hxxps://cdn[.]discordapp[.]com/attachments/1527779168920797294/1531646497572126921/staffbesting_dih_6[.]rar?ex=6a6c9b75&is=6a6b49f5&hm=82567c5bd2f9720be61b2ceafda9e7da73be09dc22ccade3b325f8ffe1359285&

Analysis

user interaction
yes
max time kernel
402s
max time network
400s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1527779168920797294/1531646497572126921/staffbesting_dih_6.rar?ex=6a6c9b75&is=6a6b49f5&hm=82567c5bd2f9720be61b2ceafda9e7da73be09dc22ccade3b325f8ffe1359285&
Sample260730-v8p4lstdph

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
541	5732	chrome.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SpiritX_tools.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5012	netsh.exe
4532	netsh.exe
5316	netsh.exe
5684	netsh.exe
3768	netsh.exe
5456	netsh.exe
2892	netsh.exe
4464	netsh.exe
3836	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	winrar-x64-701.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
1352	winrar-x64-701.exe
5092	uninstall.exe
748	WinRAR.exe
5424	SpiritX_tools.exe
1792	SpiritX_tools.exe
5148	Private Bypass.exe
2560	Private Bypass.exe
4076	Private Bypass.exe
5740	Private Bypass.exe
2488	Private Bypass.exe

Loads dropped DLL 18 IoCs

pid	Process
3216	Process not Found
3216	Process not Found
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe
1792	SpiritX_tools.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinRAR.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	444	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a23629be5df7e688	5

