7b3394a2a2530da959e8ab1df92908264b336b37e3f3fc51dd10e72622ce49f2

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
218e2009-53e5-e364-5121-c0f2a0b501e0.eml
Size 30KB
Sample260709-prcjasbw71
SHA256 7b3394a2a2530da959e8ab1df92908264b336b37e3f3fc51dd10e72622ce49f2
MD5 c783fd1abb3de44759fe5634d4a76427
SHA1 62070b06d4750ff11196505fda4feb8bc86b60d9
SHA512 8e28fb49950fbaf2b131da07cfb91d90b36d24f9181b9c5adf443230aec569c9a6028b42c0bc6b395639e8ee110e36af3efe2a70d9a167896d216147c94190fc
SSDEEP 768:zOLKIdGlIFevXHGCNuMr8TomHfrMz61To/VtjK2dFW4:kUHrQFfrMz61To/PjK2dp
TLSH
T114D2C607B3C00802CE6F492064037B7D7F38A9C69E7A4C7064DB7B7E0B8DDA7AA85955
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3996_803851646\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3996_39083482\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3996_39083482\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	msedge.exe
5904	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280740769028564"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{BE1451AA-4465-4BA8-B322-64CD974312CA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3268	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3996	msedge.exe
3996	msedge.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3268	OUTLOOK.EXE
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE
3268	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3996	3268	OUTLOOK.EXE	104
PID 3996 wrote to memory of 4696	3996	msedge.exe	105
PID 3996 wrote to memory of 4688	3996	msedge.exe	106
PID 3996 wrote to memory of 4128	3996	msedge.exe	107
PID 3996 wrote to memory of 4128	3996	msedge.exe	107
PID 3996 wrote to memory of 4128	3996	msedge.exe	107
PID 3996 wrote to memory of 3512	3996	msedge.exe	108
PID 3996 wrote to memory of 3512	3996	msedge.exe	108
PID 3996 wrote to memory of 3536	3996	msedge.exe	115
PID 3996 wrote to memory of 3536	3996	msedge.exe	115
PID 3996 wrote to memory of 3536	3996	msedge.exe	115
PID 3996 wrote to memory of 612	3996	msedge.exe	110
PID 3996 wrote to memory of 612	3996	msedge.exe	110
PID 3996 wrote to memory of 612	3996	msedge.exe	110
PID 3996 wrote to memory of 1444	3996	msedge.exe	111
PID 3996 wrote to memory of 1444	3996	msedge.exe	111
PID 3996 wrote to memory of 1444	3996	msedge.exe	111
PID 3996 wrote to memory of 744	3996	msedge.exe	112
PID 3996 wrote to memory of 744	3996	msedge.exe	112
PID 3996 wrote to memory of 744	3996	msedge.exe	112
PID 3996 wrote to memory of 3536	3996	msedge.exe	115
PID 3996 wrote to memory of 3536	3996	msedge.exe	115
PID 3996 wrote to memory of 3248	3996	msedge.exe	116
PID 3996 wrote to memory of 3248	3996	msedge.exe	116
PID 3996 wrote to memory of 4896	3996	msedge.exe	117
PID 3996 wrote to memory of 1480	3996	msedge.exe	118
PID 3996 wrote to memory of 4896	3996	msedge.exe	117
PID 3996 wrote to memory of 1480	3996	msedge.exe	118
PID 3996 wrote to memory of 5140	3996	msedge.exe	120
PID 3996 wrote to memory of 5528	3996	msedge.exe	121
PID 3996 wrote to memory of 5528	3996	msedge.exe	121
PID 3996 wrote to memory of 5600	3996	msedge.exe	122
PID 3996 wrote to memory of 5600	3996	msedge.exe	122
PID 3996 wrote to memory of 5724	3996	msedge.exe	123
PID 3996 wrote to memory of 5724	3996	msedge.exe	123
PID 3996 wrote to memory of 5732	3996	msedge.exe	124
PID 3996 wrote to memory of 5732	3996	msedge.exe	124
PID 3996 wrote to memory of 5328	3996	msedge.exe	125
PID 3996 wrote to memory of 5328	3996	msedge.exe	125
PID 3996 wrote to memory of 5128	3996	msedge.exe	127
PID 3996 wrote to memory of 5128	3996	msedge.exe	127
PID 3996 wrote to memory of 5128	3996	msedge.exe	127
PID 3996 wrote to memory of 5632	3996	msedge.exe	129
PID 3996 wrote to memory of 5632	3996	msedge.exe	129
PID 3996 wrote to memory of 5632	3996	msedge.exe	129
PID 3996 wrote to memory of 3900	3996	msedge.exe	130
PID 3996 wrote to memory of 3900	3996	msedge.exe	130
PID 3996 wrote to memory of 3900	3996	msedge.exe	130
PID 3996 wrote to memory of 5420	3996	msedge.exe	131
PID 3996 wrote to memory of 5420	3996	msedge.exe	131
PID 3996 wrote to memory of 5420	3996	msedge.exe	131
PID 3996 wrote to memory of 5508	3996	msedge.exe	132
PID 3996 wrote to memory of 5508	3996	msedge.exe	132
PID 3996 wrote to memory of 5508	3996	msedge.exe	132
PID 3996 wrote to memory of 5960	3996	msedge.exe	133
PID 3996 wrote to memory of 5972	3996	msedge.exe	134
PID 3996 wrote to memory of 5956	3996	msedge.exe	135
PID 3996 wrote to memory of 6004	3996	msedge.exe	136
PID 3996 wrote to memory of 6004	3996	msedge.exe	136
PID 3996 wrote to memory of 6004	3996	msedge.exe	136
PID 3996 wrote to memory of 4620	3996	msedge.exe	137
PID 3996 wrote to memory of 4620	3996	msedge.exe	137
PID 3996 wrote to memory of 4620	3996	msedge.exe	137
PID 3996 wrote to memory of 6064	3996	msedge.exe	140

