1da972530c2211dbaca139764ad645d43cdf2fbfe43de9e2570c92fd788
MD5 ddd1a5f46c39147406a57339792ac50f
SHA1 5cf65d587a7c7736604a21000f927514d34dfcd9
SHA512 3f1ea87042169ae6c80b8054541caf0853cde96d943c11ca96fa1c60da5fff2c09463629c04d30776fb0e2621ffc1e96494c41e8d7ae6fb6f96a0446690f587c
SSDEEP 384:hFtNn/s3n9SfsN9ysrfcA832f+g8GYZX4+2fFFG/ASt0nvsAQm96MGHOObjI9G6x:/j+9Up3mU4l3LSTAQm9hu29Mbk
TLSH
T130C26B31D8685DE785D1DAC9B50BE5272EF8023B86881E0CE6F97B39308F9FC5312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e740a548c9760d13335b7434b24a52a7a87ac0e62de0139552ec1255eae5941c
MD5 cb547668b71d4f62892b16be45d41a42
SHA1 febab7b102b0e0718b4d585869feb030c2280389
SHA512 d755975254add0e955df4a8f01d34ea30e84165f9b697ae756c49df15baa09db1b8c0c20e37ea56c51e1bde36692df2b8bb2129442a1b2e11a10a2b687ee35f9
SSDEEP 192:+ON+6hZjQmiUy0Hic/+jVWjzorGYZX4+2f/5cOqgqK1U6:+ON+6BZiu+g8GYZX4+2fy9KU6
TLSH
T18612E936A868AC7B9DE2E641F04736235EE55117AEC57F84D6EC1F1C01DF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37b02641ebe206e2a70e416a6b8b7d68ed38ed01d55e20549a24553a24c17e15
MD5 7eceba8cfa5cc14557b6e5c55c9b1a28
SHA1 129daa037dbf2ee8a538e8583ef30b615536e16a
SHA512 bafad2e6b36bb54c4a34e4eafdb8db255133a479230dd9f8aed193cf6ac49d802c311281b1d72ebc2225b4d13bdf44009f66f35fedec2f29556cd8631896c28c
SSDEEP 192:EONl6hZ0QmiUyxHpc/+jVWjzorGYW5wOZqlnU6:EONl6oypu+g8GYV2knU6
TLSH
T1FD02EB35A8786C779EF2AE45F48737235FE4112BAA952F84DAE81F1C00C765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c7a4c385c2fa45523dc3f639bf04e4d681b546f635e79803e538e2741fb579a1
MD5 e78cac4f157590d039725e60b4c5907f
SHA1 ccd03c96ab14a748d63ebf4a6f2375d09dcdb04a
SHA512 c24605f69b8da66e98d28de8c005f0ec0cc54ed8e4334c41ecb377344bd6cf7f3316300b92553d7613900a40f56073ae6d31b2e36662ee520901b5425729c6c2
TLSH
T1F041185CBAF91118B3B3AE1A9BF2686D847E79732F07C49D10110E4E0A22A44D971B37
MD5 SHA1 SHA512 TLSH

Submit Download