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
5148	Private Bypass.exe
5148	Private Bypass.exe
2560	Private Bypass.exe
2560	Private Bypass.exe
4076	Private Bypass.exe
4076	Private Bypass.exe
5740	Private Bypass.exe
5740	Private Bypass.exe
2488	Private Bypass.exe
2488	Private Bypass.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240853093	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1832	cmd.exe
4344	cmd.exe
5988	cmd.exe
1120	cmd.exe
4944	cmd.exe
4184	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1C0A6506F58431728EEF303B6F7F66ADCAE775B2\Blob = 0f0000000100000020000000f00d901e1736995305c5afa99e10e40946751e4b99a76219c784f69761f681f20300000001000000140000001c0a6506f58431728eef303b6f7f66adcae775b22000000001000000710300003082036d30820255a003020102020900ab54a98ceb1f0ad2300d06092a864886f70d01010b050030163114301206035504030c0b6b6579617574682e77696e301e170d3236303733303137343532385a170d3336303733303030303030305a30163114301206035504030c0b6b6579617574682e77696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfd4ff839dfc16010d505dd65e58c1aef118c977c0f101e4750202bc8eb5c3ba6b58ced487b6b65d1efca35cd14d9952e904254d3d7282cb9385ed038171f6501246d6b5e2c6a0733a2e0dc35777fd71f60b36db95d5ed3ec89ecf1a857fc384b488baab96d2ea53c438170a2637bf8adb0efb075f6f17eb73c3adc69b6d291701e913c083891831af9b93f0434b413270d3ec2ad0e830efd8744aa1078083ed3c26e6a7848ca9217bed3afd8fad286f6dec7092d9e1b7ceee7a7ace2b6413b6fab2235a9e7c07ee2baf1b5e83e0d2b79f597c826439023916c6fcc3ad1bfd4cb864fd921d2dfdab972f4a916381fd35c99c73c9d9a18979e6e6b69e3751223b0203010001a381bd3081ba3081b70603551d110481af3081ac820b6b6579617574682e77696e820b6d6974616d6572732e696f820f7777772e6d6974616d6572732e696f820f6170692e6d6974616d6572732e696f820c6d6974616d6572732e636f6d82107777772e6d6974616d6572732e636f6d82106170692e6d6974616d6572732e636f6d820b6d6974616d6572732e6363820876656c6c6f2e6363820c7777772e76656c6c6f2e6363820c6170692e76656c6c6f2e636382097a7a6e696f2e636f6d300d06092a864886f70d01010b05000382010100324cc71d777e1a6fa5d0561ced55e8850b98143f7db9011df938233c673cf5788374bbeaba375e72d4c83cfee0c480e61513193690be2e7e631a9f2fdec0c3f5c7a392f761ada1b32384de4d34c4f1189023d35afab6045675e52f64bd4c8aa2e67fc1e7ebc8bf91dccbddd561645106e7e23dc4a2fa345a1ffae50c9d055897c4fb87151d3f70083e39a1c2ca4a0b6003cf6acdb40f666e8424de12c562df239da3ced542e8b90023f5458b7eb2040036e422eaacaf177ad56168e7a4db46d436d4ac73f6da1bd59e5d7cc882f43eb6ee45de704859df11122538f0af09dec970b844b0e124af3796f612f7380928a8e9539ceba92ccf9e2e57b133f089b9de	rundll32.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1120	cmd.exe
5516	NETSTAT.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe
5732	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5516	NETSTAT.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299067993561212"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1C0A6506F58431728EEF303B6F7F66ADCAE775B2	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C0A6506F58431728EEF303B6F7F66ADCAE775B2	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C0A6506F58431728EEF303B6F7F66ADCAE775B2\Blob = 04000000010000001000000048d902579ee729ef95d1f9760a2ecf580f0000000100000020000000f00d901e1736995305c5afa99e10e40946751e4b99a76219c784f69761f681f2140000000100000014000000567f041d4d535bf7dbb5f43b9fea9884bd6de69519000000010000001000000050e51249e3d6f416f50c53f02a57f5545c0000000100000004000000000800000300000001000000140000001c0a6506f58431728eef303b6f7f66adcae775b22000000001000000710300003082036d30820255a003020102020900ab54a98ceb1f0ad2300d06092a864886f70d01010b050030163114301206035504030c0b6b6579617574682e77696e301e170d3236303733303137343532385a170d3336303733303030303030305a30163114301206035504030c0b6b6579617574682e77696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfd4ff839dfc16010d505dd65e58c1aef118c977c0f101e4750202bc8eb5c3ba6b58ced487b6b65d1efca35cd14d9952e904254d3d7282cb9385ed038171f6501246d6b5e2c6a0733a2e0dc35777fd71f60b36db95d5ed3ec89ecf1a857fc384b488baab96d2ea53c438170a2637bf8adb0efb075f6f17eb73c3adc69b6d291701e913c083891831af9b93f0434b413270d3ec2ad0e830efd8744aa1078083ed3c26e6a7848ca9217bed3afd8fad286f6dec7092d9e1b7ceee7a7ace2b6413b6fab2235a9e7c07ee2baf1b5e83e0d2b79f597c826439023916c6fcc3ad1bfd4cb864fd921d2dfdab972f4a916381fd35c99c73c9d9a18979e6e6b69e3751223b0203010001a381bd3081ba3081b70603551d110481af3081ac820b6b6579617574682e77696e820b6d6974616d6572732e696f820f7777772e6d6974616d6572732e696f820f6170692e6d6974616d6572732e696f820c6d6974616d6572732e636f6d82107777772e6d6974616d6572732e636f6d82106170692e6d6974616d6572732e636f6d820b6d6974616d6572732e6363820876656c6c6f2e6363820c7777772e76656c6c6f2e6363820c6170692e76656c6c6f2e636382097a7a6e696f2e636f6d300d06092a864886f70d01010b05000382010100324cc71d777e1a6fa5d0561ced55e8850b98143f7db9011df938233c673cf5788374bbeaba375e72d4c83cfee0c480e61513193690be2e7e631a9f2fdec0c3f5c7a392f761ada1b32384de4d34c4f1189023d35afab6045675e52f64bd4c8aa2e67fc1e7ebc8bf91dccbddd561645106e7e23dc4a2fa345a1ffae50c9d055897c4fb87151d3f70083e39a1c2ca4a0b6003cf6acdb40f666e8424de12c562df239da3ced542e8b90023f5458b7eb2040036e422eaacaf177ad56168e7a4db46d436d4ac73f6da1bd59e5d7cc882f43eb6ee45de704859df11122538f0af09dec970b844b0e124af3796f612f7380928a8e9539ceba92ccf9e2e57b133f089b9de	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
676	chrome.exe
676	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
748	WinRAR.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
5324	msedge.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
732	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1532	OpenWith.exe
1532	OpenWith.exe
1532	OpenWith.exe
1532	OpenWith.exe
1532	OpenWith.exe
1352	winrar-x64-701.exe
1352	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 1480	5324	msedge.exe	86
PID 5324 wrote to memory of 4228	5324	msedge.exe	87
PID 5324 wrote to memory of 4084	5324	msedge.exe	88
PID 5324 wrote to memory of 4084	5324	msedge.exe	88
PID 5324 wrote to memory of 4084	5324	msedge.exe	88
PID 5324 wrote to memory of 3144	5324	msedge.exe	90
PID 5324 wrote to memory of 3144	5324	msedge.exe	90
PID 5324 wrote to memory of 4704	5324	msedge.exe	91
PID 5324 wrote to memory of 4704	5324	msedge.exe	91
PID 5324 wrote to memory of 1704	5324	msedge.exe	92
PID 5324 wrote to memory of 4704	5324	msedge.exe	91
PID 5324 wrote to memory of 1704	5324	msedge.exe	92
PID 5324 wrote to memory of 1704	5324	msedge.exe	92
PID 5324 wrote to memory of 2696	5324	msedge.exe	93
PID 5324 wrote to memory of 2696	5324	msedge.exe	93
PID 5324 wrote to memory of 2696	5324	msedge.exe	93
PID 5324 wrote to memory of 5544	5324	msedge.exe	94
PID 5324 wrote to memory of 5544	5324	msedge.exe	94
PID 5324 wrote to memory of 5544	5324	msedge.exe	94
PID 5324 wrote to memory of 3152	5324	msedge.exe	96
PID 5324 wrote to memory of 3656	5324	msedge.exe	97
PID 5324 wrote to memory of 3152	5324	msedge.exe	96
PID 5324 wrote to memory of 3656	5324	msedge.exe	97
PID 5324 wrote to memory of 2256	5324	msedge.exe	98
PID 5324 wrote to memory of 432	5324	msedge.exe	99
PID 5324 wrote to memory of 2256	5324	msedge.exe	98
PID 5324 wrote to memory of 432	5324	msedge.exe	99
PID 5324 wrote to memory of 432	5324	msedge.exe	99
PID 5324 wrote to memory of 4928	5324	msedge.exe	102
PID 5324 wrote to memory of 5756	5324	msedge.exe	103
PID 5324 wrote to memory of 4832	5324	msedge.exe	106
PID 5324 wrote to memory of 4832	5324	msedge.exe	106
PID 5324 wrote to memory of 4832	5324	msedge.exe	106
PID 5324 wrote to memory of 3768	5324	msedge.exe	107
PID 5324 wrote to memory of 3768	5324	msedge.exe	107
PID 5324 wrote to memory of 2132	5324	msedge.exe	108
PID 5324 wrote to memory of 2132	5324	msedge.exe	108
PID 5324 wrote to memory of 2132	5324	msedge.exe	108
PID 5324 wrote to memory of 1964	5324	msedge.exe	109
PID 5324 wrote to memory of 1964	5324	msedge.exe	109
PID 5324 wrote to memory of 1964	5324	msedge.exe	109
PID 5324 wrote to memory of 5836	5324	msedge.exe	110
PID 5324 wrote to memory of 5836	5324	msedge.exe	110
PID 5324 wrote to memory of 5836	5324	msedge.exe	110
PID 5324 wrote to memory of 4052	5324	msedge.exe	111
PID 5324 wrote to memory of 4052	5324	msedge.exe	111
PID 5324 wrote to memory of 4052	5324	msedge.exe	111
PID 5324 wrote to memory of 2224	5324	msedge.exe	114
PID 5324 wrote to memory of 3440	5324	msedge.exe	115
PID 5324 wrote to memory of 416	5324	msedge.exe	116
PID 5324 wrote to memory of 2084	5324	msedge.exe	123
PID 5324 wrote to memory of 2084	5324	msedge.exe	123
PID 5324 wrote to memory of 2084	5324	msedge.exe	123
PID 5324 wrote to memory of 2876	5324	msedge.exe	124
PID 5324 wrote to memory of 2876	5324	msedge.exe	124
PID 5324 wrote to memory of 2876	5324	msedge.exe	124
PID 5324 wrote to memory of 5136	5324	msedge.exe	125
PID 5324 wrote to memory of 5136	5324	msedge.exe	125
PID 5324 wrote to memory of 5136	5324	msedge.exe	125
PID 5324 wrote to memory of 5144	5324	msedge.exe	126
PID 5324 wrote to memory of 5144	5324	msedge.exe	126
PID 5324 wrote to memory of 5144	5324	msedge.exe	126
PID 5324 wrote to memory of 3328	5324	msedge.exe	127
PID 5324 wrote to memory of 3328	5324	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1527779168920797294/1531646497572126921/staffbesting_dih_6.rar?ex=6a6c9b75&is=6a6b49f5&hm=82567c5bd2f9720be61b2ceafda9e7da73be09dc22ccade3b325f8ffe1359285&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2752289189809229012,8369931950779355013,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11206420385745054804,13168181037142231478,262144 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12727092603308457318,16842229101896583075,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8877605283683875946,7681454468699851720,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,787837003226831748,17799704820952753253,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16948782118239630305,17210550959862551340,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,13220752128215030026,10569775539028967970,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11532912665246027181,8626685989633838830,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4684950433650503088,880318963574760086,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,16213069592676228654,5957947853468134073,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,1209930575591323672,17692456795452411595,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3536768404906724889,18225308291206710540,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3536768404906724889,18225308291206710540,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,14126500472537331671,16738529850970167581,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4216,i,6582671754571186826,2700060239213963072,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,12905061106376285923,16361685199359017163,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4240,i,13996871424170759484,11073216181169476315,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7148,i,13114316887525783110,15776841499038695143,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7376,i,11685789421168649330,17522184597727256539,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7524,i,11249754378293632797,1814864506519518074,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7680,i,12955345531188436572,13653725165601228926,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,13219337372164233628,15355899614483664853,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,3114867130070166538,12722329190276234587,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5868,i,17730365500406160728,3299446404446756163,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7292,i,12304942049222649954,7850914795396369364,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6388,i,10823734604257544771,13466979845536699388,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3980,i,12063643713979311185,11203291945480489099,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5872,i,6867407765642263822,8860692717307019248,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2912,i,4053147387806295780,12772099276325497078,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7848,i,5018846018535886323,1055216509513836089,2097152 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,2818887720832189341,17102993547576083648,524288 --field-trial-handle=2284,i,8406578978486169490,11019313805945515795,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2f3dc728,0x7ffb2f3dc734,0x7ffb2f3dc740
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,16903999342535924660,14763622783731245049,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1214269190344261304,11745236052003828958,262144 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,3467448525998194150,18367878688160442227,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,12327653427246060381,10208993168726785770,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,13960127358780237013,10974188490833925892,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,16232405322678657129,5430166408390883599,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4536,i,6225569442421472889,11234926833092817057,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5448,i,3662287794638015127,13444100791740408618,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,1505766100689647047,14764953806432370871,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6184,i,10201167826630511578,10562261414938303277,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6328,i,7831465326063831995,18322164564928677244,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3368,i,6520693292148544922,17839587635389634665,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3388,i,15670378281517126598,3143844716358254579,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6252,i,3413359903325157918,1031946303825140728,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4604,i,15931156751303524582,11998819708730333553,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3288,i,3009243701239846705,17090706510184564998,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12078172079634358459,14017558269912237499,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,13821006230866104392,11352097712518421700,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,8371401804387666657,13260468122200302024,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3260,i,13691730118298824961,6753645327667837478,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4364,i,3829096450245448733,12609761778860712734,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4376,i,11254405048166138302,14105791387688714614,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4800,i,15518441339868993141,15550354268425926064,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4384,i,10769030644726584235,15422421270417317991,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5548,i,12842463470694388594,12676150392149720922,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5508,i,2818092769131618364,9193483008821141797,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6092,i,17986977701843405238,1091951840302393002,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6712,i,4752928029635658690,6207230392389621487,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4404,i,10466803374977730097,13247685024148991280,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5512,i,11095555293577154706,11666887163090181084,262144 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6152,i,8595794286420299896,163795157952333441,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5968,i,3134959235144987866,9931795795400416591,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4256,i,8857402707596940126,577278310269400127,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5924,i,642627825006568834,14147901550560588627,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4668,i,10997542891875155402,16051884013728835012,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6548,i,17437213153929314920,10355398932837280327,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3240,i,16625624010204490392,501150755789967554,2097152 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,16684274587633318250,11013533186912331275,524288 --field-trial-handle=2132,i,2112499722641791302,13192263428055105435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2084
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1352
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:5092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5872

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\staffbesting dih 6.rar"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:748
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=748.2156.13708108021495278917
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x154,0x158,0x7ffb2fa6b078,0x7ffb2fa6b084,0x7ffb2fa6b090
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1764,i,14259712167104697005,11990553263748104896,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:2
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1400,i,14259712167104697005,11990553263748104896,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2412,i,14259712167104697005,11990553263748104896,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,14259712167104697005,11990553263748104896,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:1336

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\staffbesting dih 6\How To Use.txt
1⤵
PID:5080

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\staffbesting dih 6\steps.txt
1⤵
PID:5504

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\staffbesting dih 6\Kılavuz.txt
1⤵
PID:5804