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\218e2009-53e5-e364-5121-c0f2a0b501e0.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.onelink.me%2F107872968%3Fpid%3Dnativeplacement%26c%3DUS_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature%26af_sub1%3DAcquisition%26af_sub2%3DUS_YMktg%26af_sub3%3D%26af_sub4%3D100002039%26af_sub5%3DC01_Email_Static_%26af_ios_store_cpp%3D0c38e4b0-a27e-40f9-a211-f4e2de32ab91%26af_android_url%3Dhttps%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.yahoo.mobile.client.android.mail%26listing%3Dsearch_organize_conquer&data=05%7C02%7Cximena.duque%40proteccion.com.co%7Ca46c0ac6420c4f54aa7508dedd1378e0%7Cf47dcce402e74d88a659a2d0bbe170e7%7C0%7C0%7C639191272905671160%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Nw58oYX2QDBOf6jiPjgcL53HnSexQyp7dInL8tMpR2o%3D&reserved=0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffcdcafc188,0x7ffcdcafc194,0x7ffcdcafc1a0
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,17250827700816987001,14630488529624917110,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,360774343695520916,9567717879986967415,262144 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,8106752526099972352,6174938281029720983,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14234800347139310277,5534528303569000635,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8584194392069368366,24381975520330054,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,880992883771341137,17089944850301251392,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,9565430476430574929,17029491367873951851,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,17355562365826343012,10416012157946283018,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6842981759870011436,14102294700303479413,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,10987350029285392983,6703662643143925863,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10161589896996782568,14984987290479471794,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8075862091316499562,1905502580428232998,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8075862091316499562,1905502580428232998,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13117573508551630058,1058329645077853391,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6881826508340752356,6040600426159192735,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1392251154152564357,889112522461533163,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,6372190866396498368,2649305953851341456,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,17383526473654071530,14156493330307994305,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6568,i,17722163330974830272,7736565985932625163,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3572,i,16290493176687560389,14690531782415110706,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3476,i,505738981108725875,7915214371853027903,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6704,i,17540430539899774950,5708664202440465438,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4472,i,12063839712270554961,4389792236298589130,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,7415763442326138640,2555729596977004664,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,3450078064440262057,5218585360948526995,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9264448866939433143,9156057418301605872,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5400,i,1626180596922793178,17316894101569084014,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6208,i,12254701491292985557,11654762957067709965,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,16268880519987001642,3891791459108049083,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5348,i,14292497445165251864,12252101588150304021,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7080,i,3548419951757735365,1542366476325435390,2097152 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,12834025457591272655,18337119231655524678,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:8
    3⤵
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,4140705499713464701,8717384824495973605,524288 --field-trial-handle=1968,i,2074801808532841906,9401135590127716310,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:8
    3⤵
    PID:6488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcded5c728,0x7ffcded5c734,0x7ffcded5c740
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13273964929016809192,14812332261354339420,262144 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,8026717812543477740,10143011116719766589,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,4455676185532641882,2694690449888811449,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,9371028965022991060,2091435908554297496,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,4845513303077379720,14605661667282143398,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,16976566113251984281,5356595653578923366,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,17633966410868617612,15491051841114698247,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5740,i,14251851350598995869,11782868358419973680,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4548,i,2171548241349987202,12284605789396378954,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5920,i,175215173297557631,15085919113488832414,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:7112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6012,i,16910566005279259234,18178625966134301953,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:6344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,422485221348529448,17794454931888646047,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:6532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5996,i,8268213196514596720,6376908937391069647,2097152 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,14672592874081550383,11566942029549920115,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,7497625791496978665,4904902282545057525,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:6384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,17407969651336441225,1762953167003775921,524288 --field-trial-handle=1876,i,12718120820004720263,17878314856191174162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3996_39083482\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3996_803851646\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2f3a6c35589ddc3d163601919ecd9551afc12407ff71ef9e30f80777f7172e44
MD5 1c1671fa55aa16fd0294af3929d118c1
SHA1 4cec27073bf6c25a5f512fe2c4c5d5a0e699f25e
SHA512 f9c32fd5b0b3b38ba6811ae6711bfe5abfa944ef96f0ad30d679b258af283e8d4f7e4bf80cf8c9e57b92b2060316a755f82964eb8cdf19e642ed9271b710052a
TLSH
T177E02BAAD9359C2B2CF9572C60405786E64013573B40994F773DC209CFB863A0146C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 374KB
SHA256 bc37fd8870a7cf3fca6bb2fe199270ae7ccf6f4754c3c09973d6876bda5bdc78
MD5 b3127ec4dabfb76810d1f2f73fe10e7f
SHA1 4a930d6efeaca1b3106f05bc34c24cee89275640
SHA512 3dbaa2586aa368089addb24ce0b4ee08755000520ba2e3933271017d5627439363615e03109f3a6159c1e54e2cd040f959f8ac13a317be4205b0bb4e4aec8f61
SSDEEP 6144:31LsTtQ91bhCfgc85F48+k1AwH5b1vrq/YC3i5YT3Ej3w8AxU09sw0QPzTvs5FUw:lLGQ91tWgczkxH5b1vChy5YT3EjdAu0O
TLSH
T1A384231B8717457320EDFF706ABDB89D78A8AC5285AD646C411BA9C422F04C3EB7D81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d70b13cac4e5e1524a8f58fb2a521ed0161c011aaba4134d01179b39b2d136ec
MD5 07047cff9ed710ca3dcd0e4c4174d25f
SHA1 8c04704656f61a9ef7f1b7ea298b9adb053525e7
SHA512 fc3ee0247bceacd7e097ad0e4533d81b6b1b1c992f09ac1844793cd33a0a4f2b7bdbb128eaeec0515e5b0271ca4dec53ae04bd76766d8c56fbc5f46da5013008
TLSH
T1754192B5337373D2EBA34430C4E98A5B7435072308676D123789A736B29E7E0A0C386E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eb9fd4f3f8a5e24a045955b4fb44a583af7ebcaab1f51951009b441729f8509d
MD5 6c41e08d741911f43d6e6d2295752bf7
SHA1 8b0c8bc2b808c52d0ba7ca0eb7052195f553b8f2
SHA512 02ef390d1ae9eba238e2f3502d29bbb8a5dc592dd20d6e2ca0fb19c53c33cd1b2333e9f82aa3635d1797afe8561cc78e388f7b32089d6b58accd5cceaf9ee223
SSDEEP 192:vRkcBz+xZ0Mv78pAPRp2i3WEt9DHsb+WNzVqp4jg0YH2Jk+9jo1F1xVyIsnAUgrK:vRkmz+AY4UX15wOL32u+9+9e
TLSH
T1D952B52BE914697B6CDBE219F9617767D3F3102265952E84EBFC8A1C14DB9CC221340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e30e673b20873a30211c33c89f10fd00f8dd440dbf369d0252523d27e272867b
MD5 0f82ee613d919eaf9117b608c99018d5
SHA1 228bb23956cc674ea65b792cfa5acec0581966bf
SHA512 b058e7844a5cdddf261995285e8348afbeea4dfac7d0dd2b33ba9fa191957672fb0fb085d0405026ae0c30f5b64c6634514b4c636732938cf6b138aa3228c25e
SSDEEP 192:vRkcBz+xZ0lv78pAPRp2ZW09DHsb+WNnqp4jg2Rk+9jo1F1xVyIsnAUgtaJ:vRkmz+AV4UXg5wkL2G+9+98
TLSH
T16142C52EB914693B6CDBD219FD617B67D3F2102225A52E84EBFC891C14E79CC322750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ee4fd34b8c62d01f48b81d356bc55cd531a937b059bc1b95e0f5606dd67d4215
MD5 0a5093956c173c1fbce57ed3bada0950
SHA1 8e98a0c3d7f5a2ed8257d9ce687990d3df29ab76
SHA512 d6cf2a2f93dc71792a637e122667d89f3c2b8eb62a4880271c09d49ce2bea44f2901de8fa0e7e734bd563f58fa4ec82f133b46e3319290d6aaff507734695f13
TLSH
T132B01200C0465910CD4081B8130B204B23908F2781200353C3D0F9B7D847CD45261310
MD5 SHA1 SHA512 TLSH