C:\Users\Admin\Desktop\staffbesting dih 6\SpiritX_tools.exe
"C:\Users\Admin\Desktop\staffbesting dih 6\SpiritX_tools.exe"
1⤵
- Executes dropped EXE
PID:5424
- C:\Users\Admin\Desktop\staffbesting dih 6\SpiritX_tools.exe
  "C:\Users\Admin\Desktop\staffbesting dih 6\SpiritX_tools.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title SpiritX Crack - gift from xtrex
    3⤵
    - Executes a command shell one-liner
    PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "certutil -addstore Root "C:\Users\Admin\Desktop\staffbesting dih 6\server.crt""
    3⤵
    - Executes a command shell one-liner
    PID:5988
  - - C:\Windows\system32\certutil.exe
      certutil -addstore Root "C:\Users\Admin\Desktop\staffbesting dih 6\server.crt"
      4⤵
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netstat -ano | findstr ":443 ""
    3⤵
    - Executes a command shell one-liner
    - System Network Connections Discovery
    PID:1120
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5516
  - - C:\Windows\system32\findstr.exe
      findstr ":443 "
      4⤵
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe""
    3⤵
    - Executes a command shell one-liner
    PID:4944
  - - C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe
      "C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5148

C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe
"C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\staffbesting dih 6\yonetici calistir sonra loaderi aç.bat"
1⤵
- Executes a command shell one-liner
PID:4184
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5012
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4532
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3768
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5456
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2892
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5316
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5684
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4464
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall set rule all new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3836

C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe
"C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4076

C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe
"C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5740

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Desktop\staffbesting dih 6\server.crt
1⤵
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3448