Submit Download

d4801014-f0d2-4053-95b0-accd75c95e84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4801014-f0d2-4053-95b0-accd75c95e84.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 8f530cbe6fb477aa49d12c4eb29331ba0505b1fec6cc97aad99311a12c6d818e
MD5 ab8125fb2416069d9a36933f93188164
SHA1 864ce24a9c59144e8aa5696f3714c50fa9edf00c
SHA512 ae01b8c95967c63eeb77bd0ff6c6ac337e9dc743ce6d0c93973e375f0741fa1ba253448b19a7ffa91d80775ea9c985024bf8ee2de4030f2ed8edda8ab3df4e3a
SSDEEP 6144:0TneRinYKkQTo+OYUxY9R+in1qLt4CLm7Rkm1tYpBeh2BAoc:06YYKkQtOdxe0i1iTK9oBGcAoc
TLSH
T1BB34233F9C76BD37857A635E304F7E0A08F54E738460CDB1C69C67486766F892484AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 3968e0b2bf4872d9718a5180ad5fe1cbc0a5d110245c1eb2adeb6b473b88141d
MD5 a2888e989255fb845661cd82f7c77f90
SHA1 f64455a0e663c466719db4f431b798db9e4369a2
SHA512 db18380e4ac2d205b61eba76ddc884fe499bd554dc109a0a2372fe0b46f283705ed6a7d9782ee7dbdfcdcc51ba189a32c40663c9838bbd7ac0ecc46c09e973c9
SSDEEP 6144:VTneRinYKkQTo+OYUxY9R+in1qLt4CLm7Rkm1tYpBeh2BAoc:V6YYKkQtOdxe0i1iTK9oBGcAoc
TLSH
T19334233F9C76BD37857A635E304F7E0A08F54E738460CDB1C69C67486766F892884AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0ecea38675fd9a8c17cd0a06165932bf38d51416bf450515eb748cb131cc4561
MD5 c46c9684f83cbf2ffabf8861a8c1c547
SHA1 6e5307fae4120306c9690cb07afc2b116192a8cc
SHA512 f9afdcd2c0087846a7e3e13885982baf485cd4707f5da75dffeccfaf7d3374ba26e8ae2eb44250febd379c4d8c83e14334c2a8487d705220c0d6475b50face4c
SSDEEP 3072:XGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Wm7Rkm1tYpBeh2BAoO
TLSH
T15CC3123B5D65E9375979A71EB48E0B1E1EF249A6C930DE42C8D46B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 78486e5e5c9f5cfe97530c042ce817d3340dd5ee36322f7c5983d3ed4b0fd1fe
MD5 004bdae973695a463b121b0e0c92e4c3
SHA1 5032b0607b45cb474a9ea6e8e31e55bbe9b95ee6
SHA512 b2a69303da0c010500f449d01e6875a28bece71987b1a4ff6621e8197301bbe7f383e7da6dcd990a4ad59450272a7cfad0a0d2413e28db3710c6e4b22a64f6c6
SSDEEP 48:Hc+5QLR8OS1fXlgu7vxlQVS5izuUdAv8zR0THY1Y7OJuWcW25k+gqYAH:8+KS1fXlgGxl2SwyUdAvd+Y7M2CFAH
TLSH
T1ABA17076EA7082F0DF19523050E317343AB6C5CDF41B1EE2039B6CB9661E33267AB146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a21c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a21c2.TMP
Size 3KB
SHA256 29e77de870d4b11c0052096d8fc7bc71e043f3cd8ee15cd3574c98b1a70918f6
MD5 7d225ba131c2cda9098e0e858d7f9fa0
SHA1 b3bb884d9b6a2b5bd42189a5ada960a7146d9997
SHA512 24746a471725fed9163df292e04cceeb00bce306b59ed07b82a227fb6bff47952d1d4c90008d5ee3440947b6914cbf23d5cd0c0859a2785dfcd81dd61b1d621d
TLSH
T1D5710936E90081F4EF15523190E3177579F7D0DCF8072EF252A728F66B28736676A28A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 811d34ab415c266a608209fcaf64e6e13ec21cbc32f00881106e73d401ada3fd
MD5 33d54c7fcf9d3f90f7360e3a0954b42b
SHA1 f1964c758443757e53425d740de3c1ace05e7047
SHA512 b32eeb6e4836c62f24b6141c1beb7249887fd8afe2e37300969ac40232f9d29bd9c69f4c4d0aeddd760d1ccd28dba9696706552dd5a4f8246257e0877f3c43a7