C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe
"C:\Users\Admin\Desktop\staffbesting dih 6\Private Bypass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 477KB
SHA256 f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c
MD5 4783f1a5f0bba7a6a40cb74bc8c41217
SHA1 a22b9dc8074296841a5a78ea41f0e2270f7b7ad7
SHA512 463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e
SSDEEP 12288:9Z5zraThq5dDnHEJt1kXm+wBhvBJ/+5IISY1A9h:9Z5n2hsdDnkGXm9Bhvn/+r1+h
TLSH
T1EEA4AE59A79409F8E8B7D23DC8A24607D6B23C558B31C38F03A6165B1F33691DF3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b5b24583bb877b8bafca87334de82ac9815cafd887bb73708de4857fd321de8f
MD5 dba14a16751c1d7c36aec4034b7020c1
SHA1 3f16ac1be3d1937c557933e952f140cfd1be73ce
SHA512 ad38e190a7b8115de0cba1f92f9d001ef9a2833815e447a2dd51686114a4c148930b4b3ec251948473b28519f43e07afede741fc84c98b76f46f5dcd8ce3f7db
TLSH
T1C4E022AAC921AD3F0CFD0729245D0746E754231B2B40896F3A3D960D8FB9A370A86C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 68KB
SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
MD5 2a1e87320b14aac1134938a0c0bade85
SHA1 3831900aec52ad0da761f20a4fa1069d6434a6fe
SHA512 000744a8dbbc14690245ac7924c7662544bee356b4973075f5e78726fe0848e6aa96b6cf327718217ede7cde98d7874a2a4c934d1c864203a6015df18fac2d68
SSDEEP 1536:6fWZ83jSNyAUf76Z+AGYguWv0KxwhneG/7Qe4rxzhRelJ1Z6EUR+r1:6eK3jS3X9GjuW8KxwhneG/0jJelJX6ET
TLSH
T18C63029CFFA35BB52865C41E9C69A33E48E3E296C97B9721133B01F502116C2E0F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 77KB
SHA256 8bf95f75b5dafcbc25d47394bb2db50451b8faec198fda6e92f55057f75b8091
MD5 35e55c5758f0724d13ce88a15d83eda5
SHA1 4b751e99d938d362e485e45cb11a160a9a382115
SHA512 4c13a39fd25ad9a81341071c50f40f82e7d548491916f228542168300116481e42dbefcabf8bba5ad28935431670cbe36e3af4a62d1d620aa335154de1b2e62b
SSDEEP 1536:NP2s5MBjhn81B1qwOD9hM0RpEyrHxwB+9lJe3dAbx76785:N95+h81BUwORKsRwsJAdpo
TLSH
T1DC7312223BAD256FE9FDEB9761EC0CB4445919AC6A98CF41E0CD89D0826359FBCF1111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 4f33bd501357338c4083dd582dcc46355f85622b93ea5585a8bf06b70563780b
MD5 60d9307af4367c917bc2c0cae89cd071
SHA1 aef437a9e4620b3a04a40828ad93f570249258fd
SHA512 22b692e10d3a69007947955b10d999870b710c2d8d7af404b61f322f0fdb0b0d1135c8bef96b9050f6bb0e16eb654e023f9815ed2b7ac7beb9c558cf3cd71e68
TLSH
T16341C52A3DE39020DB8B9FFEA4D068C0BFB9FA571A236CCD004A11F084B77748449348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 659b52b6e760337b19aa45cfb75b1c3758e91844bbc65f88bdba09addaca5ffc
MD5 fb2738ffe2184eec7ca4987b393f6737
SHA1 b5fa8669ea05052786bab1b0db57f352d085ffc5
SHA512 482f120a207f6ae0a9ebda2e4427adef064fc8ce6cef678ddae8de84f7009c6d5b8b25343b6914f87571bd69f125a846c2a8d58d893c55fbe8d2ed222c07ba40
TLSH
T1AF61866D3CE78820DB9A5BFD60CC9AC07BB9F91655136DCE00CA14F2A4BB7715189398
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3a5e2c939c76bf1b8f743e0db3c5cd0ed9a04e88664705e262b9a2453ef16ac8
MD5 1f0bc4b6aa73f3a5fe293b77d5127098
SHA1 d2b896ab0511f1d5ca22e70a23224b452a8c51b1
SHA512 6dde983690fef131a5496a057e1bbb9dc87dc7b54e7a4ef57d8e43dce970408f67990440c4ea9d50dd79ad893dcb843f8d77ef94955547228c2569c62f7fe20d
SSDEEP 192:Did3Nu/oesT0UegxhZDfJ1RaIf5O94jJRHHcgML172VCnW7TaPaovifP/NPCE:Did3Nu/oesT0UegxhZDfJ1RaIf5O94jF
TLSH
T1E9128AF7C3D8962DC91152F8EB256E1FCE291A14432C3C26C8D8AE1B93E2472E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ac60e5c40423bfc8bcd67b2422917cdfe0febb8b42acbb9ff2c8ecc9a82ba03
MD5 7b5934e28cff570939fc7dadd01c354e
SHA1 49b096c4272db5e00164e31fa06abea48f3561c6
SHA512 05a6ed41ec9da60c0549cba7bb795eaf581c93f548829c1326833660d597380e1371b587875e5599f18d2def19e3b84e5a1300fe2c362c9fa5a058e9084ea06a
TLSH
T11D4147B7C6D8CA6D890156E4A7152E2FCE690E24532C3C5788D8BF4F53E2971E20158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e5135f87770898be47686080a41c962a4d52cc1f2898cd71244335701d4d79d6
MD5 0511c9e0b222ce5ea67a58b4168fb6de
SHA1 d7f5308ac83a08f77f02d25514cef42860d4f74b
SHA512 db49006b388bd0293d66ba50702b4cc623f9cc4558d27cfcc929426f9343abc7244e2bcb2db37dcae02b1e0efdd52e947f1a27ca10561247db32969764bbfa9c
SSDEEP 192:Did3Nu/oesT0UegJaIf5O94Texx2VL1QtVDMNPszK:Did3Nu/oesT0UegJaIf5O94TexxgL1QS
TLSH
T18AE18AF7C3D8862DC91192F8EB156E1FCE2D0A14832C3C66C8D4AE5B93E2471E25579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c8213e0dc5ec1e08441aa651b554967ad8a18de5bc8fd0c75ef405e6f6b1381f
MD5 e56d73356292eca0458a34bb06629d8d
SHA1 8b637a7a8876cbb09832e793e60ff888e521e477
SHA512 e3641f47a3ff7535bcde33e4aeff820c7d5b92620952a9d2f3f326c0142cb22b9f912225f37736ab4c38bc5a3da0383e53d4b8998a87cb188eb211a7d8a1312a
TLSH
T1C14147B7C6D8CA6D890156E4A6152E2FCE690E24532C3C5788D8BF4F53E2971E20158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 d8b424c98ab037033e97aebd25dc4a9aa85c778a0d56cc143d36db4d1bee554c
MD5 db1ec9da619c45ec7d87cb997c84a013
SHA1 057a3ad284ffc28c034e77b1a259dffe396260f1
SHA512 43344c22de71c457371d0c216add517540fad5e743304ae1a9fec4e0fdadfd5f988688b399ac310578829f2f4b9b818599ffffed321542164053e2eef146db29
SSDEEP 384:Did3Nu/oesT0UegxhZDfJ1JeL1LRM02XaIf5O94jJRHHiMR7gCnW7TaCoafXNhaf:iPBWduZb
TLSH
T1CA72ADF7C3E8C66DC96256F5AB142E1BCD5D0A18432C3C66C8E5FE4BA3E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3538da66e333596b8846c587a1affec5eeff9ba214ae6d3b2bec38ad246f7493
MD5 266c2df96b8ec6f64e0ad9375ba1c79d
SHA1 a4572dfc5c6256b3d473b32eda8e5b51a25321f7
SHA512 51aeb29292cad99e452fe74e2460c5dd94b6239f788ff5306a67e144bd93daedcaf9b82b09c901c094b44dd6af278ab7e037ee0fab93bcc9bc73409a9de98e27
TLSH
T117418BA395BF7457217948BF1E49BC05197AB43542926CF4EEAAC1ACB0818F70707422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7c9330a7044c613ed91620c3d8602ebcd8be3ed0e787e37068ef0e483c4a5b6b
MD5 c5b1d7198dc6df0f9869f67ee82988b9
SHA1 45039bff5b616ee55cf2ad46624e0257f5e20fee
SHA512 e18dbc667b70d2544ec9042e272df8d2e08ef895726ec3043bc51ceb02c7f3153bb21ae4146f1d29dc18c19f673821fb16db48c2292691916cb77a1dc84ba07e
SSDEEP 192:7R6cBzIPvyKROKiyv72ymwAPRp2Bcd51Pc95Hsb+WNAnhSimbsWL+UVTa/2Gne4u:7R6mzIH1QBXI7w97bdvQ2e2DlB0e
TLSH
T15362B42FA920657B6CEBC216F9227766E7F2106A69D01D84EAFC8E1C14E75CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3b00c1cd07d76b4e6d83ec879eaab8d968aae6a44d82a2b5e74891661eb7fb02
MD5 db7418f3d23887c374295424502cbc1e
SHA1 7efced458ec5dd2b92697eadd7b99acb64b16ab8
SHA512 b2f4ea401630ec3a892cc873d1b335d5c38f6d25122b2b072273810d115f7f7461cfd675048f220234a5ab6243b58c0c343c1224670a7e19079d7323a179a074
SSDEEP 192:7R6cBzIPvyKRONqv72ymwhPRpuBcd51Pe95Hsb+WNAnhSimbsWL+UVTa/2ine42p:7R6mzIgmQKXK7w97bdvQ2K2DlBge
TLSH
T16362B62FA920657B6CEBC225F812BB66E3F6106676901D84EAFC8E1C14E75CD3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee0b8762a8acef8fd6ffa7fe85b68cc5614fa68c9012e18bf3c1dfbebe24cec7
MD5 21725e01c89f8303b6b7bce96fbea7c6
SHA1 62c4025f8caa85b6d2c4c20f548766eccccc72f6
SHA512 09e2e441571ae0005517126108ab7c23bc1b7b72b6764bb24f7c6f03adf0522000f5d939097e16c3b5f3486789783ff86a3a4455ceed1c9cd1c21e12c8fab71a
SSDEEP 192:kR6IPvyKROlUv72ympAPRp2BMJ95Hsb+WNnfANWL2Nne42DlBzVyIsnAUgtaJ:kR6IMQQUXb7wYW232DlBV8
TLSH
T14152D72FAA20657B6CDBC219F9227B67E7F2102675941D84EAFC8A1C14E75CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 4c27e2c6ca46221aa30f6ac8e7c94456b4c3d3966cb9114bfa3e6e7f101d3281
MD5 b288395fcfd16c2b7742cfe51cdd71a2
SHA1 2dca5f58567ba20cf957e713970de7c6fd8cbfc5
SHA512 e943018a1ab08363ea8a9f10a6459fcc21376746771cc7cf99ddedcca0401563e18d09e189469ce24935f3d34040d9ce59bdfeb898915e7727ffea499d701dcc
SSDEEP 192:7R6cBzIPvyKROzsv72ymwhPRpuBcH5ce95Hsb+WNAnHGrRNWL+Kwza/2ane42Dl/:7R6mzI+4QKXz7w7WIw2i2DlBge
TLSH
T19062B56FA920257B9DEBC226F811BB66E3F2106666901D84EAFD8F1C14E76CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9cd07c6cd20b04af7334ce7e1a97fd56a91e6acad85df95300789112f75ba540
MD5 9e18f8659cd6e555ec11983037bcaeb9
SHA1 a645c5272c0c8d322e14fb77fd535c11ec6424f8
SHA512 d66c4d622033012c7e00f29c02eed49f3b5856368f4f49e0059d9a201dfa99a1f6d64f281fc39adcd467633c924b321a6f604c7594acd9c8b9616ecdb7ad2e11
SSDEEP 192:7R6cBzIPvyKROKUv72ymwAPRp2Bcd51y95Hsb+WNANSimbsWL+UV2vne42DlBzVY:7R6mzIHQQBX+7wB7bdv2l2DlBV8
TLSH
T1CC52C42FA920657B6CEBC226F9227767E7F2102679941D84EAFC8A1C04E75CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 7ac17bad120a81008c5dcded4cd412608e5ca9bbe1781857a89c5d1dcf8ac7fe
MD5 637603ddf16c9d72668eb4b47384bc63
SHA1 28f41386abe4aca0a7e36ad2c979791e095b253a
SHA512 1615f8096770e1344ff2fda5effbc805dc61c6c24bb57f8b1992201e093f629ba77bc596df2fbbce36542480c9003e3f5777c06e3dae72afc30dccbb47750751
SSDEEP 192:7R6cBzgPvyKROzsv72ymwhPRpuwlcH5IDe95Hsb+WNAnHGrRNWL+qmnpa/2IQnen:7R6mzg+4QKXm7w7WjAK2IE2DlBge
TLSH
T19462B66FA920297B5DEBC226F811BB66E3F1102666D01D84EAFD8E1C14E76CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5b485d34d323276c834eb34d4bc3073c3510e4e6504fba4bc3355c5261384a20
MD5 4bc758d7ee1bb7a3dd546c727fe23f21
SHA1 b28d85a7392829998a7bdb277dd75f13ae12a827
SHA512 f8699a77823d5b37ac3b61fca3620184ceb0a1d8468c5fdbb9cfbb9f1491cae8c81f3f7454bd3f92a2b49922d33e30569c5f61f0cf873c6e1ca75a28cc30466a
TLSH
T18EB0120294416222C04607B4128614C871549F11960A170193E86966C8351618014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59300f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59300f.TMP
Size 96B
SHA256 f79581a8637ef3edf3d1ff4b22deefb229c03a615f4653b397378eef0199d4d3
MD5 61d63a74ccdd836d883403b3c6c6db3c
SHA1 22c10a7a454604b506d4f9f61a682338f1d3690f
SHA512 9aacf36f2abf16c74b18b794ae0d052b930d98f1293d79fac4c358aa45a7168c88fd278f3e25f6f2d72abab48c45081d726b7cc9bd006d3e140d2c1e5543bb13
TLSH
T139B02280C202322AC00203B022A080C83338EF30C20B2302A2E00AF2CC303B00220320
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0b202c80743c8849138a39056de51ebbe1ac2b00ee4af7800faeb5666f1599c6
MD5 7cf123cb57b351d9bb79b9781d3b269e
SHA1 3647b23e50f02555cd84c8b2869d197f73c5e3d1
SHA512 6c6cd6f07e2e9f5164daa6ce4ac47cecb51c5f20f7528ee46e140bcc1748062ea3269a7dcae648a0acce43f32d4eee8a3bc24aa47eb937ed57e6eec1b24f6d5b
TLSH
T1E1B0022841510973D648337D17D5DAC1B33A0E3553CA82E655B18095DC256FF6321B48
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 c5c4095fa08874fe3829184d1893905fdeb1032b5de626dfde64336995979d25
MD5 b2917b5d865eb45d2629fa6c6373bb42
SHA1 7edf7d14d96dfa1a67dd5ec6a76e99f781b878b5
SHA512 fdda971d44682df66e593c5a02ecadcd9d3719c5f2f0288510d920e20646e0e7b164f303b7bae07f6476e329ee58819f55d1d05aabcd076ef93e2b54a2c47618
SSDEEP 6144:hLXKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:RacPZ5LA9C3wbfqZ/piQh
TLSH
T1F834123BFFC61F239A92C7656412261A2FF50DE7E424E502F68C3E8B58069357E0AD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 99b9588e55c958183e0e05cb5707fc66fbd6bb021ed9b8887a345130adfc3b39
MD5 8e291609cac391051979724f7f677313
SHA1 d4b81001ed7dc8aed19a88f507871966c5aaf230
SHA512 66d3a5063ed293304b551c470c3296425cfd51d51e98db67942c3af0eb6f6d136f6df0b6979d85eb1d4b60ec613cd3a44868338fc4f14fdffd37b346d6974608
SSDEEP 6144:i9XKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:OacPZ5LA9C3wbfqZ/piQh
TLSH
T1CA34123BFFC61F239A92D7616412261A2FF50DE7E424E502F68D3F8B58069317E0AD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1bafd4beb8a02f7f4b1f559715b8458d916defe3816efc8c12d00aa77db5c48c
MD5 91f76c0b7fa4e4a25a7a922afc9e5ebc
SHA1 29aaf0d1d4b7cf4086417c0f0563eedcd4c7861f
SHA512 008147230bc1a3b548672a7ab4b16a0ab223aaa7a871f0cda8b20f4d7362a80e41bd6221e2ba78f927b3e0a214a32b9c19f966338a2e0b665e153398c0c46691
SSDEEP 6144:afXKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:afacPZ5LA9C3wbfqZ/piQh
TLSH
T18C34123BFFD71F339682C3616453165B2BB50CE6E024A602E79D3F8B58029757A4AD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 78b238d0592d0176b26aa4f9c690305b801ac9afd201b38dafddd5c0601d6592
MD5 0dbbdda5ac17b4cd0ab799f49123a748
SHA1 90fbf6fd6729b670207e43e998939023dd35a1f5
SHA512 306f72847219f58ce3fa1fc6ef1339f3cadf8085f1d04cc10aba35ebb634a678addb069464e2b1db27f34410b482de26ea5e7332044df8a52bc2c5fdeb20921f
SSDEEP 6144:QLXKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:iacPZ5LA9C3wbfqZ/piQh
TLSH
T14E34123BFFC61F239A92C7656412261A2FF50DE7E424E502F68C3E8B58069357E0AD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 75e19eb1b46c55c46a7c327a9cf5e80a7029cdc32fab921b3286afc1ced1d598
MD5 b557e2c56779ed9db0d44a196ec17060
SHA1 41437eab821b59e4bebf4c029bf07390fd3adbd7
SHA512 6f0eb2edb16d7bf1dcc318547bd5bb182bf40f20f69267e6ca744b0c981b3f4cb40837327ed84381df11930bed32abe62a4ba008009f4aaa85b7023f05c5dc23
SSDEEP 1536:THQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:eqfd7NtZL8cHQRZEQ6Spsk
TLSH
T114C30237EBC21F339D96CB60B9530FD697B644A59034D301AABD77AF6C83491684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 bdaad44e808ac281efd3f0af405076a4b8f2aedf609a59233c6605222bf5862f
MD5 21c8b71680249aa70da0402b1a732698
SHA1 56d0b1d62979d69afbe40088e7a0366a06d89b69
SHA512 dbdbe2f3fb93a2fab7ad010ce057d6f189af669852a9d646ec98685f3b74d976548fd6de8a0c7217d930d97bb88bd70f008456ac00c32abb8d9cd126f3016c43
SSDEEP 6144:WLXKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:cacPZ5LA9C3wbfqZ/piQh
TLSH
T11234123BFFC61F239A92C7656412261A2FF50DE7E424E502F68D3E8B58069357E0AD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 81575b168047734017043dac4bbd31de95aa799bf30206ea9cc6d4a57182f9ea
MD5 ac7036b556e2039aeb2e8018cfeb0132
SHA1 cb43495c4bdd93a56e64434101691bc2275d4222
SHA512 85c1b908952f2ef29ecc3453ef3270e5702a8a36c942a9f992285b1da3cca1eda9551333e4c1e5dece68eadc77831e9c8bc1afe91029defc820142b557c507e5
SSDEEP 6144:gfXKcPZzrI/qLULsBaCI0pH25tfqZ/ZLW3Exh:gfacPZ5LA9C3wbfqZ/piQh
TLSH
T10A34123BFFDB1F339682C3616453165B2BB50CE6E024A602EB9D3F8758029757A4AD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 67KB
SHA256 5e9ddd849c267cf191b2db00f575728d4b086f3b4fe31417a455bf0f4816514b
MD5 088ec17d4fa0e1202159915b03be22a7
SHA1 382daed964422de3fd5b9868d05253fd3ed4ffad
SHA512 c09cec454c2ed9330ae55066e690a1a017b3e401875a01df398872a7077ef7dd76b81cb9a5bd8d65e49b6170013f977a348e8b15467a9c96e1dda3dd949a030d
SSDEEP 1536:pAtMV9QuLlHIH7W6u5giUEJ/hnyydpMPoIShQg2WnFIZ3:pAmV9zZr6u5dJ/oydpMPonB2WSZ3
TLSH
T1666302B5D4F9178620352C8EA4F6907428EBA7F47950E9F050C4DF488DD8A7BAC08BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 405KB