SSDEEP 192:DlMDtCeuJ3JhWJO9dUmHkj6Vlr0f/i1PDL5bzgos0NYrfzlsBYnCHyxUzUlJaOST:DlMDtCeWZheO9dU0kGVd0f/i1PDL5bzp
TLSH
T16812C0F783F8852D8A2652F0EA687E1FDF9D1A21832C7D798DD47E0653E2421D301A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5482bae67de7e9ef5d0d60d242fd86744baeb99ec0a917b702539110bd0cc547
MD5 ba540263f34d4204a8a8f3b81244e9fb
SHA1 c43d7f6e3c972827c050ab3aff524791c01a2118
SHA512 82f767da40601ba71b986575d61c0d5f8f5c4771c7db234d1b882e368892cc673c229929c07419eaa6dff632ff507425b22ba9a7e047c96bf3f23d696920382f
SSDEEP 192:sxZTRlyM/jK1Ml8MiA/fqsXNN/QM7yIdpAIEHW6+WNn38/YC3frg+NIg4J:sxZTzqA/fqsdZN77QHbM/vg0c
TLSH
T12C52F912AA389977CCDBD309F955BF53D6F5156292901E489EFCCA0C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 20907cf23002176423761f11afa83d0081c8f8b47c3755a87286861b54075659
MD5 66e11dc3142592d72a2aaa5b64cd8e6b
SHA1 ec047e70bd490d423d7527229848703b4dc724b8
SHA512 0e42dab8420b8faf6403de1bfa34b9e69d6d5cddbe52b0b2ea40acfc9b9232421b9c1db66071095cc58a258fc9efc3e778312fae448824b7c140dd343d3d8ecf
SSDEEP 192:sxZTRlyM/jK1Ml8MjA/fqssNN1QM7EIdpAILHW6+WNwG38/Uh+c40CwmtZrg+NIx:sxZTz7A/fqs+LN7dfHb2/EMg0E
TLSH
T1CD62E956AA384977CCDBD219F545BB53E6F9156292905E48ABFCCB0C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b3cbd73f7be293d87b5c73afa4ec4d746c77e9b83cda65a828cbf62d45c7f9d0
MD5 7c9ee2fa411efcf7a4d1d7d4ecc222d1
SHA1 a85d7befe9d9075a57b40b549303c28c26a78190
SHA512 1201e2e7d9e7a367b379f585ffc8185f3caea53744c70a86901b5756ef95a1c46c8382365d80724137eb749497e08feb6dcafe16712066f976d7cce1a0afda61
SSDEEP 768:Y58bqdz7pLuL7a+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVzZCZLlRTKVvrob:Y58bqdlE7a+WvSCt6u1jaSZCZLbWV8b
TLSH
T198F2FB3B2C0CCB7E4F804E9CED2A6F9A6DE8018B56D8C95447FA880C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a247c3aa76b7b112a66d14785dc1c74c48c54408120d533bb40aa8219f4b3f2
MD5 27cf6e922d32166142376630e3cccdb6
SHA1 a37275b73e4ccbcb8ecdc5fd1faac4ece02f71dd
SHA512 0447cce9df43c62d3f5c973fa33be2719f6716946296c83b81e51789a6bb2c72dd5de7254b8cd416487d373f5b3922efbec8b9cd7228a1cbd0a442252e68e604
SSDEEP 96:KM8QKlu2OXiKkIH3u3D3S3O3o3w3g32W3w3139g3O32K43Tg3M32c3m3u3t383uX:y/98eTieYgQxAl+eODgc1W+9M+XHbEBA
TLSH
T123A1635AB1364291387E745CA175993A8E8532633204E86F3FB911A20FA7E534CFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cb26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cb26.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f994881318f4b2e85e0b2dc4d843fd7b4db72712dd477e6d6fde9b919bc2730
MD5 023d0c690963b67088c481df4b0081e2
SHA1 dde22ce45c272233058d01ff29423ed6f504ea6b
SHA512 63f552682212e8a3853f891834f12f32c95e275f929ac28fde5c86d27fb2c5da773c1bf5bb6aa79be6d617a3bf0345decdbe9e6ddabb22f3e40c05bb313d6e48
SSDEEP 384:n2tNn/s3n9SfsNGUtON99gIuEa+mO7+JHlU2OObjI9G6w7uc:2j+9UbK6anO7oFR29Ml
TLSH
T155928D35A83D4D725CA39559F58B3A6B9FF810B789852F48E6D8DF0C04C77AC1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c6aa91e109ce8b5ef8e1ebacfe900702be0224343165d317e918ef9ecc7c65aa
MD5 794d9efbb10057cb3ff18e118b9905ca
SHA1 d851a2d39739327fed6b122d1f055bc3c1b65c65