SHA256 1b60a6c04cc80fa726e3c5026255272c3b75303cc1666700305b3f9acf8b2226
MD5 e6b338d0fcf0d823a1874c7606dc62dc
SHA1 501f5d87f43ac13f1545286e3fde99eb15c5c5a7
SHA512 5cb49ce345babefaa0b4070245244a8cf2611000c2fd124532f43c764022177192f62a14090d3b5945544449788612326e215446cbe5f1830c4309720cedeec9
SSDEEP 12288:Ph3qrs26+46/k68I6l0X7+uHw8AVTQPUg2tQVy:PhqrL6+vkzI6yIVkY
TLSH
T16894237C930EA8852F3F559A617D2C8A1884F8F5CFD95E81BDE3E7E150A0D090B5B328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 78KB
SHA256 372140d055fe4434b65daf2fa2e6a903918f7ebd5c79b058e8272878b397b35f
MD5 6c95f9c283fb402cb287379d5efd90cb
SHA1 e3f129bb595d45e732f14bd031607984cbac31f2
SHA512 15613cea5a463ca70483a0bb1c9a1c7c6c09f2a35c3a96d34ed14f35457eda904b3643f84bf9547b5877a0a852f292c7e91a5079737cbb223f6a91019de13dfc
SSDEEP 1536:Cyop/ADwXZR9NSqrdcgTyt9QaLKEo9mOBghhbj+p84vpbQOJdF:4p/DZRTSgdcgTy3QaLKEo9dK/W86p/F
TLSH
T16E7302F77B364E112AFDFB653448C269D3C0BA859B39194E62C4D1F240AFD36ACA1874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 a00ce0339fd73cccce6524cd96a42ab7c206da671890492e079a6630e6b2e398
MD5 915cfbf8eb845f776a527b9235c6858d
SHA1 34cec1614b280ec299d824289bd6105a823dfa4c
SHA512 c242d92b0f384104ed0e6cec30d62fee7c6730f0e9d0ad03b5e14b2c44f6827081f51a33cbf1e7399fec39bdcdb5523f67d96603752ba6ab27c29a3cbd0c3c91
SSDEEP 96:0HRhjhqsJUeirdq5iu5BZyYUc6Dzp+vPR1Ah+ESMCktxsXoCrNM9vOoG8+ESh15o:sT11ngigtVO2GXubF/
TLSH
T123F1ECE24CBB8DC0EF55023CD8E58DC9B4B17C66666B1FCE8044577D563AB83A587720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58dba5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dba5.TMP
Size 3KB
SHA256 50c384f0d723bb7ca557fd6e21582dc854ef9dc3ef29f6dd90897f0be17eea77
MD5 e6929e04bb9e02ce98baff25976e3145
SHA1 a779be5422a5757582db9ba6cdb5f59138155b8f
SHA512 2a8bc55315cf24d3f09d0c0fb26da0adae8a77183f127f28cf4774079c14c74c6f19a72a88785036cedaec525f5c88f2fc1d0e820a6568755a13b6f49dea6a57
TLSH
T15A614DF8454D0CC1EFA21230E8D19E0AF8F29EBA89770FC5E54856BE2505B60C24B330
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e6cdf7db8a9d4e2b144dd201830e2c7a00a3f8bce1715f2e32b158001934145f
MD5 ed7a0944ec7b17c6b052474bac855280
SHA1 2a904ff7ca07f5880980948d53657c6405a1d347
SHA512 07c20fe85e65f82bc643d4d806d15f0efb2d131b0f02571361269787bf5012639d566cab60daf092577cdb1639bc971d35f22b40a94b1dced56069a45153f06a
SSDEEP 3:MsEllllkEthXllkl2zE/laT+t:/M/xT02zE
TLSH
T1E7440405FFC04507C50051344057C3D01374FC101713574735510437DCDF7400C10110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 86f3b74d6f3a2aa5db4595b693beaa35f339966bffc405d9127ad037dc5b1c8f
MD5 6c26bb3cd7acfb066707f2ada4ed0d93
SHA1 b1f88597b5878bdba85eda38b229a1a78bccc765
SHA512 c884d3555858e638459885647565a8ac304114ca69397dd8d4f16201c214c28d1bcef09ccba1c130b80727f834ff0d7936977107a10af7ae00bdb0a857b5c055
SSDEEP 96:DvhOnNxicDgGtzo1uXiEezcGO5HK0vRB3pGtwD1x:DvUnNxiigYE1uXinzc75q0vH3pGtC1x
TLSH
T17FB189F7C3E6862DC91196F0AA146F1BCE1C0946836C3D1AC4D4AF5BA3F24B1E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b6d741bd0814549ba72604b35bee26449825dfe69773d44375ad5f3cd0065ef9
MD5 6d4136ca46f3f77ffe2e9e61f9e63452
SHA1 f7d05f86ba9744ed61407d33fc41809befc4ff2b
SHA512 0a639b4c419e44b8a962422181d7d72e663ef178e041abaababf166609d7433ae967e9ccf2b6dfdd41bb67de2423d50923ef9d3a90b22aa3d33021cc8b1287ff
SSDEEP 96:DvhOnNxicDLzo1uXiEezcGO5HK0vRB3pGtwSx:DvUnNxiiLE1uXinzc75q0vH3pGtPx
TLSH
T11FA198F3C3E6862ED91196F0AA146F1BCE1C0556836C3D1A84D4AF5BA3F2471E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c0b35525515cdc07019927c9a794f54464935077d12df7672012ded4b838afb0
MD5 b2d86ecd4ed81e4fd800ba1c62f62415
SHA1 bd453e3d74beebe4f3f70a925b5fbbfa677c83db
SHA512 5bd2196435a62b35d2e76b47a9c284b2e6d705cc69c52a36b62a827ba4a37126e13eae9799ef478b78d3036dc5812029ed84dd629e921d12c9f175809b161db7
TLSH
T147D02223360070B9A6ADBEC994AAEC8FD33600208E62EED450E4E89829358AC450F140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58a1aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58a1aa.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 63614e2d3fffc3ac62ab89886fde11809786eb573f2374850003e5eb3b255749
MD5 7cbeedf354865710a65403a50063c069
SHA1 8b6fa211ec2a1523a56048c74287620f931ed218
SHA512 8ef01a6683a79c4fc90d19d562e940b2a9fdb231072a27ec91d47e6013f0e27377ed425a82413b7a54af00b2f509ceebac2a128501e0ffe739fe332dc0c3eb56
SSDEEP 192:sxZaR8yM/jK1Ml8M9d/fUtsz5pTIdpJHW6+WNGYHl0B7IgrJ:sxZa21d/fQsdpMJHbG79
TLSH
T1E142D7166A346977CCCBD209BA55BF53DAF50472A2900E54A9FCCA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 9837f0f1e0a6a6efdc40e83426e94e03c2cd9e215590e5e19508e31a73aa99b9
MD5 c4bee7911a2d94933f4b6da77ae7b73f
SHA1 62cacd547c812ca4f0a9782d534757ff3a1ab20c
SHA512 44bc1694fd490d480085f23d746bca5a604699b0979809f270ea0266b54fc293910ef7eee5555c512a6ee2aceb6c8fe0c9c061366b270b065cedd4cd0d7ba65b
SSDEEP 384:sxZxnouHm4d/fQsbWviSevGosOGlsSHbV4/LTrx8S:sJo+m4d/fPYiSevbrG/HboXFF
TLSH
T138A2E6566520897BDCDBC609BD32BF22DAE40063DD914E5C99FCCA0C04EA6FD2316C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9b3fdd19275266add8c7ae992a9069c59a2ec10f0c350162644b49b5f248baba
MD5 abf6c5b8fda30432e9b32d3539ec3769
SHA1 65cb7764256bb062908ea84524932eb83e8d1340
SHA512 bff3b9e020329ba3b59cda74a60d5c81dc5d6c8ae10901f144e55e6bddf00395638835e74c28870a31fb10bd18bf3dbdd38ced7064002e4ea06f92bf480e612f
SSDEEP 384:sxZxnrusm4d/fQs/SgvGoMj3Hby4/Bhrx8S:sJrnm4d/fLSgvbUHbdDFF
TLSH
T15182E71266249977DCDBC209BD22BF52DAF81463DE910E5C99FCCA0C04EA6ED2317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92598047a25b45acb48a5fa47092378bf4294e3ccd268f1ca99c21f01ede53ee
MD5 53888f5a3efcc78e2aa1c0c553facd5a
SHA1 1e0885dfe2c8a719b5044cca8f020e627c6762fd
SHA512 f74dc6d7296302392de02ed1a508d9908363b1c8a0053dce33a15cbf6ed01bb65be67898608e3b7b1f0be46f145be4b6ee9083f5f0d2c1b84a952cb6cfa256ec
SSDEEP 192:sxZaR8yM/jK1Ml8MWPd/fUtsl5p3UbnoOMdpmHHW6+WNB4P/YHT0B7Ig5vlJ:sxZa2uPd/fQs/p36oO8kHbe//hP
TLSH
T18962E906AA24597B9CDBD209F945BB53D6F81473E6900E58A9FCCA0C04E6ADD2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8c05fc853ea520a8e5f4660a8365a35ad0e07ddfbdeea1198e6be1a4760c2520
MD5 28284b6bea76012d93182093bf98ad6b
SHA1 693ffb5e41ef84cbb76ac1fe6bad23a4ccc4b65a
SHA512 365c4845bfb7f54403fcfcae026a27a603997d2b908dbcbd15b6248a3ff7b0070503147892f894a4e3ff7837ffa6541b8058b30859163ac3eeb748d874ff6aad
SSDEEP 768:T+UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RAroVt0Y:T+UZYTMWvg0Pou1ja7eLZmRLUY
TLSH
T1A0D20B2F280CCB7E4F844E5DEC266F967ED801CB6A984D5447EA884C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 07628ae815867b19c700b63fdeb1c0082c7975f648a3f9df0dea102fb6d05a7b
MD5 30a5b3c453251509fd67b18f623580db
SHA1 b0431041a2bb648295bb8a2d448f6183342bf5b4
SHA512 3e6c11bdfd37000df70ef8f52eef042d077e96b38170fa7d3b9781d43f015237623e836e4cfd722bd329465793c274bae3a4b71e68ae660f94ab28f6e59f6f7f
TLSH
T176A0026003C08086C95256B12A6246821300CE141345930759910049CC524C08D8940E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 2ea8d596de4a3aebcfc9526de81226c3f3e3c9f1b29f78ddba5c345edfc3b54b