SHA512 7053db35603fdf12308d8cece24aff28a9db320eff559e62aa610e8d0dfab709621c61fe1ad5f18dc0ffbeb43dcbc445dfc4137930accd0eac1743a1638de52c
SSDEEP 384:nAiFetNn/s3n9SzNsNL8TUNTUlIloON99KIP2aDfwxa+mO7+JHOU2OObjI9G6w7l:bFej+92ywgRI6GxanO7ouR29Ml
TLSH
T1CBD2B4F598D78936E8AE4787A77E2D569EFCC06375885984F7C85E0CCC822BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 513402bba948d1f627198d3807f2f096856c7312804777cbcbe9d5bd5098ba7d
MD5 d7fe92b5fb8cd97f9b9acd9c8b1cf274
SHA1 3d92e336c5a5ab2df074ef574d44bf62bb526f03
SHA512 0789c488b7fea6241c3b9a3792502558709ef1399c6d77bf9e1e72448c09b501c8917d2038b9862769a6960ad379ede6fec182dc3cf3cd2d8e6d1fa5f00ac433
SSDEEP 192:vON56Db6QmiUyd1HBa+jyOmM+HRgaaH1U6:vON56ueHBa+mO7+Gb1U6
TLSH
T10A02E735693C5CBB9EB26E49F88B27279F94203BD9562B94D6D81F0C00D764C234B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9af3a66a840c560571cfc23a8fd2e88030c31fbd3968c2c1dd997a2cd14f4ae
MD5 69adf52b8d6b7e520bcfcafdc1be2695
SHA1 e60e7288144b0426e2778c8d63a534ba8fb2e14c
SHA512 7428b36371ccf237d85bb73a8d62d5268426f8c6a0da1c8a69377a68cc64f111ac13f767184e38450a579eca453fd9031a5a62e21a2fe8c490ac253b9db51f9a
SSDEEP 384:n/tNn/s3n9SRsNGUoON99NIP2Ea+mO7+JHlU2OObjI9G6w7uc:/j+9mmb6lanO7oFR29Ml
TLSH
T10C928E35A83D8D725CA39559F58B3A6B9FF850B789852F48E6DCCF0C04C77AC1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad06a25ccaa380d91e71c1542542a76d5bb91a0df3ca14c2256f6c735aec5ead
MD5 7d2967c5a789a97cd2f24defbb85e76c
SHA1 c2a15ae5cf04b8b045a2e7fc111d1a76b8e77f4f
SHA512 440ffc66d4b5845f6efb518803d7a398ad7a84a7cdeb3643c5e307bc441d67b1656b2f10ad0b588fc86fb53ab41164827edeacb8c8a29358eedc7168711fc083
SSDEEP 192:fONk6DbrQmiUyR1DBa+jyOmM+JEQFahcNzPqxlyBU6:fONk6V0DBa+mO7+JHLU2U6
TLSH
T1BA12F635A83C9C775DE2A558F8C736A79E982077DC466F95E6D84F0C00C778C274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fe42c2170125e09540d57cfb34ca01c1e9defd3105b97e073545b901187b5576
MD5 9536af3f6be07c7dd27086ba9d36068e
SHA1 df61bdf7fe5ba5f1e744bc31c00d86aecb00f8b5
SHA512 645ae0e5484b96632ee2d38323f324910a9b63f25d4088ef7f52356717cbc4c683c0c02913a964f9354d735b37650d6df6e4d33cf7ac7b61e9dd1d5bd0e0d7ed
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe594368.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594368.TMP
Size 392B
SHA256 a1dc7aab2060c9dff98e47bca43a88eab71c8f800c04419542f5489f7690d5a9
MD5 3b84ac4798bb6e12ad75fdd1a3081c48
SHA1 7bb442226b54d61a182f56599d3affdd5e16f551
SHA512 e9d80bfb61bbb83e75f398948d8c0ad330e48adeb1355d8cfa329085f3e7d27b5be239d4e80cbc1881fa601ba5e3878c5643ab298d985efa51c94ae39c53769e
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d41a7f0bc1230ea8e7d1c86585124e1bea5412cde2a2193b9811813e6205a47b
MD5 2b48e15e383505a7606677e975ac13af
SHA1 ee01954c3c2eeecd5d929c5d0ae94fce7abe4b3d
SHA512 ac11577613d7443b2b1d0a204c7f836b7ade4dcd320be91d29111afb2f49c6064c39de8a21e1e3a16adcb278428fb6d2c19af3b5a452f59cac095628fb44000a
TLSH
T19B41275CBAF91158B3B7AF1AABF6A99D487EB9732E06D49D10110D4E0A22B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download