MD5 ae34663b08f204c207cc86eff3008cac
SHA1 947ea7247d29e3130fb0856669d1d46bc93b6424
SHA512 27a4bf57b0451eff709e864b4d228b44cce95caedf39f591d8d76604e50ea52a295d7fb8a6d13e01858a5111b7d100b3ec356d084c72b86e642a2e95efc9fc2e
TLSH
T1FDA0022542817042D91317B635EB456523504DA00202D32941E1054CCCE2745494171C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 191731001da38938c21a3f9bffb09b7d454a84ba95bb50bb20db56a2bc16d3df
MD5 d8ccfc9acc4ea0702ba1e0e350c41d34
SHA1 c1eb4f9d9a4ba6e30e110a5d6f8b8a7a08f643e6
SHA512 4ca18c807a9ed90244e52378e493fd7bfcb1b309ccfd57b5281e0e2a94b580e37a685f02633ccf542bddfe05256d4ba9c6e75d0a1e3fcfe6c7defa330682d86c
TLSH
T17451B44F4E518A6FD9A852B714B264D037748CCD1B559A2328EC1233EE83669294B2AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 6260f534d7dc771641d8a5f428bea73867729f1919556966292098debdf916ee
MD5 344e15859ed180cfa1df6dfdae84188c
SHA1 0bcd6cb7f0b91c75af5773b80257b2d3613bc6a7
SHA512 6b34f18515382b64a3b1d832389e8978b03cf74d53b3704e3584218e864cab19f652ed2610a4f3688e3a99483e72ade1aeff80b63fe609c736e4efd3733406c2
TLSH
T11351F70F4D4A2E6BCAAD11776CFB18C43735A8CE56888B1760CC5132FCC72352C5A725
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584d40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe584d40.TMP
Size 2KB
SHA256 cc1b2a154333431d17aa9ce4a92f8fb4bd282d396fd27c529ecb09c91f91c9e3
MD5 4cfdf6c1d60658f92803beadbf2709ae
SHA1 97703fed5476b835b8f8da345cf6fc52429bdc19
SHA512 785b35715b15db671d5fd1153d8dc165d3e30162d408da2dfd3988f36467d26f93bdd0ffe215954a1cf483fab8727cda87c410d37ad2b69e027071a79ee4c963
TLSH
T12951959A8E428639E9C441770AE3A4B4373925008719BF5374FC9636ACD27AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4da5ca3cc31a31bbbaf9079f2f47f817989c23d58a5ac30ad9c6323990736268
MD5 fbb535a91539bbf7a49b2498665bc8f7
SHA1 47f5509034809cbb3e85e690e3b81629df7ad645
SHA512 3e4fbd0c706987b5a061a17d93e01582902ab6dd4e448ae360afbf0340c606635806fc99cf13a312891ff01529c298f3f9e249c8d1b1b194fe8785abf5619510
TLSH
T18AE068F33EBB1910AC6BD3D64471A4A4050238A8C64CAD8E00AAA2A310B2304280AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b2e8025f6cd72343a2a55785c86b5237d81cee91037fe2fda08b3ec6f88fe0ee
MD5 1800408d62e200692ac1ae2324f7b6d9
SHA1 d636a676dca19e5e3238e2255d8a9d63ef74a2df
SHA512 9127f24d0de10596e73d4f32b0234049c120b704f9134c21805bbcbb8562fe7d7ff8e6865b8af47ce951b0903bf1c2e304bd250856fc4ef86d6fee803e3eb3dc
TLSH
T1B8A00221CB94C181C11003749B715184AED5CCBDC605331543AC20548C7D6405593204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a4b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a4b7.TMP
Size 48B
SHA256 ba190c82ba88195ec8e211e160eb0025f7adc347714eb5ee8fef6baa6be81ea5
MD5 f6cf203fac035d6221fc4b5f0c1ff4ae
SHA1 7bf2fa7d877ffc929efd5544d4ef80c35e226397
SHA512 548828639d354fc229ee107af1a5590e88cdf6973ae7a4726ad68c322be02b01e866590998608f91074da067de393b4b9cb24b516b71bbf95a67e2f736eebeb6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 8KB
SHA256 a6ec3b2d343e055bb240af2b6979e058307ffc8fe6d2e87f9302681c0d76d530
MD5 b9b6ca1e02623f77f56ac9c569960bcd
SHA1 de561a96037984361b34d04ae7102627becd7fe5
SHA512 6c51dafeb3a01771216d7dada36012427fa2b0900bcf36cd97e56ebe0a7b6ae2709e9c217086a046b815684c32138ba6788da59aab90af1ad61d372f3417d7ea
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaEggKZmGi4R:E0VFFjnonz7
TLSH
T1BC023615327A02113C3D260D85D697ABDAD2B1637418A46B7BFD00B18F66E218EFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36eed459-0228-41e0-9bf9-5b1b1ea1f00d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\36eed459-0228-41e0-9bf9-5b1b1ea1f00d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5f1e67d764b7181a27468440d66270ede9113617d2d524bd56c5c5b91b45f0b3
MD5 cdb768d13bd97e69f50737d231ba31c8
SHA1 86afc0df482f09d13bdfb42f23a6e6f12fab455b
SHA512 7f3093bbc879c0f855277e5f912b05514acec95fb97f73fa1d77dc6d35636b413498820c320e732b94f841951a356261b77b39ae1bc1f00eddcfd507cc46cc10
SSDEEP 384:t+sN6zP3camZuzX5od+V8ykVVX9tJrOm5vu:t+9EcOD1/hOm5W
TLSH
T1F0421936A568AC775EA3A586F4473213AFE84067EB882F94D2FD5B0C01DB19C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3457280b8b906e0236c290d24dfc7ea856bcf2682ed13fdaaadcf7923a0f3321
MD5 1ac034a7b149cf2a3f97eb3cabc6de8e
SHA1 7e331da01011c3d27755949f155668121af30a69
SHA512 aca1f824d9f9f75482a63984b04671bc676f3da9348dafc982f1fb6d56ff3b45075b6f608edc10664a9e1680f6a05e25e516daf471a4f2852eb1c4b650977a1a
SSDEEP 384:iyiFGZcIZ/sNZ8TUNTUlIlZT93chDZyzX5od+V8ykVVX9tJrO1QlvzViEuswSEsy:i5FUF6wg96YOD1/hO1Wxii29a3v29MC
TLSH
T181F26AE184D75DB6D8AD9BC7A76DAC012ABCC133B5584958B3F4A62DEC4B0BFC311811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fa8c4e11347618d56bfb6c614f2c886c179a3d02afeacbd34974fbc9e3e425fd
MD5 88ad205dfe5936c9b77b516c158cebb8
SHA1 a6aec55b18c2e9ce3b3f8eb5de17f53583f64f11
SHA512 cacbb6712fc6c6cfdc93ea7a4e73cb83a022f72eabacb113cc342a9104195900cad768a1236990183599ca56fcab6766c51b4dc7626a39a100d05417fa381451
SSDEEP 384:iyiFZZcIZ/sNC8TUNTUlIlZT93cAUZyzX5od+V8ykVVX9tJrOO5OObjI9G6w7pWz:i5FxFzwg9qYOD1/hOO529MC
TLSH
T149D229F258D79836E9AE9747B77E2D125EBCC063F6945A90B3D85A0CCC560BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 756fe8065550cd6fc5d94e59a73e96de85196ddd22fc303d90c89a4adcee9cc4
MD5 e076d0c0b8ae2a1771341b239ef4a94b
SHA1 6b06fb4eb98e23a9a3d0b8e7c0a1691ba7f39ee3
SHA512 232ad5419369c8ea8b1120e32ee1d714a37def4ece8c1ae591cc0c06991dc85453a30fa5151642c536e324990abcaa7abe9cdbdc407dbf16b20e9d136b7d5d9c
SSDEEP 192:yONL61VWQmiUyYbgGX5Obd+j1jzorykaoX/ak315U6:yONL6WlgGX5od+V8ykVCO5U6
TLSH
T1C502C835A8686CA78EE2AE4AB48736135F95106BEA552F84D6FC1B1C009765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 319e77c1bb624af8050718eb6028c2e69d2a72ab3e197dce48f14b4c7b46d9d2
MD5 85bd0c1d3cff10937b6e79ccfe5e565e
SHA1 b3d17ed9655ea26dad4dff5d602c9bedc392c097
SHA512 abaf40e415b4d57da0c7ac42c469e6b4ef465cce86ac2f4b132146bafdb0f0de603eb8980f8a210a3e4d1fecb07859dfc4b2a5ebf5cf9106fcfc59e6afed4220
SSDEEP 384:tDsN69T93c1RZP2zX5od+V8ykVVX9tJrOm5vu:tDN+1qOD1/hOm5W
TLSH
T19E522A36A568AC775DE3A586F4473213AFE84067EB882F94D2FD5B0C01DB29C131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ec133a1ea018c980a3620dc462ee3d21332e29a79de86c999f8e5bb2e7c8ef65
MD5 b810c5372c785c367c97357051c87b4d
SHA1 53047740332172640d1bd6d048028cca573158e5
SHA512 f45e25c75557a56e426425a6f0e7f6e61817be8ab0b6a4da46011e7c2fb546dc91fdd5fd771ad22a4c82a037226d3aecc11991c94307dad83cbff116173e5875
SSDEEP 384:6LZcIQsN61T93c1GZyzX5od+V8ykVVX9tJrOm5OObjI9G6w7pWz:6TQJBYOD1/hOm529MC
TLSH
T1CB928D32A838AC77ADE3E156F48635135FF89077E7982F8492FD9B0D05975AC031AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0e1937e6e3e92c9a111d84ffb93c34338b0ebe6a46a7c0ad70402b640e725de4
MD5 40e2038f8d7c81b55737108197471bcd
SHA1 bcf1acabee889382a5890f5d17a9584a950239ae
SHA512 98e34e10a64ab9cbdd7f1c28abb8a1cd25ddb211da99d606e38373f84d0feaaccf7ced06f8c647416bd045c9ad81bda21407baa7abb475cb8fa193fb9ea38c3c
SSDEEP 384:6LZcIcsN61T93c1bZizX5od+V8ykVVX9tJrOm5OObjI9G6w7pWz:6TcJwoOD1/hOm529MC
TLSH