5709403a-b417-4a1d-98de-cf08c4fe490d.tmp

Path C:\Users\Admin\AppData\Local\Temp\5709403a-b417-4a1d-98de-cf08c4fe490d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

844fe2cf-149e-42a3-a027-dc9049c22075.tmp

Path C:\Users\Admin\AppData\Local\Temp\844fe2cf-149e-42a3-a027-dc9049c22075.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3996_1125551950\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c5d9f46-3e8e-4f85-85b8-9d6575f6a0cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3996_1876436567\8c5d9f46-3e8e-4f85-85b8-9d6575f6a0cd.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3268-37-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-7-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-8-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-9-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-10-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-6-0x00007FFD09FD0000-0x00007FFD0A1C5000-memory.dmp

Download

memory/3268-0-0x00007FFCCA050000-0x00007FFCCA060000-memory.dmp

Download

memory/3268-11-0x00007FFCC7FF0000-0x00007FFCC8000000-memory.dmp

Download

memory/3268-1-0x00007FFCCA050000-0x00007FFCCA060000-memory.dmp

Download

memory/3268-3-0x00007FFD0A06D000-0x00007FFD0A06E000-memory.dmp

Download

memory/3268-5-0x00007FFCCA050000-0x00007FFCCA060000-memory.dmp

Download

memory/3268-4-0x00007FFCCA050000-0x00007FFCCA060000-memory.dmp

Download

memory/3268-12-0x00007FFCC7FF0000-0x00007FFCC8000000-memory.dmp

Download

memory/3268-2-0x00007FFCCA050000-0x00007FFCCA060000-memory.dmp

Download