T187929D32A838AC77ADE3E156F48635135FF89077E7982F8492FD9B0D05975AC031AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d09b0eea683fb595bbe71b950d5b7e1bed407cd366b4085b9ffec1153734fc71
MD5 6bd66eac1796fa4d43ee013a391e312e
SHA1 71fb33409dd9485e39b762630625a2f0116d9b95
SHA512 9c69e458f790ff1df36c1a4b07d314b15e6b758662db500957d2d402549fa5f85aab7172dc8f06ae7e21b35a58558278abeb7f9443c7242f7586268cc7f724e3
SSDEEP 192:lOND61gWQmiUyvbilGX5Obd+j1jzorykaoVX9ySJrOVjJYqk4U6:lOND6tsEGX5od+V8ykVVX9tJrOn5U6
TLSH
T198120836A468BC6B5DE3B595B48731139FA95127EB496F80D6FC2B0C01EB5AC130EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c329d7f-0e31-4b17-97d2-8b25fb13b299.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c329d7f-0e31-4b17-97d2-8b25fb13b299.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8efcc08cf2022592b00f5f57951e96da7271262a5f319f18253cbdc1ab85cd94
MD5 bb61becdefbc94e0d9760ffaba14c857
SHA1 558ddafe52e06f850529f36c1838b80305552f9a
SHA512 d0d7580a591371c7d5c193f2a7b4db2129d4bb912b11e9e57ca8041241e61f9cd2d2fed2fddd3dca923590c77148abb3c9afa4b0af60a5cb6228f2e6bea5e503
TLSH
T15D413758BAED1018B3B76F1A9BF7A9AD487B7C771E0AD05D10110E4F0666F40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fa47a80222571fbf76141f26b784d2009e34a7fde15ddc95a350a2b0b90201fc
MD5 1d25c372334c4d12f5d7a3cf3ea0290f
SHA1 ffdc9c241c1134c45f38bec5580509272882160e
SHA512 35ea4eb141bfd36698871e76a9f0105ea6a074df6f2cf8349c411a899f0779e6418deedae0a522c06e0e3c22e7c1799d94b76104fe7bb7b1a536500373505245
TLSH
T162D0122672850275C01020330103710D2744C21F802640005429951E5A640501A46442
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2e7341f9d2b27384fb3860d94191325074c5ff7aa04cf810b003132d7831d83e
MD5 65404c672e962162cf8d585a1368bc86
SHA1 98a0fe3e1058b6f4c530ab4572beb1b63fbfaf6a
SHA512 c7454acedf6a19bd64cb73b701f1e7477c27a31aa3e0668364160447172a9f66cc6af2b8c5963f4bd94f00b308825a30500b63dfb1f86a4f9e2d488839bc1111
SSDEEP 3:LstlNllkll/lnsq:LsX3lEts
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 226e9f399cef3d5f817e29506038348da2f982253f02e491908a5c3a2d81ce18
MD5 f20a4c13b3e2dde9c9f7856128ce551f
SHA1 9232ae80e64c6aa932787d6bbb3a28c6b7a92684
SHA512 79482a1fc114b83cd004f3edf567862a804bc2c61bf5b4dbd59880d605ba5f3e81beff6c4c5b9b018961b8d3b281074a70a74cf630a47a6e5c0f74c17004b466
TLSH
T12251A533B8189B3389E256497D462F17AF715172F7622FA0A5EE0B0D01EB66C2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 215250eb31e2ab73bc440b1fd2c8670a92157d9a19f5df1e0c36f24baee942e0
MD5 d4a5eed839e0e065874a304233b86af5
SHA1 16216de7849da3c8f88122c61788a5e15b6c74a1
SHA512 37d370368075d7180cc8dc9a5493b095636f55314dd0448496dc7a0058124472e4bf8b621f954e026b9afcb9f0bf43a0314d03c7be46792e181197708b5dc785
TLSH
T16E71B637A964AA374EF39A457D862B167BA15137F6913FA8D9ED0F0D01DB3982302C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 6bc66108637103d88ead132a506f5351ababfac5ac232eeec7cdee77ec0f89a4
MD5 88953270c1c9cb3bb7056e07240fb69c
SHA1 f0fb8b05bf6e0bfc01399a2ebd29cb1b1091c621
SHA512 a47be2fd39be6312d177454c0e921e476af5ff058db349aa69487a8b70c3dc208549b6e8f6dc09ca3dba83559d3834372a3a591d574e1f3487739ea6a0bd85f8
TLSH
T1E381B536A5649A374DE2DA46B9863B077BB14037E6A13FA8D9ED0F0D01DB3982342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 8abc6e7f4bd9cb3cd21289a2c202d0e7be3543a69c1a750896395b09bf95175b
MD5 6cd66238facbce5ba7a2f025d1b8f0e6
SHA1 8fe7c73389223464d5d6821ca9e3956caace6570
SHA512 41db9e946f97a0e7cd69058e82b3c559c7f86d1ec86f7613492b3632d887b3a5cf728ce5278206e28b1df0c7d927bf33ad31163f56850af1f0e949224f958f57
TLSH
T14431A773E5951F32AD91624B35436A5B2F701036E2210E44B0EE4B0D02FB69CA237C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5b5689.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe5b5689.TMP
Size 1KB
SHA256 750859213da37c2e24e3a61a8fd038f80574687db1dbed615b1cdcd6087fa3f5
MD5 e1dbd1b541757f714deb81d67a0d4328
SHA1 b1138ab4edb34bd2c9fa35d139f5fd2116d7b262
SHA512 b09a09f5d456ac7703f34075a276380c0bb2019e50c74b5addf1eda6d2469870f4230e6c018974a89a0d52965d8caac31e963e34a9c020b67735896453805633
TLSH
T1F1216533D5995E32AD81555A7543AA4F2FA05175E2210E48E0DE570D02EB5ACA237C32
MD5 SHA1 SHA512 TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 14KB
SHA256 29bb5352e0cdf0cd1907eebc8f5b051f780a0d230cd3551e281b0a852013f94d
MD5 1012ad5343489b804b8fd5b9eed3fcad
SHA1 7d9b8b9596c3f77d50af89a0e1a431dc7a0e6a45
SHA512 24d6bb21a5b8884716609d34bc98577baa3c4530a40346e64b63096908611706664e97a6ee67ba5d0b781ef6846561a8a4d882de50c261cf4e386338f155f95d
SSDEEP 192:fPmQ1J42k0PPPP2P4Q1J4wyP4Q1J4jPAQy:fPfT42k0PHP2PFT4ZPFT4jPAQy
TLSH
T16052F14927F66519F1F3CA72EBF63B615F7AF8269A086E1E41C082080D71F106A95F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 12KB
SHA256 9cff14daf37d0559a0229ca987b41daf32ca33d19c121fee071062bb80a99fc8
MD5 eb3d8218e56ef41ed91d2da7dbed82ff
SHA1 bbd6dd95edb9069fa5098679439e8b613fc6a5bd
SHA512 c12c03806f706266a0fe209aca08eae8c031d601c2dc8b231bad7a501411a0a1846d438ebb77472e013e87aa6ead93293d3425d0d5c2bff0501c92f641aeada7
SSDEEP 96:evuQSo4qJ4tyFx67n/1PZJluQSo4qJ47EpFaEnrluQSo4qJ47EpFaE932gdt:emQ1J42kdPb4Q1J4wr4Q1J4yGy
TLSH
T1A952F04927F56519F2F3CA72EBF23B615F7AF8269A096E1E41C042080D71F106A95F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 5c6d12fe6d14e0a4c36bc9c92e658871f0bb68763714e76f6297851a4522da0c
MD5 c16c29f468f747fcddee9de2653989fc
SHA1 e9b61a6da0c3025acd97834304e2ceb3d9d7b20e
SHA512 b9c5098682772e438d699d713c1a2652012187828eeee28439b2244c2895607c5adc25d926be08f44a5da573d467451d33aa6284e16fbef7ebbbc84fb9b2cefb
SSDEEP 96:evuQSo4qJ4tyFx67n/EPZTluQSo4qJ47EpFaEM33gdt:emQ1J42ksP54Q1J4LHy
TLSH
T1DD22014927F66519F1F3CA72EBF23B615F7AF8229A096E1E41C043080D71E106A95F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 ff31e9fcd0c6db1b139946bf5487ff63291c6c53476ce9c7a19f491157a6b84c
MD5 68e2c3db47fc2f5facc1df235c89cb28
SHA1 6f815035f8dd1eb438df88468bc9a9f29d2f48c2
SHA512 3e133a70f324cbbe0223ca63bace4874bd787cfbe4df17f697fde70d4f51c9743ce91dccc1e00f7b3c478392689559621d198db9f222e63663abe0b06b338041
SSDEEP 96:wZHJjuQSo4qJ4SF6wXFdDJNxu5OAJruD8JJnIut:msQ1J4WFE5dBIs
TLSH
T17702E0405BEA665EF2F3DA71E6B37724AF36FA0596085A0D4080420D1C62F05DA7EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 576766.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 576766.crdownload
Size 3.8MB
SHA256 c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
MD5 46c17c999744470b689331f41eab7df1
SHA1 b8a63127df6a87d333061c622220d6d70ed80f7c
SHA512 4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
SSDEEP 98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
TLSH
T18206231AF7A904F5D077E178C9A34607E6727C9D4771928F23E60A492F277909E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-2222-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/1336-2348-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/1532-188-0x000001EA57150000-0x000001EA572FE000-memory.dmp

Download

memory/3276-2278-0x00007FFB4F140000-0x00007FFB4F141000-memory.dmp

Download

memory/3276-2277-0x00007FFB4E4E0000-0x00007FFB4E4E1000-memory.dmp

Download

memory/3276-2475-0x000001906D540000-0x000001906D570000-memory.dmp

Download